Procurement & Vendor Management: RFPs, SOWs, and Ethical Sourcing

make or buy

Not every piece of a project's scope has to be built in-house. A make-or-buy analysis weighs doing the work internally against bringing in an outside vendor — comparing cost, speed, in-house expertise, and how central that piece of work is to the organization's own capabilities. Once "buy" wins, procurement is the process of finding, selecting, and contracting the right vendor.

the solicitation documents: rfi, rfp, rfq

Document	Purpose	When to use it
RFI — Request for Information	Explore what's out there before committing to anything	Requirements aren't fully defined yet; scanning the market
RFP — Request for Proposal	Ask vendors to propose a solution and how they'd deliver it	The problem is defined but the approach can vary between vendors
RFQ — Request for Quote	Ask for a price against a tightly defined scope	Requirements are fully specified; price is the main variable

An RFP typically asks vendors to address technical approach, timeline, relevant experience, and cost together, scored against published evaluation criteria — which keeps the selection defensible and comparable across vendors instead of an informal gut call.

contract types and who bears the risk

Contract type	How it works	Risk sits with
Fixed-price	One agreed price for defined deliverables	Vendor — they absorb cost overruns on their side
Time & Materials (T&M)	Pay for hours worked plus materials, at agreed rates	Buyer — scope creep directly increases the bill
Cost-reimbursable	Pay actual allowable costs plus a fee	Buyer, with the vendor's fee tied to performance in some variants

Fixed-price only works well when scope is genuinely well-defined — forcing a fixed price onto vague requirements just pushes the vendor to pad their bid for the ambiguity, or to fight every change request as "out of scope" later.

the statement of work (sow)

The Statement of Work is the operational backbone of the contract — it spells out exactly what will be delivered, by when, to what acceptance criteria, and who owns what during the engagement. Where the contract sets the commercial terms, the SOW is what actually gets checked against when a deliverable shows up: if it isn't in the SOW, it isn't part of what was agreed.

ethical sourcing

Vendor selection carries an ethical dimension beyond price and capability: disclosing any conflict of interest (a decision-maker with a personal stake in a bidding vendor should recuse themselves), giving qualified vendors a fair and equal chance to compete rather than steering the process toward a preferred one, and being able to justify a single-source award (going with one vendor without competition) when it happens — usually because only one vendor genuinely can do the work, not out of convenience.

a short example

A startup preparing to launch a product needs an independent security penetration test before going live. It issues an RFP to three specialist firms, scoring proposals on relevant experience, proposed timeline, and cost. The winning firm signs a fixed-price contract — the scope (which systems, what kind of testing, one round of retesting after fixes) is well-defined enough that a fixed price makes sense. The SOW specifies exact deliverables: a findings report within 10 business days of testing, severity ratings for each finding, and a free retest of any critical issues once patched.

practical notes

Vendor management doesn't end at contract signature. Track the vendor's actual delivery against the SOW's milestones the same way internal work is tracked — a vendor silently slipping is just as much a project risk as an internal team slipping.

Watch for single-vendor dependency risk on anything critical to the project's success — if that one vendor can't deliver, does the project have any fallback at all?

reference

PMI — Procurement Management