How long should a QA vendor selection take?

It depends on how much evidence you need, not on a fixed calendar. Plan time for writing the evaluation model before release, for independent scoring and moderation, and for reference calls and certificate checks, which are the steps most often squeezed.

Do I need a formal RFP for a small testing contract?

Not always, but you still need written requirements and criteria that every vendor answers against. Without them, you end up comparing sales conversations rather than proposals.

The vendor selection process, step by step, for QA services

Most vendor selection guides describe the same sequence: define the need, find suppliers, evaluate them, choose one and contract. Public procurement guidance adds discipline to that sequence, because public buyers have to explain their decisions to losing bidders and auditors. A private company buying testing services has no such duty, but the same discipline protects it from the most common failure: choosing the vendor with the most persuasive pitch rather than the one that will do the work well.

This post walks through the steps and notes where buying QA differs from buying software or infrastructure.

Step 1: Define the need and the evaluation model

Start with what you want tested, at which levels, on which platforms, and what "done" looks like at the end of the first quarter. Then decide how you will judge proposals before you see any.

The UK Cabinet Office bid evaluation guidance asks buyers to develop and test the evaluation model before the contract is advertised, so that it contains relevant, clear and focused quality criteria. It also notes that the most economically advantageous bid may not be the lowest cost one. The US Federal Acquisition Regulation, Part 15, takes the same approach: factors and their relative importance are set out in the solicitation.

Where QA differs. In testing, the thing being bought is judgement: deciding what to test, how deep to go and what a result means. Criteria such as test strategy quality, the seniority of the named team and ownership of test assets deserve weight alongside price.

Step 2: Request proposals

Send the same written requirements to every vendor. Include the scope, your current tooling, the environments the vendor will use, the data they will see and the contract terms you consider non-negotiable. Ask for named people, CVs and a sample of real work.

Where QA differs. Vendors can describe any team in a proposal. Ask for the specific individuals, their share of time on your account, and what happens if one of them leaves. If a proposal describes roles and headcount but names nobody, record that as a gap.

Step 3: Question the shortlist

Written answers show how a vendor writes; a structured interview shows how they think. Use the same questions with every shortlisted vendor and ask them to walk through how they would test one of your real features. Ask the proposed lead, not a sales engineer, to answer.

Step 4: Score against the published criteria

The UK guidance says bids should be independently scored by at least two evaluators with enough knowledge of the criteria, followed by moderation to reach a consensus score. It also recommends that the same evaluator scores all responses to a given question, which keeps scoring consistent.

Keep your notes. When the decision is later questioned, the record of why each score was given is the only answer you will have.

Step 5: Verify claims

Do not take certificates, references or financial health on trust. The 2023 US interagency guidance on third-party relationships says that relying solely on experience with or prior knowledge of a third party is not an adequate proxy for due diligence, and that due diligence should be tailored to the activity the third party will perform. For a testing vendor, that means checking certificate scope and validity with the issuing body, reading the SOC 2 report period and exceptions if one is offered, and calling references you chose rather than only those the vendor put forward.

Where QA differs. A short paid pilot on a real feature is often the strongest evidence available. It shows you the test design, the defect reports and the communication style of the people you would actually get.

Step 6: Negotiate and contract

Terms that matter to you, such as key personnel, ownership of test code, subcontracting consent, data handling and exit assistance, should appear in the RFP so that proposals are priced with them in mind. Raising them for the first time after selection hands the vendor leverage and invites a price increase.

The interagency guidance describes the relationship as a life cycle: planning, due diligence and selection, contract negotiation, ongoing monitoring and termination. Selection is the start of that cycle, not the end. Agree at signature how you will monitor performance and how you will leave.

A short checklist

Criteria and weights written and agreed before release
Same requirements and questions for every vendor
Named team with CVs in every proposal
Two or more independent scorers per proposal, then moderation
Certificates, references and legal entity checked by you
Contract terms in the RFP, not saved for the end
A monitoring and exit plan agreed at signature

What this means for your selection

Build the evaluation model first with the scorecard, then send the same requirements to every vendor with the RFP generator. Use the questionnaire for the shortlist interviews and the due diligence checklist before you commit. For the detail behind each step, read how to write a QA RFP, weighting a vendor scorecard, how to evaluate RFP responses and how to run a paid pilot.