How a boutique consultancy wins enterprise work without an enterprise brand

Boutique consultancies rarely lose enterprise work on capability. They lose it at procurement, where the buyer needs artefacts a five-person firm has never assembled. The Australian Government alone targets 40 per cent of contracts by value, up to $20 million, from SMEs. The constraint is being contractable, not being big.

• The real blocker: paperwork with third-party lead times, not brand recognition.
• On your clock (this week): entity and ABN details, certificates of currency, a written security questionnaire response, a referee pack, supplier-code attestations.
• On someone else’s clock: an ATO Statement of Tax Record (generally 4 business days), an ABN sent for review (up to 20 business days), fingerprint police checks (15–30 business days), certification and clearances.
• If you are told you are too small: two side doors — subcontract under a prime, or get onto a panel.
• Finish state: a single folder you can attach to any RFP within 24 hours of it landing.

Why small consultancies lose enterprise deals at procurement, not at the pitch

The pattern is diagnostic: the technical evaluation goes well, the sponsor is enthusiastic, then the deal enters vendor onboarding and stops for weeks. Nothing has gone wrong with the sale. You have been handed to a function whose job is not to like you, and it wants documents, not ideas.

Most of what it asks is not a judgement about your quality — it is a compliance obligation the buyer inherited. An APRA-regulated buyer, must assess the information security capability of any third party managing its information assets under Prudential Standard CPS 234. A buyer with annual consolidated revenue of at least AUD$100 million must report under the Modern Slavery Act, which is why a listed company asks a six-person consultancy about its supply chain. The questionnaire is the buyer discharging its own duty, downwards — not scepticism about you.

The procurement-readiness checklist: what an enterprise buyer needs before you can be contracted

This is the list nobody writes down, because the firms who have it never had to assemble it in a hurry. Column three matters most: some you produce in an afternoon, some run on a clock you do not control.

Which of these can I start this week, and which have a clock I can’t compress?

The two-clock rule: every procurement artefact sits on your clock or on somebody else’s, and you start the somebody-else items on the day you decide to chase enterprise work — not on the day the RFP lands. Tender windows are routinely shorter than the lead times in column three, so an artefact on a regulator’s, insurer’s, auditor’s or referee’s clock either exists before the opportunity or costs you the opportunity.

The failure mode it kills: polishing a capability statement while the fingerprint check that gates site access, at 15 to 30 business days, has not been lodged.

The security questionnaire is the artefact that actually stops the deal

Tax and insurance paperwork is merely irritating. The security review is where boutiques genuinely fail, because it asks about practices a small firm has but has never written down: where client data lives, who holds administrative access, what happens when a contractor leaves, how you would notify a breach. You are asked to evidence a process, not to own a security platform.

The fix is written, not bought. Draft the answers once against a real framework rather than freehand — the Essential Eight maturity model is the reference most Australian buyers recognise — and version them. We published the security review our own enterprise buyers run, answered in public, in data privacy and AI sales agents: what enterprise buyers ask, with a companion AI outbound compliance checklist for enterprise. Publishing answers instead of emailing them on request is unusual, and it shortens the review, because the reviewer arrives having already read them.

“We’ve been told we’re too small” — the sub-contract and panel routes

Sometimes it is true: a buyer replacing a core system will not put a two-person firm on the critical path, and no paperwork changes that. But “too small” is more often about risk concentration and panel access than headcount, and both have documented routes around them.

The subcontract route is the one boutiques undervalue: it converts your problem from “can a small firm be trusted with this?” into “can the prime absorb the risk?” — which the prime is paid to answer yes to.

What the insurance and liability clauses actually ask for

Read the liability cap before the insurance schedule. NSW buyer guidance sets default insurance of $10 million for public liability, notes professional indemnity should only be required for professional services, and sets the default indemnity at a multiple of annual contract value, such as five times. That last clause should slow you down: on a $120,000 engagement, a five-times indemnity is $600,000 of exposure against a fee that will not fund it. Asking for a cap at contract value, or at your PI limit, is refused less often than boutiques assume — the same guidance warns buyers not to make supplier obligations so onerous that they deter suppliers.

The 30-day sequence, starting today

The finish state is one folder, current, that you can attach to any RFP within 24 hours.

1. Day 1 — start the gated items. Lodge the STR if you will bid at or above $4 million, order police checks for anyone who will be on a client site, and confirm the mobile numbers you hold for your two best referees still work.
2. Days 2–5 — write the security answers once. Data location, access control, offboarding, breach notification, subcontractor list. Date it, version it, and host it at one link.
3. Days 6–10 — call your broker, not your lawyer. Get certificates of currency on file and ask what raising your limits to the levels you keep seeing in tenders costs per year. That number decides which deals you chase.
4. Days 11–20 — pick one route and pre-qualify. Identify two primes already delivering into your target buyers, and one panel with an open application window. Approach primes with a narrow, nameable scope, not a capability overview.
5. Days 21–30 — assemble the folder and dry-run it. Have someone outside the firm complete a real onboarding form using only the folder. Whatever they must ask you for is the gap.

Honest cost: roughly 20 to 30 hours of principal time, most of it admin, plus premiums and any certification you pursue. None of it is billable, which is why boutiques defer it until an RFP forces the issue — by which point the gated items cannot be finished in time.

What being procurement-ready does not fix

Procurement readiness converts opportunities into contracts; it does not create them. A boutique that completes this checklist and then waits for referrals has cleared the blocker at the end of the pipeline while leaving the pipeline itself dependent on who happens to remember the firm this quarter.

Enterprise pipeline is a named-account problem: a defined list of target organisations, the two or three roles inside each that sponsor work like yours, and enough contact attempts to survive most of them not replying first time. Run in-house that is a part-time BD hire, a data source and a sequencing tool, and the honest failure mode is that principals stop doing it in a busy delivery month. How that top-of-pipeline work is built and run is set out on our lead generation for consultants in Australia page and, for multi-stakeholder deals, under enterprise lead generation services. Committee size, cycle length and what counts as a qualified meeting are set out in enterprise vs SMB lead generation.

Frequently asked questions

Do we need ISO 27001 before an enterprise will buy from us?

Usually not, but it depends on the buyer’s own obligation rather than its preference. An APRA-regulated buyer must assess the information security capability of a third party managing its information assets under CPS 234; it can discharge that by reviewing your evidence. Many buyers accept a completed questionnaire plus a documented self-assessment against the Essential Eight. Certification pays when you bid repeatedly into regulated buyers and the review cost recurs.

How long does it take to become procurement-ready?

The paperwork you control takes about a fortnight of part-time effort. The gated items set the real date: the ATO generally processes a Statement of Tax Record within 4 business days, and the ABR aims to review a flagged ABN application within 20 business days. Certification and clearances run longer and are scheduled by third parties.

How much insurance does an enterprise contract require?

The buyer sets it, and it is negotiable. As a reference point, NSW buyer guidance uses default insurance levels of $10 million for public liability and a default indemnity of a multiple of annual contract value, such as five times. Check the indemnity before the insurance schedule.

Why is a large company asking a six-person firm about modern slavery?

Because it has its own reporting duty. Entities in the Australian market with annual consolidated revenue of at least AUD$100 million must report under the Modern Slavery Act, and they satisfy it partly by asking their suppliers. Treat the questionnaire as a form, not a judgement.

How fast do enterprise and government clients actually pay?

Government is often the faster payer. Under the Commonwealth’s Supplier Pay On-Time or Pay Interest Policy, 5-day payment terms apply where Peppol-compliant eInvoicing capability exists, and the previous $1 million contract-value threshold has been removed. Confirm payment terms before you price the work.