The short answer
Before you sign, a good provider shows it understands the problem, has a delivery method with acceptance tests and a clear "done", gives an honest estimate, handles data and access responsibly (subcontractors included) and plans documentation, handover and exit. Price matters, but a low estimate with vague scope is usually the most expensive by the end.
Criteria that matter
Judge every provider on nine criteria; the questions below test each one.
- Discovery first
- Checkable experience
- The actual people
- A visible method
- An honest estimate
- Security and data
- Power and connectivity resilience
- Handover and ownership
- Independence
What to look for under each criterion
| Criterion | What to look for |
|---|---|
| Discovery first | Processes, data, systems, constraints, who decides; not a price after one call. Paid discovery is normal for larger projects. |
| Checkable experience | Similar work; references you can call about what went wrong and how it was handled |
| The actual people | Who configures, builds, migrates and trains; employees or subcontractors; meet the lead first |
| A visible method | Stages, deliverables, testing, your approvals; progress in working software, not only reports |
| An honest estimate | Assumptions, exclusions (licences, hardware, third-party fees, out-of-scope work), your team's part, cost drivers, change handling; which items are priced in US dollars and how exchange-rate movements are handled |
| Security and data | Credential storage, who gets access, whether data leaves Nigeria, copies at the end |
| Power and connectivity resilience | For work in your offices or on your network: plans for power cuts and link failures (UPS and generator or inverter cover, a second internet link), so the project does not stall on avoidable outages |
| Handover and ownership | Who owns configuration, code, integrations and documentation; can someone else pick up later |
| Independence | Resale or vendor fees disclosed, so you can weigh recommendations |
Supplier-risk practices such as those in the NIST Cybersecurity Framework suggest looking at who a supplier is, where it operates, how mature its security is and how well you can manage the risk it introduces.
Nigerian obligations to keep in mind
- Data protection. Under the Nigeria Data Protection Act 2023 (NDPA), your organisation stays responsible for personal data a service provider processes on its behalf. Use a written contract setting out what the provider may do with the data and the safeguards it must apply; check the NDPA's rules on transfers outside Nigeria if the provider or its tools are abroad, and tell people plainly if their data may be processed in another country. The Nigeria Data Protection Commission (NDPC) publishes the Act and its General Application and Implementation Directive (GAID) 2025.
- Regulated sectors. Banks, payment service providers, insurers, pension operators and capital-market operators also answer to their own regulators: check the current outsourcing and third-party risk requirements of the Central Bank of Nigeria, SEC Nigeria, NAICOM or PenCom, which typically expect due diligence proportionate to risk, written contracts and control over subcontracting.
- Accessibility and public-facing content. For public-facing websites or customer documents, confirm how accessibility (we recommend WCAG 2.2 AA as good practice) and mobile use are handled.
This is general information, not legal advice.
Questions to ask any provider
Understanding and approach
- What do you understand our problem to be, in your own words?
- What must you learn before committing to a fixed scope?
- What would make you advise against going ahead, or another product?
Team and experience
- Who exactly will work on our project, and in which roles?
- Any subcontractors? Where are they based, and will they access our data?
- Can we call two similar clients, including one where things went wrong?
Delivery and quality
- What are the stages, and what do we approve after each?
- How will we test the work, and who writes the acceptance tests?
- How do you handle changes to scope, and how are they priced?
Estimate and commercial terms
- What does the estimate assume, and what does it exclude?
- Which costs are fixed, and which depend on time spent?
- Which items are priced in US dollars? How are exchange-rate changes handled?
- Do you get commissions or referral fees from vendors you recommend?
Security and data
- How do you store and share credentials for our systems?
- Where is our data stored and processed, and does any leave Nigeria?
- What happens to our data, access and copies when the project ends?
Handover, support and exit
- What documentation will we receive, and in what format?
- Who owns custom code, configuration and integrations?
- What support follows go-live, and how are response targets agreed?
- If we switch providers, how will you help with the transition?
Questions a good provider will ask you
Its questions tell you a lot; expect:
- Who makes decisions
- What success looks like
- Which systems and data are involved
- What your team can commit
- What is truly fixed: budget, deadline, regulation
- What has been tried before
If it asks none of this, be cautious.
Warning signs
- A firm price before anyone sees your data or processes
- No written exclusions, or "everything included"
- Unnamed team, no references
- Promised savings, or no downtime at all
- No testing, training or handover
- Terms that trap your data, code or documentation
Comparing providers fairly
Send every shortlisted provider the same brief (problem, systems, constraints) and any checklist you completed, such as the ERP evaluation checklist or build, buy or integrate worksheet. Score responses against the criteria, with weights agreed beforehand. For ongoing IT support, see how to choose a managed service provider in Nigeria.
Limitations
No questions remove all risk: a provider can answer well and deliver poorly, so stage approvals, acceptance tests and the ability to change course matter more than any answer.
Next step
Ask us every question on this list; our approach is on how we work. For an independent view before choosing a provider or platform, see IT consulting and advisory.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Nigeria Data Protection Act 2023 and GAID 2025, Nigeria Data Protection Commission
- NIST Cybersecurity Framework, National Institute of Standards and Technology
- Guidelines and circulars for regulated financial institutions, Central Bank of Nigeria
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.