Seniority often matters more than the vendor's size

Why seniority often matters more than the vendor’s size

A bigger consultancy doesn't automatically mean more competence. In information security, GRC and CISO support, senior expertise often decides – and how you assess it.

Summary: A bigger consultancy doesn’t automatically mean more competence. In information security, GRC and CISO support, quality is often decided by who actually does the work – and how senior that person is. Here is why seniority matters, and how to assess it.

It is easy to assume that a larger consultancy automatically means more competence. In practice, quality is often decided by something simpler: who actually sits in the room and does the work.

In information security, GRC and CISO support, seniority plays a big role. Not just to know the regulations, but to be able to prioritise, simplify and anchor the right things in the business.

What seniority gives in practice

A senior advisor can more quickly tell the difference between a critical gap and a minor deviation. That means the organisation does not spend equal energy on everything at once.

Seniority also shows in the dialogue. A good consultant needs to be able to talk to the board and management without getting stuck in technical details, but also to go into depth with IT, the security function and the business when needed.

It is also about judgement. Not every measure that is possible is reasonable. Sometimes the most important advice is to say what should not be prioritised right now.

Size can be right – but not always

Large consultancies can be the right choice when the engagement requires many resources, global coverage or several parallel workstreams.

But if the need is senior support, clear prioritisation and close dialogue, a smaller specialist firm can be more effective. Then it becomes more important to know who you will actually work with than how many consultants the provider has in total.

How to assess seniority

Don’t just ask about the firm’s experience. Ask about the consultant’s experience.

Good questions are:

  1. Who will concretely carry out the work?
  2. Which similar engagements has that person done?
  3. How do you handle situations where requirements are unclear or conflicting?
  4. Can you give an example of when you advised a client not to take a particular measure?
  5. How do you ensure the work is anchored with management and the business?

It is often the answers to those questions that show whether the partner is a good fit.

Would you like to meet the consultant who would actually work with you already in the first conversation? Read more about our Manager as a Service or contact us and we will book a first dialogue.