Field Guide

How to Write a Compliance Consulting Statement of Work

The short version

A Statement of Work turns a relationship, the Master Services Agreement, into an obligation: specific work, for a specific price, delivered against specific dates, accepted by a specific process. SOW disputes commonly turn on what "done" means rather than on price, because the drafter recorded no acceptance mechanic. A complete SOW names its register, anchors itself to its parent agreement, and scopes the work with an explicit out-of-scope sentence. Each deliverable carries a four-part acceptance mechanic, the charging model states a cap, and a change-order clause makes scope drift a paid amendment rather than a free one.

A compliance-consulting Statement of Work is the engagement-level document, issued under a Master Services Agreement or an equivalent parent contract, that fixes the scope, deliverables, price, dates, and acceptance process for one engagement. The same document governs a two-month gap analysis for a Series B fintech and a multi-year program build for a sponsor bank. It is what the client signs, what an examiner or auditor may eventually read alongside the deliverable, and what determines whether payment issues on schedule or the parties spend a month arguing over whether "the risk assessment" included the matrix or only the narrative.

This guide takes the SOW section by section, in the order a reader and a signer expect to see it: register and precedence, scope, requirements, personnel, deliverables and acceptance, charges, change management, and governance. It closes with a one-page skeleton usable as a drafting checklist and with the failure patterns that turn a signed SOW into an unpaid dispute.

The four SOW registers

SOWs take several standard formats, and mixing formats produces an incoherent document. The register is selected before Section 1 is written, and a drafter can state which register applies, and why, in one sentence.

RegisterWhen to use itTell
Federal task-order narrativeGovernment prime or subcontract work; labor-category-driven staffingNumbered sections, "the Contractor shall" prose, security/badging riders
Framework outline-agreement / multi-annexA master agreement that will spawn many task-order SOWs over a multi-year termA short core body plus numbered Annexes for staffing, pricing, and references
Commercial schedule-basedEnterprise or public-sector engagement under a standing MSA; managed-service deliveryNumbered Schedules/Exhibits, a RACI-style Responsibility Matrix, an SLA-credit table
Fill-in-the-blank consulting templateA smaller or first-time engagement with no prior contract vehicle to hang off ofBracketed placeholders, an Order-of-Precedence clause up top, numbered Attachments

Most independent compliance-consulting engagements fall in the fill-in-the-blank or commercial-schedule register. The deliverables-acceptance discipline described in the sections below applies in each register regardless of engagement size; omitting it on small engagements is a recurring source of scope-creep disputes.

Order of precedence and the parent agreement

Every SOW is subordinate to something: an MSA, an outline agreement, or, for a standalone engagement, a referenced Consulting Agreement. That relationship belongs in the first paragraph. The SOW names the parent vehicle (agreement name, date, parties) and states precedence explicitly for the case where the SOW and the parent agreement conflict: some templates make the Agreement control, others put the SOW first with named exceptions. Either allocation is defensible, and leaving the question unstated is not. Where the SOW is one of several under the same MSA, it states how it relates to its siblings and whether terminating one affects the others. For the clauses that belong in the MSA rather than here (indemnification, liability caps, IP assignment, governing law), see the consulting MSA checklist.

Background, scope, and the out-of-scope sentence

The background section gives the reader, who may be a program office consulting the document two years later, enough context to understand why the work exists before any requirement is stated. The scope statement that follows runs to one paragraph, and its second sentence draws a boundary rather than adding description. The SOW states explicitly that anything not addressed in it is out of scope. That sentence is what converts a later scope argument into a change-order conversation.

Specific requirements as "shall" statements

The specific-requirements section carries most of an SOW's page count, and imprecision there is the most expensive to correct. The section is written as bulleted "shall" statements, one obligation per bullet, rather than paragraphs bundling several obligations together. A bundled bullet cannot be audited afterward, because no reader can determine which obligation was missed.

The modal-verb convention is stated up front: "shall" statements are binding, "should" and "may" are non-mandatory, and "will" statements express future tense or intent rather than obligation. Without a stated convention, "the consultant should provide weekly reports" is unenforceable, and the gap surfaces only when it matters. The section names the standards and methodologies the work is pinned to rather than referring to "industry best practices." For a BSA/AML engagement that may mean the FFIEC BSA/AML Examination Manual and a named risk-scoring method; for a broader GRC engagement, a named framework. Each "shall" statement is independently verifiable: a third party can read it and determine pass or fail without asking the drafter what was meant.

Personnel and staffing

The personnel section names who performs the work, at what seniority, and under what constraints. It is the section that prevents a client from being staffed with junior personnel after signature.

Key positionNamed individualLevel of effortCommitted period
Engagement lead[Name or TBD][e.g., 50%][e.g., full engagement term]
Subject-matter reviewer[Name or TBD][e.g., as-needed][e.g., through deliverable acceptance]

For a multi-consultant engagement, the table is tiered by seniority: years of relevant experience, certifications held, and language or jurisdiction requirements where applicable. A substitution clause covers any named lead, requiring advance notice (commonly 10-14 days), written justification, and a replacement whose qualifications equal or exceed those of the person replaced.

Deliverables, milestones, and acceptance

A deliverable stated without an acceptance mechanic creates no enforceable obligation to accept or pay. This is the gap examiners, sponsor banks, and clients' counsel identify first when a dispute is reduced to writing.

The deliverables table carries at minimum a number, title, format, due date, review-complete due date, and final due date. Acceptable formats are fixed up front (Word, Excel, a named platform) so that a deliverable is not rejected on a technicality. Where an engagement spans multiple deliverable types, such as a BSA/AML risk assessment, a program gap analysis, and an independent-testing review under one master SOW, each occupies its own numbered row with its own review window rather than a single blanket "10 business days to review."

Complexity tierTypical review-and-accept windowTypical sign-off-after-acceptance
Simple: status report, single-page artifact2-3 business daysSame day to 1 business day
Medium: design workbook, configuration document3-4 business days3 business days
Complex: full assessment report, multi-stakeholder workshop output5-6 business days3 business days

The four-part acceptance mechanic is stated for every deliverable:

  1. Who approves. A named role (Compliance Officer, Program Manager), never a department.
  2. How long the approver has. A stated business-day window, rather than "promptly" or "in a reasonable time."
  3. What silence means. Stated explicitly: either the deliverable is deemed accepted if no deficiency notice arrives within the window, or explicit written acceptance is required. One of the two is selected rather than left implied.
  4. What a rejection triggers. A written, itemized deficiencies list referencing the specific requirement violated, never a bare "not accepted," plus a stated cure period.

A one-page, reusable Deliverable Acceptance Receipt (Accepted / Rejected / Conditionally Accepted, with a deficiencies field) is attached, rather than the mechanic being restated in prose for every engagement. Where a specific deliverable type is scoped into the table, the underlying methodology pages serve both drafter and client: a risk assessment, an AML gap analysis, or an independent-testing review each carry their own scope and evidentiary bar, which the SOW's requirements section mirrors.

Charges and payment mechanics

The charges section states the pricing model, then the numbers, then the guardrails, in that order, because the model determines which guardrails apply.

Where more than one person bills, the SOW carries a rate table by role rather than a single blended rate. Pricing assumptions are stated separately from the rate table: what counts as billable, what does not, and who bears pass-through costs such as travel. T&M work carries a budget-burn notification trigger: the client is notified at roughly 80% of the NTE consumed, and no invoice issues past the cap without a signed Change Order. That clause operates before an overrun occurs, where after-the-fact dispute language operates only once it has.

The change-management clause

Where an SOW carries no change process, scope drift is free to the client and unbillable to the consultant. The flow runs in six steps: trigger identification, change initiation (a written Change Request), change validation (confirming the trigger is genuinely outside current scope, not a disagreement about what the SOW already means), impact estimation (effort, schedule, and fee impact in writing), negotiation and approval (a signed Change Order), and implementation and amendment.

The operative sentence is stated explicitly: nothing, no email, no call, no status-meeting comment, varies the SOW except a signed Change Order. The clause states plainly that neither party is obligated to perform, or pay for, changed work until the Change Order is executed. It protects the consultant against "just start, we'll paper it later," and protects the client against being billed for scope neither side agreed to.

Governance, reporting, and data safeguards

The meeting cadence and the named participants are fixed before day one rather than after the first missed deadline. A working-level status update (weekly or biweekly) plus a monthly formal progress report, with a fixed content list, covers most engagements. A named escalation path carries a defined timeframe (commonly 30 days of good-faith working-level resolution) before matters escalate above the engagement lead.

Where the engagement touches the client's regulated data, customer records, transaction data, or PII the consultant handles to run testing or scoring, a dedicated data-safeguards rider replaces reliance on generic MSA confidentiality language. The rider classifies the data categories in scope, lists the technical and organizational controls the consultant commits to (encryption, access controls, credential deactivation on a stated timeline), states a breach-notification clock, and specifies how data is returned or destroyed on termination. This matters even more in a banking-as-a-service context, where a sponsor bank's own oversight obligations extend to the vendors and consultants touching its fintech partners' data; see the sponsor-bank oversight guide for how that responsibility is allocated.

A one-page SOW skeleton

The skeleton below functions as a drafting checklist. A small engagement may not require every section at full depth; the omission is a deliberate decision rather than an oversight.

Where compliance-consulting SOWs fail

A well-drafted SOW is provable: every "shall" statement can be checked, every deliverable has a named approver, and every dollar has a trigger that releases it. For how this document differs from the agreement it sits under, see SOW vs. MSA; for a lighter-weight document sometimes used ahead of a full SOW, see consulting terms of reference.

Primary sources

Common questions

What's the difference between a Statement of Work and a Master Services Agreement?
A Master Services Agreement sets the ongoing relationship between a firm and a client: indemnification, liability caps, IP ownership, termination-for-cause, governing law. A Statement of Work is the document issued under that agreement for one specific engagement: the scope, the deliverables, the price, the dates, and how "done" gets decided. The MSA is signed once and can cover years of work; a new SOW is signed for each engagement it governs.
Does a compliance-consulting SOW need a change-order clause?
Yes. Without a stated change process, scope drift costs the client nothing and pays the consultant nothing. Every added ask becomes an argument instead of a paid Change Order. The clause should name who can request a change, what a Change Request must contain, how impact is quantified, and state plainly that nothing (an email, a call, a status-meeting comment) varies the SOW except a signed Change Order.
Fixed fee or time and materials for a compliance engagement?
Fixed fee suits work with a stable, well-scoped deliverable set, like a risk assessment or a gap analysis: invoice on written acceptance of each deliverable, with a not-to-exceed cap stated even though the price is fixed. Time and materials suits open-ended or investigation-driven work where the effort cannot be scoped in advance, and in either case a not-to-exceed cap bounds the client's total exposure.
What makes a deliverable "accepted" under an SOW?
Four things, stated explicitly for every deliverable: who approves it (a named role, not a department), how long they have to review it, what happens if they say nothing within that window, and what a rejection triggers, meaning a written, itemized list of deficiencies tied to a specific requirement, plus a cure period. A deliverable missing any of the four leaves acceptance undefined.
Does a compliance-consulting engagement need a data-safeguards rider?
If the engagement touches the client's regulated data, such as customer records, transaction data, or PII the consultant handles to run testing or scoring, then yes. The rider should classify the data categories in scope, list the technical and organizational controls the consultant commits to, state a breach-notification clock, and specify how data is returned or destroyed when the engagement ends.
About this library

This reference library is maintained by Rupture Labs, the company behind Compliance Command Center, compliance software built and reviewed by practitioners. Contact.