Don’t just ask for case studies; ask how the consultant will scope the first two weeks, who will own each deliverable, and what system access the work requires. Strong answers should be tied to your systems, metrics, users, and constraints—not a generic template.
Before the call, inventory your data sources, reporting bottlenecks, and the decisions the work needs to support. The Small Business Data Audit Checklist gives you a practical prep list, so you can spend the conversation evaluating the consultant instead of reconstructing your own environment.
Engagement (Scope and Fit)
1. What will you do in the first two weeks, and what will I have at the end of it?
- Good answer: “The first two weeks are a discovery and data auditing phase. We will inspect your raw data sources, map the data flow, and deliver a technical scope document along with a working prototype or wireframe of the reporting dashboard.”
- Bad answer: “We will start building the final dashboards immediately and have the complete solution ready in two weeks without needing to review your underlying data sources first.”
2. What do you need to understand before you can recommend a solution?
- Good answer: “Before recommending anything, we need to understand the decisions you are trying to make, how your metrics are defined, where the data comes from, who uses the output, and what constraints we need to work within.”
- Bad answer: “We understand the problem from your brief and can start with our standard dashboard template without further discovery.”
3. What is your approach to cleaning data that isn’t ready for analysis?
- Good answer: “Data cleaning and transformation are explicit line items in our project scope. We document data anomalies, build automated transformation pipelines where possible, and establish data validation rules.”
- Bad answer: “We assume your data is already clean and perfectly formatted, so data preparation won’t take any time or budget.”
Money and Ownership
4. How do you structure your fees, and can you provide a fixed-price option for the first phase?
- Good answer: “We offer fixed-price scoping and discovery packages, followed by either fixed milestone pricing or structured hourly rates for ongoing iterations with clear cap limits.”
- Bad answer: “We only work on open-ended hourly billing with no initial estimate, maximum ceiling, or milestone deliverables.”
For directional context, Clutch’s 2026 marketplace data lists U.S. and Canadian BI and analytics firms at $100–$149 per hour and reviewed projects typically at $10,000–$49,999. Those figures are not a quote for your project; a tightly scoped first phase may be much smaller.
5. Who owns each deliverable, and does the contract assign the IP or grant the rights I need?
- Good answer: “The agreement identifies each deliverable, any pre-existing tools, and the ownership or license rights you receive upon payment. We will put those rights and handoff obligations in writing.”
- Bad answer: “Ownership is standard—there is no need to spell out which code, dashboards, models, or documentation you can use after the engagement ends.”
For contractor work, a “work made for hire” label applies only when the work meets specific statutory conditions. The U.S. Copyright Office explains that specially commissioned work must fit one of nine categories and be covered by an express signed agreement; a written assignment or license is a separate route for defining rights. Have counsel review the final language.
6. If we stop working together in six months, what do I actually have?
- Good answer: “You will have full admin access to all deployed tools, complete source code repositories, documented data models, and an offboarding playbook that allows another analyst to maintain the system.”
- Bad answer: “The reports run inside our proprietary platform, so if our contract ends, you lose access to the dashboards and underlying pipelines.”
System Access, Security, and Compliance
7. Exactly what systems do you need access to, and can you use ‘read-only’ credentials?
- Good answer: “We use least privilege: read-only by default. Any write or administrator access will be justified, role-based, time-limited, and separated from production where practical.”
- Bad answer: “We need admin-level passwords and full write privileges across all your core production databases and business accounts.”
8. How will you store or transfer the data files I send you?
- Good answer: “All file transfers occur via encrypted channels (SFTP, secure cloud storage), and data stored locally during development resides on encrypted drives with strict deletion protocols upon project completion.”
- Bad answer: “You can just email us raw CSV files or share unencrypted Google Sheets containing sensitive customer records.”
9. What is your process for data security, and how do you handle sensitive customer information?
- Good answer: “We document the data involved, use MFA and encrypted transfer and storage, limit access, mask sensitive fields where practical, and agree in writing how data will be retained, returned, or deleted.”
- Bad answer: “We don’t have formal security protocols; we just assume small business data isn’t a high-risk target.”
For example, New York’s SHIELD Act requires any business that owns or licenses computerized data containing a New York resident’s “private information” to maintain reasonable safeguards. Its examples include selecting capable service providers and requiring safeguards by contract. Other state, federal, sector-specific, or international rules may apply based on the data and where the parties operate. Identify the applicable requirements and have counsel review the contract.
Proof and Testing
10. Can you show me a similar dashboard or report you built for a business this size?
- Good answer: “Yes, here is a sanitized demo or portfolio sample created for a similar business, showing how we structured the metrics, user filters, and data refreshes.”
- Bad answer: “Client confidentiality prevents us from showing completed work, and we will not offer a sanitized demo, synthetic example, architecture walkthrough, reference, or comparable-process explanation.”
11. What is your policy on ‘post-delivery’ bugs?
- Good answer: “The contract defines what counts as a defect, the correction window and response time, what support is included, and the rate for maintenance or changes after acceptance.”
- Bad answer: “Support starts on a new open-ended hourly work order, and we do not define defects, acceptance, response times, or post-delivery responsibilities in advance.”
12. Can I run a paid trial before committing to a full project?
- Good answer: “Yes, we recommend starting with a short, paid discovery phase or small data audit to test working chemistry and validate data feasibility before signing a full engagement.”
- Bad answer: “No, we only accept full-scale long-term contracts with large upfront commitments.”
How to Decide After the Call
Move forward when the consultant gives concrete answers to the top three questions—scope, ownership, and access—and the key terms are documented in writing.
Choose a paid trial when the fit looks promising, but the scope, data quality, or working relationship still needs to be tested.
Walk away when the consultant is evasive about ownership, asks for unjustified access, or cannot explain how your data will be protected.
If you are not sure whether your business is ready, take the five-minute Analytics Health Assessment. If you are ready to discuss a defined project, start the conversation.
Frequently Asked Questions
Should I sign an NDA?
Use an NDA before sharing genuinely confidential information, but do not treat it as a substitute for least-privilege access, data-security terms, deletion and return obligations, or any required data-processing agreement. Have counsel review the contract when the stakes or data sensitivity justify it.
Should I pay hourly or fixed price?
Use fixed-price arrangements for clearly defined scope and initial deliverables like audits or initial dashboards. Hourly structures are best reserved for ongoing maintenance, advisory work, or unpredictable operational support.
What if they use a tool I don’t have?
If you don’t already own the tool, you likely need a strategy implementation expert rather than a pure analyst. Make sure the consultant builds solutions on infrastructure you own and can support long-term.
How long should a first project be?
I recommend a bounded two-week paid discovery or audit with named outputs: a data-source inventory, risk and quality findings, a prioritized scope, and a go/no-go decision. The key is a clear deliverable and decision point with no automatic long-term commitment.