How to choose a QA outsourcing company

A QA outsourcing decision comes down to four documents and one small purchase: a requirement sheet whose lines answer yes or no, a scoring sheet weighted before any proposal is opened, a paid pilot with a pass mark written down first, and a contract whose clauses name a metric, a source, a window and a consequence. Below is the wording of all four, with the twelve suppliers in the ranking as evidence of what gets published and what has to be asked for. The sequence around them sits in the step-by-step section.

What goes in a QA RFP

An RFP longer than four pages gets answered by a proposal team rather than by the person who would run the account. Nine sections, a paragraph each, make replies comparable, which is the only thing the document is for. The right-hand column is the standard you hold replies to; agree it internally first.

Leave out your company description, the methodology essay, and questions the supplier's site answers.

The lines you can fill in before you send it

Ten minutes per supplier across four public pages fills part of the sheet, so the RFP asks only for what is missing. Among the twelve companies compared here, an hourly band is recorded for ten, each read from a directory profile rather than from the supplier's own site. A team size is published by eleven. A ramp-up time is published by seven. A minimum engagement is published by four, and the comparison table has the rest field by field.

Asking for an hourly rate mostly retrieves a number a directory already carries; asking which roles sit inside it retrieves something new. DeviQA, first in the ranking, shows the split: three ISO certificates are published, among them ISO 20000-1 for service management, while no ramp-up figure and no minimum engagement appears on its pages. Two rows stay blank for everybody — staffed hours, and asset ownership at the end — and the questions section phrases both.

A scoring sheet with weights you set

The ranking here uses eight dimensions at fixed weights, described on the methodology page, because it compares twelve suppliers for a reader whose product it does not know. You have one product, so your weights should differ. Fix them in writing before the first proposal is opened, with the anchor for a full score.

Write the zero anchor too: a logo wall instead of a case, a tool list instead of a pipeline, a standard named instead of a certificate. Reweighting is the point of the sheet: a medical device team moves data handling and certificates into the first two rows, while a team launching in six weeks raises staffing above evidence. Weight it once, date it, and leave it alone once proposals arrive.

What a pilot should cost and what it has to prove

A pilot answers the question a proposal cannot: what arrives when these people do the work. Buy a slice you can already grade — a release or a flow your own team has tested — so the output is compared rather than believed.

Two weeks of one engineer is about eighty working hours. The band most often recorded across these suppliers is $25-49 an hour, which puts a paid pilot near $2,000 to $3,900; regional spreads sit in the pricing guide. Grade three things a proposal never shows: the defect report, with steps, environment and a reason for the severity chosen; time from access granted to first test executed; and whether the report arrives unchased. The Flip case published by Global App Testing reports regression duration cut by 1.5 weeks — a before, an after and a unit, which is the shape a pilot report should take. A supplier selling only a multi-month retainer has named its smallest unit, and that number belongs in the commercial row of the sheet.

Contract and SLA: which wording holds

A service level clause holds when four elements are present: the metric, the place the number is read from, the window it covers, and what happens when it is missed. Remove one and the clause is a statement of intent, worth nothing in month four.

Some of it can be drafted from what suppliers publish. ScienceSoft lists time and materials with a cap among its pricing models, so a capped arrangement can be asked for by name. Global App Testing publishes that it acts as processor while the client remains controller, with transfers outside the EEA under Standard Contractual Clauses. The reverse is readable in advance too: the TestFort privacy policy states that personal data it processes may be transferred and stored outside the European Economic Area, so a residency rule is either closed in the contract or met by a supplier such as QualityLogic, which states that its operations sit in the United States and client data stays there. Where a certificate decides the deal, the risks section covers what happens when it is taken on trust.

Handover: the first two weeks decide the first quarter

What separates a workable first quarter from an expensive one is whether week one was spent testing or waiting for access. You prepare all of it bar the severity scale and the escalation list, and each row ends in something observable.

Replacing an incumbent adds a column, and a1qa publishes a QA vendor transition service that treats the changeover as defined work. Where the supplier joins a process you already run, iBeta states that it integrates with a client's in-house QA team and follows the methodologies that team uses. Ask for the exit version of this handover at signature, not at termination.

Frequently asked questions

What should a QA RFP contain?

Nine short sections: product and release rhythm, work in scope, hard constraints, team and hours, start and shape, reporting, assets and exit, commercials, and reply format. Each is a paragraph stating what a usable reply must contain, so answers compare line by line. Keep it under four pages and leave out what the supplier already publishes.

What should a QA vendor evaluation checklist score?

Eight criteria: evidence in your sector, automation ownership, commercial fit, start date and staffing, data handling, certificates with scope and expiry, reporting and baseline, and peer reviews across more than one directory. Weight them to a hundred and write the score anchors before proposals arrive. A medical device buyer weights data handling first; a launch-date team weights staffing first.

How do you evaluate a QA outsourcing partner from public information alone?

Four pages carry most of it: services, certifications, privacy or security, and whatever is published about engagement models and price. Across the twelve suppliers here, ten have a published hourly band and eleven publish a team size. Seven publish a ramp-up time, and four say anything about a minimum engagement. Record each field as published, named-only or absent, with the URL and date.

How long should a QA pilot run, and what does it cost?

A two-week pilot with one named engineer is the usual shape, roughly eighty working hours. At the $25-49 band most often recorded across these suppliers, that is near $2,000 to $3,900, plus your own cost for access and review. Paying for it gives you standing to reject what comes back, so write the pass mark before the start.

How do you measure outsourced QA performance month to month?

Pick metrics that exist before the supplier arrives. Four carry most of the weight: defects escaping to production per release, regression cycle duration, automation failure rate on the shared pipeline, and coverage of the flows you named as critical. Take the baseline yourself in the two weeks before work starts, or the first improvement reported will be arithmetic.

Which QA outsourcing contract clauses matter most?

Five decide the money: price unit and what it includes, minimum engagement, notice period, monthly cap, and what falls outside the cap. Four decide the risk: storage country and subprocessors, deletion on termination, ownership of test cases and automation code, and the notice owed when an engineer is replaced. Each should resolve to a number, a date or a named place.

What belongs in a QA SLA?

Every commitment needs four parts: the metric, the source the number is read from, the measurement window, and the consequence of a miss. That means an acknowledgement time for a blocked release with the hours it applies in, a coverage window in local time with named engineers, a monthly report on a fixed template and date, and a remedy when one is missed.

What are the red flags when outsourcing QA?

Four are visible before signature. A supplier that will not put a start date and a minimum engagement in writing has left both to be settled after you have chosen. A credential that produces no certificate — no number, no auditing body, no scope, no expiry — stays a claim. A case study with no named client and no measurement period cannot be checked. Hours priced with no monthly deliverable named leave an invoice you cannot audit.

How do you hand a project over to an outsourced QA team?

Prepare eight artefacts before day one: repository and tracker access, a working test environment, test data with a reset procedure, an inventory of suites with owners, your severity scale and definition of done, the release calendar with freeze rules, an escalation list, and a baseline you measured. Each is finished when something observable happens: the environment when the supplier has run one of your tests unaided.

Company facts here come from the same twelve files as the ranking, collected on 2026-09-06 from the pages listed on the sources page. Case figures are as published by the vendor. Field counts run across those twelve companies.