What an engagement letter should say before a security firm walks into your building

Why the letter matters more than the proposal

The proposal says what a firm will do. The letter says what it will not do, who it tells, and what happens when the work surfaces something no one expected. A security firm inside an athletic department is in a position to learn things about staff and athletes that the department itself does not know. The letter is the only document that decides, in advance and in writing, what becomes of that knowledge.

We send ours to the department's counsel before any work begins, and we are glad when counsel has questions. Here is what they should be asking of anyone.

Nine things to find in the letter

1. One named client contact. A single person who receives reports and findings. Not a committee, not a distribution list. If the letter does not name the person, the firm has not decided whom it works for.
2. The scope, and the statement that anything else is a separate engagement. A firm engaged to inspect three rooms should not be reviewing the staff's telephones because it noticed something interesting. Scope creep in security work is how departments end up with reports they did not ask for about people they employ.
3. What the firm does not do. Written as a list. Ours says: no guard or bodyguard services, no investigation of individual employees or athletes, no recording of anyone, no reading of private messages, no access to any account or device without the department's written instruction and the holder's knowledge, and never jamming, interception or covert surveillance of any person. A firm that will not write such a list has reasons.
4. Licensing. Which activities require a state license, whether the firm holds it in your state, and what happens when a request would require one it does not hold. The honest answer is sometimes that the work is referred or declined. A firm that claims every activity is unlicensed advisory work is wrong in most states.
5. The reporting rules, decided in advance. This is the section missing most often. What does the firm do if it believes someone is in immediate danger? If it finds a live threat or active surveillance? If something suggests harm to a minor? If the work surfaces evidence of a crime, a rules violation, gambling, or harassment by a member of staff? Each should have an answer: who is told, how quickly, and whether the firm investigates further. Ours says it reports misconduct in writing to the person the letter names, within two business days, and investigates no further unless separately engaged and licensed. It also says the firm does not report to the media, the conference, the NCAA or law enforcement on its own initiative, except where a person is in danger or the law requires.
6. How reports are written and delivered. To whom, in what form, and whether individuals are named. Our reports describe patterns and remedies and name no staff member or athlete. They are delivered in person or by video, to the client contact, never by email alone.
7. What the report is and is not. A snapshot of what was examined on the dates stated, with what was not examined recorded. No guarantee that a room is free of devices, that a leak will not occur, or that a threat will not materialize. A sweep report that does not list its instruments and their limits is a marketing document.
8. Confidentiality in both directions. What the firm retains, for how long, and when it is destroyed. Who at the department may see the report. What either side may disclose when the law requires it.
9. Fees, travel and terms, stated so plainly that the business office has nothing to ask. And the statement that pricing for follow-on work goes in a separate proposal, never inside a report. A report that recommends services and prices them is selling, not assessing.

Three questions to ask the firm directly

• Who, personally, will be in our building? The answer should be a name, and the same name should appear in the proposal and on site.
• What will you do if you find something about one of our coaches? The answer should match the letter word for word. If the person across the table has to think about it, the letter was written by someone else.
• What can you not find? Any honest technical firm has a ready answer. Any honest advisory firm has a longer one.

What the department owes in return

Access, documents and people reasonably needed for the work. A named contact who returns calls. Anything that is off limits stated in advance rather than discovered on day three. And the understanding that the department, not the firm, is responsible for what it does with the findings. The firm writes the remedy; the department decides whether to make it.

The firm's engagement letter, section by section