Scoping the Question: Turning a Client Request Into Intelligence Requirements

BY DR. LELAND W. SMITH

Clients rarely arrive with a well-formed question. They arrive with a worry. "Can you look into this company?" "We need to know who is behind this account." "Find out everything about the new partner." Each of those could mean a two-hour check or a two-month project, and the difference is usually not visible until you ask.

Scoping is the step that turns a worry into a set of answerable intelligence requirements, with agreed limits, a deadline, a budget and a deliverable. It is the least glamorous part of the job and one of the most important. A badly scoped engagement produces unhappy clients, unpaid overruns and, at worst, research that should never have been done.

Where scoping sits in the intelligence cycle

The intelligence cycle is usually described in five or six stages:

1. Planning and direction: establishing what the decision-maker needs to know and why.
2. Collection: gathering information from sources.
3. Processing: converting raw material into usable form, such as translating, transcribing, deduplicating and organizing.
4. Analysis and production: evaluating, integrating and interpreting information to answer the question.
5. Dissemination: delivering the product to the people who need it.
6. Feedback: learning whether the product met the need and refining the next round.

The real cycle is messier and loops back on itself, but the model makes one point well: everything downstream depends on planning and direction. If the requirement is vague, collection becomes a fishing trip and analysis has nothing to aim at. Scoping is how a small practice does planning and direction properly.

Start with the decision, not the subject

The most useful scoping question is: what decision will you make with this, and when? A client who asks you to "look into" a supplier might be deciding whether to sign a contract, whether to increase credit terms, or whether to report a suspected fraud. Each decision needs different information.

Other questions worth asking in the first conversation:

• What prompted this request now?
• What do you already know, and how do you know it?
• What would change your decision? What would not?
• Who else will read the output, and in what setting: a board, a lawyer, a court, a partner?
• Are there legal proceedings, regulators or law enforcement involved, or likely to be?
• Have you or anyone else already researched this? What did they find?

Listen for mismatches between the stated request and the actual need. "Everything about the new partner" often turns out to mean "are there any red flags that should stop us signing next Friday?"

Key intelligence questions

Once you understand the decision, write it down as a small number of key intelligence questions. Different organizations use different labels for these, such as priority intelligence requirements or essential elements of information, but the idea is the same: specific questions that, once answered, support the decision.

Good key intelligence questions are:

• Specific: they name the subject and the information sought.
• Answerable: open sources could plausibly answer them, at least in part.
• Relevant: each one connects to the decision.
• Bounded: they have a time frame and, where needed, a geography.
• Few: three to six is typical. More than that usually means the scope is too broad.

Compare a weak question with a stronger version. Weak: "Is this company legitimate?" Stronger: "Is the company registered and in good standing in its stated jurisdiction, who are its current directors and beneficial owners as disclosed in public registers, and are there any public court judgments, regulatory actions or sanctions listings against the company or those individuals in the past ten years?"

Break broad questions into sub-questions you can actually research. Those sub-questions become your collection plan.

Scope and proportionality

Scope defines what you will and will not research. Proportionality asks whether the research is justified by the purpose. Both matter more when the subject is a person rather than a company.

When personal data is involved, consider:

• Lawful basis. Under data-protection regimes such as the GDPR, you and your client need a lawful basis for processing personal data. Legitimate interests is common in commercial due diligence but requires a balancing test against the subject's rights.
• Minimization. Collect what the questions require. If the question is about business conduct, a subject's family life and health are out of scope, even if you find them.
• Special rules. Some uses carry specific legal regimes. In the United States, for example, background reports used for employment, tenancy or credit decisions can fall under the Fair Credit Reporting Act, with obligations around consent and disclosure. If the purpose touches regulated decisions, get advice before starting.
• Risk to the subject. Ask whether the output could be used to locate, harass or harm someone. If the client's purpose is unclear or troubling, do not proceed.

Proportionality also applies to methods. A routine vendor check does not justify deep social media review of employees' personal accounts. Match the depth of research to the stakes of the decision.

What is out of scope

Writing down exclusions is as important as writing down inclusions. It prevents scope creep and protects you if the client later asks why something was not covered. Typical exclusions include:

• Any access to non-public systems, accounts or data, including logging into accounts, buying leaked data or using credentials.
• Pretexting, impersonation or contacting the subject or their associates, unless separately agreed and lawful.
• Physical surveillance or site visits.
• Research into family members, minors or uninvolved third parties beyond what is necessary to resolve identity.
• Special categories of data such as health, religion or sexual orientation.
• Jurisdictions, languages or time periods not listed in the scope.
• Legal advice or conclusions about guilt or liability.

Some of these exclusions are not negotiable. Make clear in the scope document which are firm limits of your practice and which could be added in a separate engagement.

Deliverable format

Agree on the output before you start. The format shapes how you collect and record evidence.

• Verbal briefing or short memo: fast, suitable for internal decisions with low stakes.
• Written report: an executive summary, answers to each key intelligence question with confidence levels, supporting findings, sources and limitations.
• Evidence pack: preserved captures, hashes and a source log, needed if the work may be used in litigation or shared with authorities.
• Structured data: spreadsheets or timelines for a client's analysts to work with.

If there is any chance the work will reach a court or regulator, plan for evidential standards from day one: capture pages with dates and URLs, keep original files, and log your methods. Retrofitting that later is painful and sometimes impossible.

Deadline and budget

Deadline and budget are not afterthoughts. They are part of the requirement, because they determine how much of the question you can answer.

• Tie the deadline to the client's decision date, with time for them to read and ask questions.
• Estimate hours per key intelligence question and show the client the total. Clients often trim questions once they see what each one costs.
• Include costs for paid sources such as company registry documents, court records or commercial databases.
• Set a checkpoint, often around the halfway mark, to report progress and agree whether to continue, adjust or stop.
• Agree in advance what happens if a question cannot be answered within budget. "Not found within scope" is a legitimate result and should be reported as such.

A worked example

Suppose a mid-sized logistics company emails you: "We are about to bring on a new freight-forwarding partner in another country. Can you check them out?"

In the first call, you learn that the decision is whether to sign a three-year contract in four weeks. The client's compliance team is worried about sanctions exposure, and the chief financial officer is worried the partner is financially weak. Nobody has concerns about individual employees.

You draft four key intelligence questions:

1. Is the partner company registered, active and in good standing, and what are its registered address and filing history?
2. Who are the directors and disclosed beneficial owners, and do any of them, or the company, appear on major sanctions lists?
3. Are there public insolvency proceedings, court judgments or regulatory actions involving the company or its directors in the past seven years?
4. Is there public evidence that the company operates at the scale it claims, such as facilities, fleet, licences or trade memberships?

Out of scope: personal social media of staff, any contact with the company, physical site visits, and directors' family members. Deliverable: a written report with confidence levels and a source log, delivered in three weeks, with a checkpoint call at the end of week one. Budget: an agreed number of hours plus registry fees, with a cap.

The client signs off. You now have a focused job that answers what they actually need, and a document that protects both of you.

A requirements template

A one-page template keeps scoping consistent. Adapt this to your practice.

• Client and contact: who commissioned the work and who receives the output.
• Decision supported: the decision, its owner and its date.
• Background: what the client already knows and how.
• Subjects: organizations and individuals in scope, with identifiers.
• Key intelligence questions: numbered, specific, bounded.
• Time period and jurisdictions: what is covered.
• Lawful basis and proportionality note: purpose and balancing reasoning for personal data.
• Methods permitted: open sources, paid databases, registries.
• Exclusions: explicit list of what will not be done.
• Deliverable: format, level of evidence and confidence language.
• Deadline and checkpoints: dates.
• Budget: hours, fees and the rule for overruns.
• Handling: how findings are stored, shared and retained.
• Sign-off: client approval with date.

Limits and common mistakes

• Starting before agreement. Collection before scope is agreed tends to expand indefinitely and is hard to bill.
• Accepting the client's framing uncritically. The first request is often the wrong question. Ask about the decision.
• Too many questions. A list of fifteen requirements usually hides a lack of focus. Prioritize.
• No exclusions. Without them, every gap in your report looks like an omission.
• Silent scope creep. When a client adds a question mid-project, update the scope in writing and adjust time and budget.
• Promising certainty. Open sources have gaps. Set expectations that some questions may be answered only partly.

Checklist

1. Identify the decision the work supports, its owner and its deadline.
2. Capture what the client already knows and how they know it.
3. Write three to six specific, answerable key intelligence questions.
4. Record the lawful basis and a proportionality note for any personal data.
5. List firm exclusions and optional add-ons separately.
6. Agree the deliverable format and evidential standard.
7. Estimate effort per question and agree a budget with an overrun rule.
8. Set a midpoint checkpoint.
9. Get written sign-off before collection begins.
10. Update the scope in writing whenever the questions change.