How to Choose a CRA Consultant

We have met manufacturers who loaded all the offers for their CRA project into ChatGPT unread and asked which one was best. Others compared only the totals, although one offer contained a single workshop and the other a complete risk assessment. Our new guide, “How to choose the right CRA consultant,” shows what you should measure offers against instead. Here are the main points.

Compare services before you compare prices

The same line item can stand for very different services. Take a connected machine controller with remote maintenance. In one offer, “risk assessment” can mean a workshop in which threats are collected. In another, it covers a documented risk assessment with measures and residual risks for the technical documentation.

So for each area of work, record what the provider actually takes on: analyzing, designing, producing the deliverables itself, reviewing your team's results, or supporting the rollout. Also check the quantities: how many products, variants, and review cycles are included? Only then can you compare €20,000 with €80,000 in a meaningful way.

Vague offers are a warning sign

Many providers do not know exactly what a complete CRA implementation requires. This shows in offers that contain irrelevant services, leave out necessary areas of work, or sharply limit the actual scope through exclusions. The missing effort then often only surfaces during the project.

Typical signs are general promises, a narrow definition of services, and long lists of exclusions. If one offer is well below the others, ask what scope was calculated and what input from your side is assumed. An experienced provider should be able to give you a concrete answer.

Fix the team you see in the pitch

The classic is “bait and switch”: experienced consultants sit at the table in the first meeting, and other people do the work in the project. Ask for the names, seniority, tasks, and share of the project for the central roles, and agree that these people can only be replaced with your consent.

Also ask which deliverables these specific people produced themselves in comparable projects. A company's reference list says little about that.

Check industry experience and knowledge of current standards

Experience with automotive security under ISO/SAE 21434 is a good foundation. Machinery and industrial equipment differ from vehicles, however, in lifecycles, the number of variants, updatability, and supply chains, among other things. A suitable provider should know these differences and be able to explain what they mean for your product.

We have industry limits too. We cannot serve manufacturers from medical technology or aerospace as well as manufacturers of machinery, industrial equipment, and devices. There, a provider with the relevant industry experience may be the better choice.

For knowledge of standards, what counts is the current state. Ask whether the provider works with the current drafts of the EN 40000 series and the IEC 62443 series or mainly follows the text of the regulation. Otherwise, you risk having to adapt processes and evidence again once later versions of the standards are published.

Think about the second product

An approach that works for the pilot product becomes expensive if every further product needs the same consulting service again. So before you commission a provider, clarify which processes, methods, and templates can be reused across the company.

The usability of the results matters just as much. May you change templates yourself and apply them to other products? Do you get editable files? The goal should be to use the first project to build a foundation for the next products, not a permanent dependency on the provider.

Guide with interview questions, red flag card, and scoring sheet

The guide covers these points in more depth on about 30 pages. It first helps you determine the right support model based on your in-house expertise and available capacity. It also contains working material for the first meeting, the tender, and the comparison of offers:

• 20 questions for the meeting with a provider
• a red flag card with typical warning signs
• a scoring sheet with rating guidance
• a checklist before you commission a provider
• two templates for the request for proposal