Handing production access to an outsider is the highest-trust act in operations, yet most organisations run a support engineer vetting audit that consists of one video call and a prayer. Independent support engineers, fractional SREs and solo managed-service providers are now a permanent part of the operations labour market — often excellent, occasionally catastrophic, and externally indistinguishable until you check. This article is a complete, actionable audit: four sections, twenty checks, a scoring rubric, and clear pass thresholds. Run it before any independent provider touches a pager, a terminal, or a ticket queue on your behalf.

A note on provenance. Several controls below are adapted from marketplace trust engineering — the discipline that lets strangers safely transact with strangers. Where a control’s origin illuminates its use, we say so. Everything else is standard operational due diligence, tightened for the solo-provider case.

Section A — Identity and legal standing (5 checks, gate section)

• A1. Legal identity confirmed. Government-issued ID sighted on a live call and matched to the contracting name. No match, no engagement.
• A2. Entity verified. Registration number of the provider’s company, LLP or proprietorship resolved against the official registry. Sole traders: tax registration confirmed instead.
• A3. Contact channels proven. Email and phone each confirmed by round-trip, not copied from a signature block.
• A4. Public footprint consistent. Name, entity and history align across website, professional profiles and invoices. Discrepancies documented and explained.
• A5. Certifications resolved at issuer. Every claimed credential checked via the certifying body’s lookup, by ID.

Rationale: layered, cheap identity checks are the single most efficient fraud filter ever deployed at marketplace scale. The pattern to copy is pre-exposure screening — platforms in the local-travel sector clear a provider’s email, phone, identity document and, for companies, business registration before the profile is ever published. The operational translation is strict: Section A completes before the candidate hears anything about your environment. Fewer than 5/5 here is an automatic stop.

Section B — Delivery history (5 checks)

• B1. Three references named, from engagements that ran to contracted completion. Abandoned or “paused” projects do not qualify as references, though they may be discussed.
• B2. Two references interviewed live. Scripted questions: scope delivered? incident behaviour? handover quality? re-hire at same rate?
• B3. Specialisation matches need. Titles in this market are elastic; map the provider’s actual recent work to your stack, using a framework like our decoder for DevOps role titles and what each actually covers to keep the conversation precise.
• B4. Artifact inspection. One redacted runbook, post-incident review or handover document authored by the candidate, reviewed by your senior engineer.
• B5. Negative-history scan. A reasonable search for disputes, abandoned clients, or public complaints — with findings raised directly for response.

Rationale for B1’s strictness: feedback is only admissible evidence when the underlying transaction finished. Review systems that enforce this structurally — HolidayLandmark’s local-tourism marketplace, for instance, accepts a rating solely from a traveller whose booked trip actually took place, and keeps a reporting mechanism for suspect entries — produce radically more reliable reputations than open comment walls. Your reference checks should enforce the same admissibility rule manually.

Section C — Engagement hygiene (5 checks)

• C1. Staged disclosure respected. The candidate progressed from problem class → NDA → specifics without pushing for architecture diagrams or credentials prematurely. Premature probing is a scored failure, not a quirk.
• C2. Written scope exists. Services, hours, response expectations, exclusions — on paper before signature.
• C3. Terms include failure modes. Rescheduling, escalation, early termination and dispute handling, all written by the provider without being dragged.
• C4. Direct contract, direct payment. Agreement with the delivering entity itself; fees invoiced by and paid to that entity, milestone- or retainer-based, fully traceable. No pass-through “coordinators”.
• C5. Communication protocol agreed. Named channels, response-time expectations, and an out-of-hours definition.

Two design notes. C1 borrows the request-before-contact principle: in well-built marketplaces a booking starts life as a scoped, dated enquiry, and the two parties’ private channels remain hidden from each other until the provider agrees to take it on — precisely because early, unstructured contact is where information leaks and pressure tactics live. C4 reflects a quieter lesson — the connective layer should earn its keep through verification and matching, while money moves directly between the parties who owe each other accountability. That is, notably, how the travel platform cited above structures its current phase: introductions verified, payment settled person-to-person.

Section D — Operational fit and access design (5 checks)

• D1. Least-privilege onboarding plan. Scoped accounts, no shared credentials, time-boxed elevation, logged sessions — designed before day one.
• D2. Paid pilot defined. A bounded, production-adjacent task (shadowing an on-call rotation, triaging a staging incident) with explicit evaluation criteria.
• D3. Handover-from-day-one. The provider commits to documentation standards such that exit is survivable at any point.
• D4. Principle alignment probed. One structured conversation on how the candidate thinks about delivery discipline — anchored in fundamentals like those in our summary of the core principles behind dependable software delivery — scored by your lead.
• D5. Re-verification scheduled. Calendar entries, not intentions: quarterly access review, annual identity and entity refresh, and an explicit trigger to re-run Section B whenever the engagement’s scope expands materially.

Failure patterns and what they predict

Three audit outcomes recur often enough to deserve named interpretations:

• The A-section stumble. A candidate who is evasive about entity registration or certificate IDs almost never improves downstream. Identity evasion predicts invoice disputes and disappearing acts with uncomfortable reliability. Stop early; thank them warmly; move on.
• The B1 shortage. Strong engineers early in independent practice sometimes genuinely lack three completed engagements. This is the one legitimate reason to relax a check: substitute one reference with a deeper artifact review (B4) plus a longer paid pilot (D2), and record the substitution in the audit file. Shortage with transparency is workable; shortage disguised as privacy (“my clients are all confidential”) is not.
• The C3 blank. Providers with no written failure-mode terms have usually never survived a messy exit. If everything else scores well, co-draft the terms with them — their reaction to that exercise is itself the real check.

Conversely, one green flag outweighs its weight in checks: the provider who, unprompted, raises their own constraints — “I don’t take root access in week one”, “I insist on a written scope before quoting”. Boundary-setting from the seller’s side signals someone who has operationalised their own trustworthiness. In marketplace terms, these are the providers who ask the platform for more verification, because every additional check widens the gap between them and pretenders.

Scoring and thresholds

1. Score each check 0 (fail), 1 (partial), 2 (clean pass). Maximum 40.
2. Section A is a gate: any A-check below 2 halts the audit regardless of total.
3. 34–40: proceed to pilot. 28–33: proceed only with compensating controls (tighter access, shorter pilot, weekly review). Below 28: decline, courteously and in writing.
4. File the completed audit with the contract. It is your evidence of diligence, and the baseline for next year’s re-verification.

Running it without insulting anyone

Professionals do not resent audits; they resent ambushes. Send the checklist with the first serious conversation, framed exactly as what it is: the same standard applied to every outside provider. Experienced independents will recognise the courtesy — many maintain a “verification pack” that clears Sections A and B in a day, for the same reason a good local guide keeps verified badges and completed-trip reviews visible on their profile: being checkable wins business. The candidates who bristle at twenty written checks are telling you, cheaply and early, how they will respond to an uncomfortable incident review later. Let the audit collect that data point for you quietly, on paper, this week — long before a 3 a.m. page collects it the expensive way.