Signed Downstream: Making Client Terms Survive the Subcontractor Appointment

Advisory firms increasingly deliver mandates through a small constellation of specialist suppliers: a data analyst here, a technical reviewer there, a niche consultancy engaged for one workstream. The client contract, however, is usually signed by the prime adviser alone. The client looks to the firm for delivery, continuity and redress. The subcontractor looks to its own standard terms, which may say very little about the client's expectations. The gap between those two positions is not theoretical. It is where unpriced risk accumulates.

The flow-down problem is rarely a single missing clause

Most firms know that client obligations should be passed to subcontractors. Fewer appreciate how selectively that passing works in practice. A generic clause requiring the subcontractor to comply with "all applicable client requirements" is unlikely to survive scrutiny. It does not identify which obligations apply, how they are to be evidenced, or what happens when the client's terms and the supplier's terms conflict. The prime adviser remains the contracting counterparty to the client and therefore remains the party exposed to service credits, termination rights, indemnities and reputational damage.

The practical answer is not a longer clause. It is a flow-down matrix: a schedule that maps each client obligation to a corresponding subcontractor obligation, identifies the evidence required, and records any residual risk that the prime adviser must retain and price. The matrix should be prepared before the subcontractor is appointed, not after the client has asked for its first audit pack.

Start with the obligations that carry consequence

A workable matrix begins with the client contract's operative provisions, not the subcontractor's template. For each obligation, the firm should ask four questions. Does the obligation apply to the subcontracted work? Can it be translated into a clear supplier duty? What evidence will show compliance? If it cannot be translated, who owns the residual risk and at what cost?

That discipline is more useful than a broad indemnity. An indemnity may give a right of recovery, but it does not prevent the breach, satisfy the client, or preserve the relationship. Flow-down is primarily about prevention and evidence; indemnity is the backstop.

Confidentiality: define the boundary, not just the duty

Client confidentiality clauses often define confidential information widely, impose need-to-know restrictions, limit onward disclosure and require return or destruction at the end of the engagement. A subcontractor's standard confidentiality clause may be narrower, may permit disclosure to affiliates, or may allow retention for archival purposes. Those differences matter when the client's information is commercially sensitive or when the client has imposed a specific marking regime.

The matrix should therefore capture the definition of confidential information, permitted recipients, security standards, onward disclosure controls, the duration of the obligation and the return or destruction process. Where the subcontractor needs to use the information for its own product development or benchmarking, that should be identified and either carved out with client consent or refused. Silence in the subcontract is not a permission.

Data protection: map roles before drafting clauses

Data protection is the area in which flow-down most often fails because the parties have not agreed their roles. The prime adviser may be a controller, a processor, or a controller in common with the client, depending on the mandate. The subcontractor may be a sub-processor or an independent controller. UK GDPR and the Data Protection Act 2018 require particular terms where a processor engages another processor, including authorised sub-processing, security obligations, breach notification, assistance with data subject rights and deletion or return of data.

A clause that simply says the subcontractor will comply with UK GDPR is not enough. The matrix should identify the personal data, the processing purpose, the role of each party, the sub-processing approval route, international transfer arrangements and the incident notification timetable. The prime adviser should also check whether the client contract requires prior consent for sub-processors or imposes specific audit rights over them. If the subcontractor cannot meet those requirements, the prime adviser needs to know before signature, not after a subject access request arrives.

Anti-bribery: require evidence, not just acknowledgement

The Bribery Act 2010 reaches commercial organisations and their associated persons. A subcontractor's employees, agents and intermediaries may fall within that concept. A flow-down clause that requires compliance with the client's anti-bribery policy is a start, but it does not demonstrate that the subcontractor has controls in place. The matrix should require a current policy, appropriate training evidence, declarations of conflicts and gifts, a route for raising concerns and a right to audit or terminate where concerns arise.

The level of evidence should be proportionate to the risk. A low-value specialist engagement may need only a policy extract and a declaration. A high-value appointment involving government clients, intermediaries or overseas delivery may justify enhanced due diligence. The important point is that the obligation is evidenced in a way the prime adviser can show to the client if asked.

Insurance: check that the cover responds to the obligation

Client contracts frequently require professional indemnity, cyber, public liability or employers' liability cover at specified limits. Subcontractors often carry cover, but not necessarily on the same basis. Limits may be aggregate rather than per claim, exclusions may remove the relevant activity, and run-off cover may be absent. The prime adviser should obtain evidence of cover before appointment and at each renewal, and should check that the policy responds to the work actually being subcontracted.

Where the client contract requires the prime adviser to maintain cover for a period after termination, the subcontractor should be asked to do the same or the prime adviser should price the gap. Insurance clauses should also address notification obligations and co-operation. A certificate of insurance is evidence of cover, not a guarantee that a claim will be paid.

Intellectual property: secure the rights the client expects

IP flow-down is often overlooked because the parties assume the prime adviser will own or license everything. That assumption can fail where the subcontractor contributes background IP, uses third-party materials, or generates foreground IP in the course of delivery. The client contract may require assignment of deliverables, a broad licence, or specific rights to use outputs. The subcontractor may offer only a limited licence for the prime adviser's internal use.

The matrix should distinguish background IP, foreground IP and third-party materials. It should record whether rights are assigned or licensed, the scope of the licence, the permitted purposes, the treatment of moral rights and the position on escrow or source code where relevant. The prime adviser must be able to grant the client the rights the client contract promises. If it cannot, the gap should be closed before the mandate begins.

Audit rights: create a route the client can actually use

Clients increasingly require audit rights over suppliers, particularly in regulated sectors or where the client is itself accountable to a regulator. The prime adviser may have an audit right against the client, but no corresponding right against the subcontractor. The client cannot usually enforce its audit clause directly against a subcontractor because there is no contract between them.

The flow-down should therefore mirror the audit right: notice periods, scope, frequency, access to premises and records, confidentiality controls, remote audit options and the production of evidence packs. Where the client has a right to audit a sub-processor or a critical supplier, the subcontractor should acknowledge that right and agree to co-operate. The matrix should also identify who bears the cost of the audit and how findings are remediated.

Keep the matrix alive

A flow-down matrix is not a one-off annex. It should be reviewed when the client contract changes, when the subcontractor's scope changes, and at each renewal. The firm should record residual risks, assign an owner and reflect any additional cost in the fee or the supplier price. The objective is not to eliminate every gap; it is to ensure that the gaps are known, accepted and priced by the party best placed to carry them.

For prime advisers, the subcontractor's signature is only the beginning. The real question is whether the client's obligations have travelled downstream intact. A disciplined flow-down matrix gives the firm a defensible answer, and gives the client confidence that the delivery chain is governed rather than merely assembled.