Large UK Rail Operator

Questions to ask for a smooth MSP implementation

Cost reduction is often seen as the headline benefit of a Managed Service Programme (MSP), but with critical infrastructure projects typically seen across the energy, rail, utilities, and nuclear industries, the stakes are far higher. Here, the real measure of success is whether an MSP can strengthen safety, compliance, and operational continuity. Before MSP implementation, it’s worth asking the right questions to ensure your programme becomes a safeguard for your organisation and not just a service. The checklist below provides a structured way for stakeholders to evaluate what “good” looks like. 10 essential questions to ask before rolling out an MSP What outcomes do we want? (e.g., safety, compliance, surge capability, cost efficiency) Which worker categories and sites are in scope? (temporary, safety-critical, cleared personnel) How is governance structured? (cyber certification, business continuity, regulatory audit readiness) What sector-specific safety controls are provided? (Sentinel/PTS, EUSR, BPSS/SC/DV clearance) How are IR35, AWR, right-to-work and umbrella risks handled? How does the MSP support social value and ethical supply chain goals? What technology underpins the VMS and data reporting? (integrations, dashboards, GDPR compliance) Which KPIs will be tracked? (time-to-fill, fill rate, compliance rates) What is the mobilisation and change plan? (pilot, training, audits) What’s the exit plan? (data export, knowledge transfer, continuity) 1. What outcomes do we need? Clarity on outcomes not only guides your MSP partnership but also strengthens your internal business case. We’ve unpacked this further in our blog on building a business case for an MSP. Cost efficiency is one part, but so are safety assurance, compliance, and workforce resilience. Each function will view outcomes through its own lens: service levels, visibility of worker status, faster site access, or audit-ready integrations. The end goal is the same: assurance and continuity. What good looks like: Outcomes linked to risk mitigation (safety incidents, fatigue, cyber). KPIs such as time-to-site, right-to-work compliance rates, audit pass rates, and incident reduction. Alignment with regulations: IR35, Agency Workers Regulations 2010 (AWR), Conduct Regulations, NIS, and the Modern Slavery Act. 2. What is the scope of services? An MSP can cover everything from temporary and contract workers to niche, highly cleared roles. Defining scope clearly avoids costly gaps or overlaps. What good looks like: Clear worker categories in and out of scope. Documented responsibility for IR35, AWR, and right-to-work checks. Agreed processes for sector clearance and site access. For organisations implementing an MSP for the first time, defining scope is one of the biggest factors in choosing the right provider. Our guide on how to choose your first MSP provider outlines how scope and service expectations should shape that decision. 3. How will governance and risk be managed? MSP providers operating in these highly regulated sectors, such as the energy sector or nuclear sector, need to demonstrate how to ensure MSP IR35 and right-to-work compliance and strong governance. Regulatory penalties, cyber breaches, or continuity failures can have serious consequences. What good looks like: Alignment with regulations (IR35, AWR, Conduct Regs, NIS, GDPR). Cyber certifications such as Cyber Essentials Plus or ISO 27001. Business continuity aligned to ISO 22301. Processes mapped to NCSC supply chain security principles. 4. How are safety and competence controlled? Workforce safety is non-negotiable. Each sector requires specific qualifications and clearances (e.g., Sentinel/PTS, EUSR/CSCS, BPSS/SC/DV). An MSP must build these checks into their operating model. Example: Rail sites: Sentinel/PTS competence cards Utilities sites: CSCS Nuclear sites: Baseline personnel security standard (BPSS)/security clearance (SC/DV) What good looks like: Verified competence and clearance checks embedded in onboarding. Fatigue management through working hours monitoring. Consistent reporting of incidents and near misses. 5. How are employment law and pay risks managed? UK workforce legislation is complex. Mismanagement of IR35, AWR, or umbrella companies risks claims, fines, reputational damage, and workforce disruption. What good looks like: Clear allocation of responsibility for IR35 assessments and AWR compliance. Verified right-to-work checks. Due diligence on umbrella companies. Fair pay and holiday entitlement assurance processes. Questions to ask: How are umbrella companies verified? What safeguards ensure fair pay and holiday entitlement? How does the MSP partner track and apply legislative changes? 6. How does the MSP contribute to social value and ethics? Beyond compliance, organisations are increasingly accountable for social value. This includes commitments under the UK Government’s Social Value Model and obligations under the Modern Slavery Act. Signals of good practice: Anti-modern slavery due diligence. Evidence of diverse or local supplier engagement. Apprenticeships and training pathways. Diversity and inclusion outcomes. Transparent workforce and hiring reports. 7. How will technology and data be integrated? With technology underpinning a lot of the programme, you’ll want to know how to integrate technology in an MSP rollout. The Vendor Management System (VMS) should provide not only a single source of truth for your workforce but also the tools to ensure total compliance, visibility, and efficiency. From onboarding and scheduling to site access, reporting dashboards, and secure integrations, the platform must work seamlessly with your existing systems. Whether the technology is supplied by the MSP or owned in-house, it should strengthen assurance rather than add complexity. What good looks like: A secure, GDPR-compliant VMS that protects sensitive data. Interoperability with HR, payroll, and site access systems. Cyber security controls aligned to NCSC supply chain guidance. Real-time dashboards accessible to all relevant stakeholders. 8. How are commercial terms structured? Commercial structures should protect both buyer and supplier while incentivising safety and compliance. What good looks like: KPIs and service credits linked to compliance and safety outcomes, not just cost. Transparent margin structures. Transparent subcontractor management. Flexibility for volume fluctuations. 9. What is the mobilisation plan? Even the best-designed managed service programme can falter if mobilisation isn’t executed effectively. A reliable MSP provider will build in phased rollout, stakeholder training, and assurance checkpoints to maintain good relationships and governance throughout. What good looks like: Phased pilot implementation or phased rollout Early integration and system testing. Stakeholder workshops across functions. Manager training and communication support. Early audit checks to confirm compliance. Ongoing audit checkpoints. 10. How will the exit plan and knowledge transfer work? Continuity matters. If you transition MSP providers, knowledge and data must transfer smoothly to protect your business continuity. What good looks like: Documented exit plans and transition milestones. Data portability agreements. Knowledge transfer embedded in contracts. Questions to ask: How will data be returned? And in what format? Is contractual knowledge transfer guaranteed? What transition support is included? Priorities before MSP go-live Every function has a stake in the success of the programme. While priorities differ, they must align around the same goals of safety, compliance, and efficiency. Function Core priorities Procurement Transparent contracts, audit rights, enforceable service levels, supply chain due diligence HR/Talent IR35 and AWR compliance, fair pay controls, diversity and workforce visibility HSE/Operations Competence checks, fatigue management, sector safety cards, incident reporting Cyber/IT Secure integrations, Cyber Essentials/ISO 27001, GDPR compliance, audit trails When done right, a managed service programme becomes an integral part of your safety, compliance, and resilience ecosystem. See this in action within our E.ON MSP partnership. If an MSP provider can demonstrate evidence across these ten areas, you’re far more likely to have found a partner who can strengthen both your workforce and your risk posture.