Consultancies and internal audit functions can take inbound scope requests on a services page. The form captures what they want audited and when, before anyone sends a 40-page proposal.
Notify the proposal owner.
Edit the select to match rate cards.
Tell them what ‘in scope’ means in a sentence above the form.
Price after you understand the boundary.
An audit request form is a scoping lead: SOC 2 Type II, WCAG, ISO, stocktake, or a process audit. US startups chasing enterprise deals and UK firms preparing for ISO 27001 both need a structured ask so partners are not guessing the system boundary from a one-line email.
It is not the engagement letter. It is not a penetration-test booking with a rules-of-engagement annex. Those documents come after a call.
‘Audit us’ is not a statement of work. You need the framework, the environment count, and a date they think they need a report.
Do not ask them to upload production data or password vaults to a public form.
RFPs, Coupa, and a warm intro from the CFO all exist. HTML catches inbound from the website.
Next to frameworks you actually deliver. Notifications to the partner who writes proposals.
Still required for public sector. This form is for everyone else.
Loses the framework and the deadline in a signature block.
Right for in-house IA teams. External firms use this HTML path.
A three-page firm site can host this under ‘request a conversation’ without buying HubSpot.
Independence and conflict checks still happen in your CRM. Flag competitor names in details, then run your real process.
Treat pentests as a specialised type. You still need a separate RoE process.
Ask for a link to a private file, not an unrestricted upload of findings.
Use two pages or a type option. Routing matters for independence.
They may still need a portal. Offer this for SMEs and commercial inbound.
Capture repro steps, severity, and environment from users on your site.
Let customers pitch product ideas with context, not a one-line tweet.
A lighter intake than a feature request for culture, process, or UX niggles.