Read the Fine Print Before the Handshake: A Board-Level Framework for Vetting Philippine Advisory Firms

Offshore advisory engagements fail for predictable reasons. Rarely is it a lack of technical capability. More often, it is a gap that surfaced late: an expired registration, an ambiguous subcontracting arrangement, a data security posture that looked fine in the sales deck but collapsed under audit. By the time these issues emerge, the company has already transferred processes, data, and institutional trust.

The remedy is not more caution — it is more structure. Boards and executive teams that evaluate Philippine professional services firms with the same rigor they apply to a domestic acquisition or a material vendor contract consistently outperform those that rely on referrals and rapport. Below is a practical framework, organized around the five questions most US firms never ask until a problem surfaces.

1. Verify Corporate Standing the Way a Regulator Would

Start with the corporate registry, not the website. The Philippine Securities and Exchange Commission maintains public records of registered corporations, and a legitimate advisory firm should be able to produce its SEC Certificate of Registration, current General Information Sheet, and Audited Financial Statements without hesitation.

Ask for three documents explicitly:

• SEC Certificate of Registration — confirms the entity legally exists and matches the name on the contract.
• Mayor's Permit and BIR Certificate of Registration — confirms the firm is operating legitimately in its locality and is current with tax registration.
• Audited financial statements — a firm unwilling to share at least summary financials with a prospective client under NDA is telling you something.

Pay attention to entity names. The firm pitching you and the firm on the engagement letter should be the same legal entity. If a holding structure is involved, understand which entity holds the contract, which employs the staff, and which carries the insurance. Ambiguity here is the single most common source of disputes in cross-border professional services.

2. Interrogate Credentials Beyond the Logos

Professional certifications — CPA licenses from the Philippine Professional Regulation Commission, memberships in PICPA or international bodies, ISO registrations — matter, but verify rather than assume. Ask which specific individuals will be assigned to your engagement, then confirm their credentials individually. A firm's institutional pedigree is no guarantee that the three people actually doing your work hold the qualifications the proposal implied.

For US clients, one additional check is often overlooked: confirm the firm's experience with US-specific regulatory contexts. A Philippine advisory team may be excellent at IFRS-based work but unfamiliar with US GAAP nuances, SOX control environments, or state-level privacy statutes like the CCPA. Ask for concrete examples of US-regulated work, not just US clients.

3. Run References Like a Diligence Committee

Client references are standard practice; how you run them is not. Move past the curated list of satisfied logos. Ask for references from:

• A client of similar size and industry,
• A client whose engagement failed or was restructured — how the firm behaved when things went wrong is more revealing than how it behaves when things go well, and
• A client of at least two years' standing, to test durability beyond the honeymoon phase.

In each conversation, ask about staff turnover on the account, responsiveness during month three (after the sales team has moved on), and whether invoiced scope matched delivered scope. For offshore engagements specifically, ask whether the client ever felt a bait-and-switch between senior leadership who sold the work and junior staff who performed it.

4. Audit Data Security Before Data Moves

The Philippines has a robust data privacy framework — the Data Privacy Act of 2012, enforced by the National Privacy Commission — and reputable firms will readily discuss their compliance posture. But a US board should dig into specifics:

• Certifications: ISO 27001 certification (verify the certificate and scope — some firms certify only a single facility), SOC 2 Type II reports where applicable, and PCI DSS compliance if payment data is involved.
• Infrastructure: Where is data hosted? Are there cross-border transfer mechanisms that satisfy US obligations? How are endpoints controlled?
• Personnel controls: Background check policies, confidentiality agreements at hire, and offboarding procedures for departing staff.
• Incident response: A written breach notification protocol with defined timelines — not a verbal assurance that "we take security seriously."

If your engagement touches healthcare data, financial records, or personally identifiable information of US consumers, involve your own counsel in reviewing the firm's data processing agreement. A well-constructed DPA with clear breach notification windows and audit rights is not an insult to the partnership; it is the mark of a serious counterparty on both sides.

5. Test Cultural Fit Under Pressure, Not at Dinner

Cultural compatibility is the softest variable in the evaluation and the one with the hardest consequences. Philippine professional culture is relationship-oriented, hierarchical, and conflict-averse in ways that can mask early warnings — a team that will not push back on an unrealistic deadline in the sales process will not push back mid-engagement either.

Test for this deliberately. Present a deliberately tight timeline during diligence and observe whether the firm negotiates it honestly. Ask how they escalate disagreements with clients. Request an example of a time they told a client no. A firm with a practiced, specific answer has likely earned that answer through experience; a vague one suggests you will learn about problems through missed deliverables rather than raised flags.

Also assess communication infrastructure: a named engagement lead, defined reporting cadence, escalation paths in writing, and time-zone overlap commitments that match your operating reality. The best firms will volunteer all of this; the rest will improvise it.

From Checklist to Contract

Findings from this diligence should flow directly into the engagement agreement: entity identity, named key personnel, data processing terms, audit rights, staff replacement provisions, and termination triggers tied to verified performance. A Philippine advisory firm that welcomes this level of contractual specificity is demonstrating exactly the professionalism you are seeking. One that resists it has answered your final question — before you asked it.

The US companies that build durable offshore advisory relationships in the Philippines are not the ones that found the best pitch. They are the ones that did the paperwork first. The handshake comes after.