Summary

  • Consultancy is a material RIR expense, but public categories are not directly comparable. RIPE NCC reported EUR 3.916 million of consultancy cost in 2025, EUR 316,000 above budget. APNIC's 2024 budget provided AUD 1.384 million for professional fees. LACNIC reported USD 772,079 of professional fees and hired services in 2023. ARIN budgeted USD 747,000 for consulting and other professional services in 2024. Different scopes, currencies and accounting rules prevent a ranking.
  • External expertise is often necessary. Statutory audit, specialist law, penetration testing, architecture review, compensation advice, tax work, recruitment and short-term absence cover can be cheaper or more credible outside the institution. The risk rises when a consultant defines strategy, frames a governance problem, chooses consultation evidence, drafts policy options or becomes long-term shadow staff.
  • A budget total cannot reveal influence. RIPE NCC's 2026 plan assigns consultancy amounts to community building, membership engagement, public policy and Internet governance, technology, legal, security and human resources. APNIC's 2024 budget names survey work, iTank design, research, an online community platform and other professional services. These disclosures show where agenda effects could occur; they do not prove that a vendor captured a decision.
  • Every material engagement should have a public contract record stating the problem, authority, scope, vendor-selection method, value or value band, duration, conflicts, deliverables, acceptance criteria, information access, publication status, renewal history and responsible executive. Privileged legal advice and security-sensitive detail can be protected without erasing the category, purpose and approving authority.
  • The decisive record is the Board's adoption statement. It should identify the consultant's recommendation, alternatives considered, member or operator evidence, management's response, conflicts, financial effect and reasons for accepting, modifying or rejecting the advice. A Board cannot outsource judgment by citing a confidential report.
  • RIRs should distinguish finite specialist assignments from recurring capacity. Long-running contractors need a convert, compete or end decision; strategic studies need an expiry and result check; and consultant-authored proposals need visible attribution. The aim is not procurement theatre but preservation of institutional competence and member control.

Consultancy is a capability choice before it is a cost line

No serious Internet registry can perform every specialized task with permanent employees. An independent auditor must remain outside management. A complex court dispute may require local counsel. A security assessment is stronger when a qualified external team tests assumptions that internal engineers share. Tax, pension, property, insurance and employment questions can demand jurisdiction-specific knowledge. Executive recruitment may need market reach and confidentiality. A short parental leave or illness can create a temporary gap that should not become a permanent hire.

External expertise can therefore save money and improve independence. The institution buys a defined skill for a limited need instead of maintaining every skill continuously. A consultant who has completed similar assignments elsewhere may see failure patterns faster than an internal team. A Board facing management's preferred option may benefit from a second view.

The opposite can also occur. An institution can repeatedly buy analysis because it has not retained expertise. A temporary adviser can remain for years. A strategy consultant can define the problem in terms that favour more strategy work. A public-affairs firm can turn institutional visibility into a permanent objective. A survey company can ask questions that validate the programme commissioning it. A technology vendor can write requirements that point toward its own product class. A law firm can frame every uncertainty as legal risk and make alternatives appear unsafe.

None of these mechanisms requires corruption. Agenda power often works through sequence. The consultant arrives before members see the issue, selects evidence, names the options, estimates cost and drafts the document to which everyone later reacts. By the time the Board asks for comments, the institution has paid for one path and acquired a sunk cost.

The consultancy budget should therefore be read as a map of capability, timing and decision influence. The price matters. The location of judgment matters more.

The four public totals describe different things

RIPE NCC's audited 2025 Financial Report records EUR 3.916 million of consultancy, up from EUR 2.985 million in 2024 and EUR 316,000 above the 2025 budget. Total 2025 expenses were EUR 38.952 million, so the line was approximately one tenth of expenditure. The report attributes the use primarily to short-term assignments where expertise was unavailable in-house and to continuity during extended leave or illness. It says the institution is moving longer-term consultancies to employment, including Employer-of-Record arrangements where appropriate.

The same report adds an important accounting detail. RIPE NCC had an average of 5.1 Employer-of-Record workers in 2025, and EUR 610,000 of associated cost was recorded under consultancy. A consultancy total can therefore contain labour that resembles staff more than advisory work. The line is not a pure measure of external intellectual influence.

APNIC's 2024 Budget Submission provided AUD 1.384 million for professional fees, down 9.2 percent from the 2023 forecast. The category included contractor and consultant services, legal advice, audit, tax compliance and arrangements where international employment was impractical. Named items included AUD 247,100 for lab research consultancy, AUD 141,371 for iTank design consultancy, AUD 136,925 for legal fees, AUD 120,000 for an online community platform, AUD 96,000 for Tier 1 support improvement, AUD 86,000 for survey expense, and smaller audit, tax, finance, systems and human-resources items.

LACNIC's audited 2023 financial statements reported USD 772,079 for Professional Fees and Hired Services, down from USD 926,036 in 2022. Its 2025 budget planned USD 891,000 for the category, equal to 8 percent of budgeted operating expense.

ARIN's 2024 budget provided USD 1.180 million for professional services, split between USD 433,000 of legal cost and USD 747,000 of consulting and other professional services. Its total operating expense budget, including depreciation adjustments, was USD 31.707 million.

These numbers do not support a cross-registry efficiency ranking. RIPE NCC includes Employer-of-Record cost in consultancy. APNIC combines contractors, advisers and specific projects. ARIN separates legal from other professional services. LACNIC combines professional fees and hired services. Audit, currency, year, labour law, outsourcing choice and organizational size differ. AFRINIC's disrupted governance prevents a stable current comparison.

The totals establish materiality. They justify a stronger record of what capability was bought and how it entered decisions.

RIPE NCC's activity map reveals where influence could matter

The RIPE NCC 2026 Activity Plan and Budget reduced the total consultancy budget from EUR 3.6 million to EUR 3.525 million and stated a preference for regular employment, using consultants for specialized limited work or extended absence. It also distributed consultancy across activities.

Registration Services listed EUR 60,000. Registry Monitoring listed EUR 55,000. The LIR Portal listed EUR 325,000 and RPKI EUR 75,000. Community Building listed EUR 430,000; Membership Engagement EUR 170,000; Coordination and Collaboration EUR 560,000; Public Policy and Internet Governance EUR 530,000. Human Resources listed EUR 250,000, Legal EUR 500,000, Finance EUR 325,000 and Information Security, Risk and Compliance EUR 470,000.

The numbers are useful because they show that consultancy is not confined to audit or technical testing. It sits in community building, member engagement, coordination and public policy - areas where advice can shape what the institution believes its mandate requires. This is not proof that any consultant wrote a policy or caused expansion. It identifies the activities where deliverable and adoption records are especially important.

Technical consultancy has agenda effects too. An architecture review can define which risks count. A portal contractor can decide which user journeys become easy. A security assessor can set a remediation priority. These effects may be beneficial and necessary. They become accountable when the institution publishes requirements, acceptance, alternatives and ownership.

The plan's level of detail is a strong starting point. Members can see a budget by activity rather than one organization-wide number. The missing bridge runs from those amounts to actual engagements, named deliverable types and Board or management decisions.

APNIC's named items show why category matters

APNIC's list distinguishes several kinds of consultancy. Audit and tax advice provide assurance or compliance. NetSuite support helps operate a business system. HR consulting supports internal employment capability. Lab research consultancy can generate public technical knowledge. iTank design consultancy can shape an institutional initiative. An online community platform can shape how participation occurs. A survey can shape how member preference is understood.

The last three deserve a different governance record from statutory audit. A survey vendor can choose sampling, question order, answer scales, translations and weighting. An initiative-design adviser can define the problem, stakeholders, success measure and organizational home. A community-platform designer can make some interactions visible and others difficult, choose moderation and identity features, and influence who participates.

Again, the existence of the budget item does not prove a defective outcome. It shows why the label professional fees is limited public evidence. Members need to know whether the deliverable was an independent finding, management support, public research, software implementation or institutional strategy.

APNIC's 2024 year-end financial report said the Registry pillar saved money partly through insourcing 24-hour Tier 1 support and reducing planned consultant work. The Engagement pillar also reported savings in travel and consultancy. Insourcing is not automatically better, but the decision demonstrates that the employment boundary can change when capability becomes recurring.

Every institution should ask the same question before renewal: if the work is central, continuous and directed like employment, why is it still external? The answer may be lawful international engagement, rare skill, flexibility or independence. It should not be inertia.

ARIN's public contracting rule is useful and incomplete

ARIN publishes an External Contracting Process dating from 2011. It says professional services should be contracted fairly, consistently and for best value, which need not mean lowest price. Services may supplement skills, provide project expertise or support essential mission work.

For contracts of USD 50,000 per year or more, the policy generally calls for Board review before public announcement, a public request, at least two competitive bids where possible, written proposals, evaluation and publication of the award. The request is expected to state services, terms, time frame, deadline and contact. Proposals should include scope, references, price and delivery schedule.

This is a meaningful baseline. It creates a threshold, competition expectation and public award route. It recognizes that technical quality can outweigh price.

The exclusions are equally important. Hotels and meeting venues, operations and maintenance, insurance, employee benefits, travel, legal services and opportunities where information could be inappropriately disclosed are generally outside the process. Some exclusions are practical. Publicly tendering litigation strategy or detailed security operations can create harm. Yet the excluded categories can be large and influential.

An exclusion from open competition should not mean an exclusion from all accountability. The annual contract register can still state the category, value band, duration, selection reason, approving authority and conflict review. Security-sensitive scope can be summarized. Legal privilege can protect advice while members see aggregate spend, firm selection method and whether the relationship is recurring.

ARIN's policy also says it creates no member rights and may be modified. That legal reservation does not erase the governance expectation created by publication. If the Board departs materially, it should record why.

There are at least six consultant roles

The first role is independent assurance. Statutory auditors, penetration testers, control assessors and election auditors should be external because their value depends partly on independence. Their appointment, rotation, non-audit services, scope and findings response matter more than building an internal substitute.

The second is specialist advice. Local counsel, tax experts, actuaries, compensation advisers and technical specialists provide knowledge needed intermittently. The institution should retain enough internal capability to instruct them, challenge assumptions and understand the result.

The third is temporary capacity. A contractor covers leave, a vacancy, a deadline or a project surge. This work needs an end date and knowledge-transfer plan. Repeated extensions indicate a workforce decision that should be made explicitly.

The fourth is implementation. A vendor builds software, deploys a system, conducts training or migrates data. The institution owns requirements, testing, security, documentation and exit. Vendor delivery should not determine policy by technical default.

The fifth is research and evaluation. A consultant conducts a survey, market study, governance review or impact assessment. Independence depends on method, evidence access, publication rights and freedom to report negative findings.

The sixth is strategy and agenda design. A consultant frames the future, redesigns the organization, maps stakeholders, develops a public-policy position or proposes a new initiative. This is where the member mandate is most exposed. External facilitation may improve thought, but the institution must publish who chose the question and who accepted the answer.

One firm can occupy several roles. An auditor can sell advisory services. A law firm can become strategist. A system vendor can advise on policy requirements. The register should identify role changes and related contracts so independence is assessed across the relationship, not one invoice.

Agenda power begins with the terms of reference

The contract's first paragraph can decide more than the final report. A study titled how to implement a regional office assumes an office is the entity. A better question might compare an office, an Employer-of-Record model, local partnerships, travel, remote delivery and no expansion. A review titled improving community engagement can assume that more engagement is required rather than asking which member problems remain unsolved.

Terms of reference should state the decision that remains open. They should list alternatives the adviser must examine, evidence populations, legal constraints, distributional effects and the point at which members or operators are consulted. They should not specify the preferred answer through selective scope.

Boards should publish material terms before the study begins where timing and confidentiality allow. Early publication lets members identify a missing option before the institution pays to analyze the wrong question. It also distinguishes consultation on the problem from consultation on a nearly finished recommendation.

If urgent or confidential conditions prevent early publication, the later adoption record should reproduce the original terms and explain the constraint. Members should be able to see whether scope changed after evidence emerged.

Evidence selection can outsource the constituency

A consultant often controls interviews, surveys and workshops. Selection determines whose experience becomes evidence. Frequent meeting entities are easy to reach. Large members have public-affairs staff. Board contacts respond quickly. Small operators, former members, rejected applicants and networks using national registries may be harder to include.

A report can be professionally executed and still reflect a narrow sample. The deliverable should disclose the sampling frame, invitations, response rate, entity categories, geography, language, funded participation and non-response limits. Anonymous interviews can remain anonymous while the method is public.

Consultants should not describe attendees as the community without a denominator. They should distinguish a member survey from an open consultation, a stakeholder workshop from representative research and expert judgment from empirical finding.

The commissioning institution shares responsibility. If management gives the adviser only friendly contacts or excludes disputed records, the consultant cannot repair the evidence base. The contract should grant appropriate access and record material limitations. The Board should ask who was missing before it accepts a consensus claim.

Drafting can convert advice into institutional voice

External writers may prepare Board papers, strategy language, policy submissions, consultation summaries or public reports. This can improve clarity and speed. It can also blur authorship.

A consultant-drafted document should identify the external contribution when it is material. Attribution need not appear on every sentence. A document note can state that a firm facilitated research, drafted an initial version or provided technical review, and that management and the Board approved the final text.

The distinction matters because institutional voice carries authority. Members may assume a strategy emerged from staff and Board deliberation when the conceptual frame came from a vendor. They may treat a consultation summary as neutral when the same adviser designed the questions. Transparent authorship lets readers examine those dependencies without dismissing the work.

Version history is valuable for high-impact documents. The public need not see privileged comments or personal edits. It should be possible to identify the consultant recommendation, management changes, member input and final Board decision. Otherwise, no one can tell whether advice was adopted, softened or rejected.

Confidentiality needs a narrower vocabulary

Institutions often defend non-disclosure with one word: confidential. The word can cover several legitimate interests and several avoidable habits.

Legal privilege protects communications made for legal advice and litigation. Security confidentiality protects exploitable detail, credentials, architecture and incident response. Commercial confidentiality can protect bids, rates, intellectual property and negotiating positions. Personal confidentiality protects candidates, staff and interviewees. Deliberative confidentiality can permit candid Board discussion before a decision.

Each interest supports a different redaction, duration and disclosure. The existence, category, value band, term and approving authority of a legal engagement can usually be disclosed without revealing advice. A penetration test's high-level findings and remediation status can be public while exploit detail remains restricted. Bid prices may remain confidential during competition and become partly disclosable after award. Interview quotations can be anonymized while the sample is reported.

A contract register should name the exemption used and review date. Permanent secrecy should be exceptional. When the risk expires, the record should open automatically or return for review.

Conflicts extend beyond direct financial interest

A consultant may advise more than one Internet institution, work for governments or network operators, sell a product implicated by the study, help design a programme and later evaluate it, or recruit executives whose compensation it benchmarks. None of these relationships automatically disqualifies the adviser. They can create information advantages and perspective. They must be visible.

The conflict statement should cover the firm, relevant team members, affiliates and recent material work. It should ask whether the consultant could benefit from the recommended implementation, including a follow-on contract. It should identify whether the adviser is permitted to bid for that work.

RIRs are a small institutional world. The same experts move among registries, ICANN, standards bodies, operator groups, law firms and vendors. A rule that demanded no prior relationship could eliminate the people who understand the subject. The correct response is disclosure, role separation, independent review and reasoned waiver where necessary.

The Board should also disclose its own connection to the adviser. A director may have worked with the firm, be employed by a client or participate in another body using the same consultant. Recusal should be recorded, not assumed.

Long-term contractors create a shadow organization

The longer a consultant remains, the more likely the role contains institutional memory, operational authority and employee-like direction. The individual may control systems, draft recurring decisions, supervise staff or represent the registry. Members then see a staff count that understates the people executing the mission and a consultancy line that overstates temporary advice.

This can weaken continuity. Contractors can leave with knowledge. Their files may sit in vendor systems. Contract renewal can become an operational emergency. Internal staff may stop developing the skill because the external expert is always available. A vendor may become impossible to challenge because only it understands the implementation.

Every engagement continuing beyond twelve months should receive a convert, compete or end review. Convert means hire directly or through a lawful employment arrangement if the work is permanent and independence is unnecessary. Compete means retest the market and require transition capability. End means complete knowledge transfer and close the work.

The threshold is a governance trigger, not a legal definition of employment. Different jurisdictions have different rules. A short period may still create dependency, and a multi-year audit appointment may remain properly external. The review should focus on function.

The public statement should report contractor full-time-equivalent estimates, tenure bands and concentration by vendor. RIPE NCC's disclosure that Employer-of-Record costs sit in consultancy is a good example of why the classification bridge matters.

Knowledge transfer must be a paid deliverable

Institutions often ask consultants to produce a report and assume knowledge will remain. A PDF does not transfer judgment. Internal staff need models, assumptions, data definitions, configuration, decision logs, training and the ability to repeat the analysis.

Every implementation, research or strategic contract should include a knowledge-transfer plan. The accepting manager should certify that named internal owners can operate or update the result. Code and data rights should be clear. Critical systems should have escrow or exit provisions where appropriate. Proprietary methods should not make a public institution unable to explain its own decision.

The transfer should be tested. Can staff rerun the model? Can a new vendor take over? Can the Board understand the risk without the consultant in the room? Can members inspect the non-confidential evidence? If not, the deliverable is incomplete even if the presentation was polished.

Payment milestones should reserve a meaningful amount for transfer and acceptance. A final invoice paid before documentation arrives weakens leverage. The contract owner should record defects and lessons for future procurement.

The public contract record can be concise

A useful register does not need to publish thousands of pages. One row and a linked decision note can carry most accountability.

The row should contain vendor and beneficial owner where available; contract category; commissioning unit; responsible executive; purpose; original value or value band; amendments; start and end; competition method; number of qualified bids; conflicts; deliverables; publication status; renewal history; data access; and related implementation eligibility.

Value bands can protect genuinely sensitive rates while showing materiality. Small routine engagements can be aggregated. A lower threshold should apply to strategy, governance, compensation, election, policy and evaluation work because influence can be high even when price is modest.

The linked note should state whether the deliverable was accepted, modified or rejected; whether objectives were met; whether follow-on work was commissioned; what capability remains internal; and what decision used the advice. Negative results belong in the register. A consultant who recommends against a project may have delivered excellent value.

The register should reconcile annually to the audited consultancy and professional-services lines. Differences should explain legal, audit, Employer-of-Record, contractor, security and capitalized costs. This prevents a transparency page from covering only the contracts management prefers to display.

The adoption statement is the missing constitutional document

Advice has no institutional authority until an authorized person or body adopts it. That moment should be visible.

For a major strategy, governance reform, policy position, organization redesign or technology architecture, the Board or delegated executive should publish an adoption statement. It should identify the decision, legal and constitutional authority, consultant and scope, material recommendations, evidence considered, alternatives, member input, conflicts, cost, implementation owner and review date.

The statement should explain departures from the advice. Selective adoption can be reasonable. A Board may accept a risk analysis and reject the proposed remedy. It may choose a slower implementation to protect continuity. It may decide that a technically efficient option exceeds the institutional mandate. Recording those reasons proves that directors exercised judgment.

The statement should also identify what remains uncertain. Consultant branding can give a recommendation more certainty than the evidence warrants. A Board that states assumptions and failure triggers makes later correction easier.

This record protects the consultant as well as members. It prevents management from blaming the adviser for a decision the institution altered or implemented badly. It makes ownership clear.

Members need influence before the contract creates momentum

Not every procurement belongs in a member vote. Management must buy ordinary services, and Boards must act between meetings. Strategic consultancy can nevertheless pre-commit institutional direction before the annual budget is debated.

The draft budget should list planned high-influence engagements by purpose and value band. It should distinguish renewals, new studies and implementation following earlier advice. Members should be able to question the problem definition and alternatives before award where timing allows.

Emergency advice can proceed with retrospective disclosure. A cyber incident, court deadline or sudden executive vacancy cannot wait for a consultation. The exception should state urgency, scope, approving authority and later review.

Board minutes should show material contract approvals and recusals. A generic resolution approving the whole budget is not enough for a consultant designing the next multi-year strategy or governance structure. The Board can keep negotiation details confidential while recording the decision category.

Performance is not the same as agreement

A consultant should not be scored according to whether management likes the conclusion. The evaluator who finds a programme ineffective may have performed better than one who validates it. A lawyer who identifies a serious risk may save cost even if the advice complicates a project. A security tester who finds weaknesses has not failed.

Performance measures should cover method, timeliness, evidence quality, independence, clarity, transfer, implementation usability and adherence to scope. For an implementation vendor, reliability, security, defects and exit readiness matter. For strategic advice, the durability of assumptions and decision usefulness matter.

Outcome review should occur after enough time. Did the new structure reduce the problem? Did the survey predict member response? Did the platform improve access? Did insourcing reduce dependency? The review should separate bad advice from poor execution and changed conditions.

Vendor performance should inform future competition, but blacklisting requires fair reasons and challenge. A small expert market can be damaged by opaque reputational sanctions. The institution should retain evidence and apply a proportionate response.

Audit committees should review the portfolio, not every invoice

Board oversight can become performative if directors approve routine contracts one by one without seeing concentration and influence. The audit, finance or risk committee should review the consultancy portfolio quarterly.

The dashboard should show actual against budget, vendor concentration, role category, long-term contractor count, amendments, noncompetitive awards, conflicts, delayed deliverables, renewals, knowledge-transfer status and decisions awaiting adoption. It should flag one vendor working across assurance and implementation.

The committee should sample contracts, test the register against accounts and review management's classification. It should ask whether recurring work belongs in staff, whether an adviser has become indispensable and whether strategic findings were published. Internal audit can test the controls; an external reviewer can periodically assess high-risk procurement.

The committee should not rewrite technical specifications. Its role is to ensure that authority, evidence, competition, conflict and acceptance are intact.

Crisis spending needs stronger, not weaker, traceability

AFRINIC's crisis demonstrates how legal, technical and governance costs can expand under pressure. Ordinary competition may be impossible when accounts are constrained, authority is disputed, hearings are imminent and services must continue. Consultants, lawyers and temporary managers may become essential.

Emergency conditions justify speed. They do not justify a blank record. Each engagement should identify who had authority to instruct it, which funds paid, the protected function, term, cap, conflicts and reporting destination. Privileged advice can remain protected. The court, receiver, members and later Board need a cost and authority trail.

The institution should distinguish advice that preserves the registry from advice that advances one faction's governance position. Both may be legally permissible under the relevant authority, but they should not be merged under continuity. A crisis consultant should not acquire permanent policy influence merely because ordinary institutions are weak.

When governance returns, the handback should include contracts, work product, credentials, data, outstanding commitments and performance records. Otherwise, temporary professional support becomes another layer of institutional uncertainty.

Better procurement supports a thinner, stronger registry

The argument for scrutiny is not hostility to expertise. A thin registry still needs excellent security, law, audit and engineering. It may use more external specialists because it refuses to build every capability permanently. The difference is that each contract remains tied to the narrow function and does not quietly expand the institution's mandate.

External advice can also challenge expansion. A rigorous study may show that a proposed office, platform, campaign or governance programme has weak benefit. A Board willing to publish and adopt that result demonstrates discipline. Consultancy becomes dangerous when only growth-supporting advice survives.

Portability and operator rights would add an external constraint. If registration service could move under a verified continuity design, management would have stronger reason to buy advice that improves service rather than institutional reach. Number Resource Society principles of auditability, continuity and withdrawable authorization point toward that accountability.

Until then, the contract-to-decision chain must carry more weight. Members fund institutions they cannot readily replace. They are entitled to know which external actors help define those institutions and who remains accountable for the result.

Expertise should enter the institution without taking its mandate

The correct consultancy policy is neither consultants are waste nor experts know best. It is a division of labour with an auditable boundary.

The Board defines authority. Management defines the operational need. Procurement tests capability, value and conflicts. The consultant supplies independent assurance, specialist knowledge, temporary capacity, implementation, research or facilitation. Staff challenge and absorb the work. Members supply relevant evidence and exercise the rights given by the governing instruments. The authorized body owns the decision.

When those roles blur, the budget line becomes an outsourced agenda. A vendor writes the question, selects the entities, recommends the answer, wins the implementation and evaluates the result. Even a competent and honest firm should not occupy that entire chain without separation and disclosure.

When the roles remain clear, consultancy can strengthen the registry. An external auditor can protect members from management error. A security team can reveal a weakness. A lawyer can prevent an unlawful action. A specialist can carry a service through a vacancy. A researcher can expose that a favoured programme does not work.

The public record should make the difference visible. Publish the scope, selection, conflicts, deliverable and adoption. Reconcile the register to the accounts. Convert or retest recurring capacity. Protect privilege narrowly. Record failure. Make the Board explain its judgment.

The institution may outsource work. It cannot outsource its mandate.

Amendments often reveal more than the original award

A competitive contract can become noncompetitive after award through scope changes, extensions and emergency additions. The original price may be below a publication threshold while later amendments make the relationship material. A short diagnostic can become implementation, maintenance and evaluation. By the time the full value is visible, changing vendor may look too risky.

The register should show original value, cumulative amendments and current ceiling. It should explain scope change, approval authority, competition impact and whether other bidders could reasonably have priced the expanded work. A material amendment should trigger a fresh market test unless continuity, intellectual property, security or urgency provides a documented reason.

Cost overruns require context. A consultant can exceed estimate because the institution supplied poor data, changed the question, delayed access or discovered a genuine risk. The vendor can also underestimate, manage weakly or use change requests to recover a low bid. The acceptance note should assign the cause rather than label every overrun as either waste or necessity.

Renewal history is especially important for influence. A strategy adviser retained through several planning cycles may shape institutional language even if each annual contract is modest. A law firm can become the default interpreter of mandate. A communications supplier can control archives, audiences and analytics. Cumulative relationship value and role should be visible across years.

Small contracts can carry large constitutional weight

Financial thresholds are efficient for routine procurement. They are weak proxies for governance risk. A short memorandum on Board authority, a survey of member preference, an election review or the first design of a new policy body may cost less than a large software contract and have a much larger effect on institutional power.

RIRs should use a second threshold based on subject. Governance, election, compensation, mandate, policy, strategic expansion, member research and independent evaluation engagements should enter the public register regardless of value above a low administrative floor. Their adoption statements can be proportionate, but authorship and conflicts should be visible.

The same rule should cover donated and discounted advice. A zero-price study can still create agenda power, and the provider may gain reputation, access or a later implementation opportunity. The record should state estimated value, donor, conditions and follow-on eligibility. Sponsorship should not become an invisible route around procurement scrutiny.

Framework agreements need similar care. Pre-qualifying several firms can speed urgent work, but each call-off should identify purpose, value and selection. The public should be able to distinguish a genuine competition among framework vendors from automatic reuse of one preferred adviser.

Data access must match purpose and end with the contract

Consultants can receive member records, employee data, security information, survey responses, legal files and internal deliberations. The contract should specify the minimum data required, lawful basis, location, subcontractors, retention, deletion, incident duties and audit rights. A broad promise to maintain confidentiality is not a complete data-control plan.

Research and strategy teams should not receive operational personal data merely because access is convenient. A survey provider should not reuse contact lists for its own marketing. A compensation consultant should not share identifiable employee information across clients. A departing vendor should return or verifiably delete material, subject to legal retention obligations.

The adoption record should disclose data categories at a safe level. Members should know whether an adviser used public records, aggregated operational data, confidential interviews or identifiable account information. That context affects how they assess both evidence quality and privacy risk.

When a contract ends, credentials, accounts and remote access must end promptly. System owners should confirm revocation, data return and preservation of institutional records. A contractor who can still enter a registry system after the assignment closes is not merely a procurement defect; it is a continuity and security risk.

Consultant independence requires control of payment timing

An evaluator can be formally external and economically dependent on management's satisfaction. If the final payment depends on acceptance by the programme being reviewed, the consultant may soften findings. If future work is likely, a negative result can threaten renewal. Independence needs contractual protection.

Evaluation criteria should reward method, evidence and clarity rather than a favourable conclusion. Payment milestones should follow completed work, not management agreement. The evaluator should have a route to the Board or audit committee when management disputes publication. Material factual errors can be corrected, while analytical disagreement remains visible.

For high-stakes reviews, the commissioning and paying authority should be separated from the unit under examination. The Board, audit committee or another defined body can own the contract. Management should have a right to respond, not a private veto over findings.

The report should disclose whether the adviser may seek implementation work. A clean rule may prohibit it for some reviews. Where the market is too narrow, the Board can allow participation with a conflict statement and fresh competition. The important point is that the incentive is decided before recommendations are written.

Sources and analytical limits

RIPE NCC's audited 2025 Financial Report supports the consultancy actual, budget variance, prior-year comparison, stated usage, Employer-of-Record classification and transition toward regular employment. The 2026 Activity Plan and Budget supports the organization-wide budget and activity-level consultancy amounts. Those amounts do not identify individual vendors or prove influence.

APNIC's 2024 Budget Submission supports the professional-fee total, stated rationale and named planned assignments. Its December 2024 financial report supports the reported savings and insourcing context. Budgeted line items are not treated as proof that every engagement occurred at the planned amount.

ARIN's 2024 budget supports the professional-services, legal and consulting amounts. Its External Contracting Process supports the threshold, competition, bid, award and exclusion descriptions. The public policy does not reveal every contract or establish that every excluded engagement lacked other review.

LACNIC's audited 2023 financial statements and 2025 budget support the actual and planned Professional Fees and Hired Services amounts. The category is not assumed to contain only strategy consultants.

The article does not convert currencies, compare vendor rates, identify undisclosed firms, infer conflicts from repeat work or claim that any named initiative was consultant-controlled. It uses published totals and scope descriptions to propose a contract-to-decision accountability standard, and treats current AFRINIC comparability as limited by institutional disruption.