Scope Creep Examples — Web development
Compliance sign-off requested, outside the agency's actual expertise
The client asks the dev team to confirm the payment flow is fully PCI-DSS compliant — a formal compliance certification, not a development task.
The build includes a checkout flow implemented using industry-standard practices (tokenized payments via the processor, no raw card data touching the client's servers). The client asks the dev team to formally confirm the implementation is PCI-DSS compliant so they can tell their board it's been "certified" — but PCI compliance certification is a formal audit process performed by a Qualified Security Assessor, not something a development team can attest to, regardless of how well the code follows best practices.
Clause typically implicated
Clause typically implicated
Liability limitation clause→ — Usually excludes formal compliance certifications from what the agency is liable for or authorized to attest to — worth confirming before responding to a certification request directly.
Suggested change-order wording
Suggested change-order wording (illustrative, not legal advice)
We've implemented the checkout using tokenized payments and industry-standard practices to support PCI compliance, but formal PCI-DSS certification requires an audit by a Qualified Security Assessor — that's outside what we're authorized to attest to. I'd recommend engaging a QSA for formal certification; we're glad to support that audit process from the technical side if useful.
How this usually resolves
Being specific about what was actually done (tokenization, no raw card data stored) alongside the redirect to a formal auditor gives the client something concrete to relay internally, rather than a flat no — it shows real work was done in support of compliance even while correctly declining to certify it.
Related reading