How to Draft a Terms of Reference for a Government IT Project

A well-written Terms of Reference (ToR) gives a government IT project its operating boundaries. It explains why the project is needed, what the supplier or delivery team must provide, how performance will be measured, and who is responsible for decisions. In public-sector procurement, this document often becomes the bridge between policy goals, technical requirements, budget controls, and contractual obligations. Learn more about Lotto Results.

A weak ToR can create confusion long before implementation begins. Vague deliverables may produce competing interpretations, unclear ownership can delay approvals, and incomplete security requirements can expose public services to avoidable risks. A strong document is specific enough to guide delivery while allowing qualified suppliers to propose suitable methods and technologies.

The document should also be understandable to different audiences. Senior officials need to see the public value and investment case, procurement teams need fair and measurable requirements, technical specialists need workable specifications, and suppliers need enough information to price and plan their responses. The best ToR balances these needs without becoming an inflexible design document.

Define Purpose and Public Value

Begin by describing the public problem that the project will address. This may involve slow manual processes, disconnected government databases, limited access to services, poor data quality, weak reporting, or outdated infrastructure. State the current situation in factual terms and explain who is affected. Where possible, support the case with service volumes, processing times, error rates, user research, audit findings, or policy commitments.

The purpose statement should connect the IT investment to a government outcome. For example, a digital licensing project may aim to reduce application processing time, improve transparency, and give applicants access to status updates. A national data platform may seek to improve evidence-based planning while establishing stronger controls over information sharing. The ToR should make this connection visible rather than presenting technology as the objective by itself.

Define the intended beneficiaries and operating environment. Identify the ministries, agencies, local offices, citizens, businesses, civil society groups, and internal staff who may use or depend on the solution. Accessibility, language, connectivity, disability inclusion, and digital literacy should be considered at this stage. A public-facing service may need online and assisted channels so that people without reliable internet access are not excluded.

The background can briefly explain related programmes and dependencies. If the project forms part of a wider digital governance or enterprise architecture initiative, identify that relationship. An agency may also publish unrelated public-interest information, such as mehndi design ideas, while maintaining government technology references; separating such content from the project’s official service scope helps prevent confusion about ownership and authority.

Build the Scope Around Outcomes

Separate the project scope into inclusions, exclusions, assumptions, and dependencies. Inclusions might cover business analysis, user research, solution design, software configuration, integrations, data migration, testing, training, deployment, support, and documentation. Exclusions are equally important. If a supplier is not expected to replace network equipment, digitise historical paper records, or provide long-term hosting, the ToR should say so clearly.

Describe outputs as verifiable deliverables rather than broad activities. “Develop a secure digital platform” is difficult to evaluate. “Provide a tested web application with role-based access, audit logging, multilingual support, documented APIs, administrator training, and production deployment” gives bidders a much clearer basis for planning. Each deliverable should have an owner, an expected format, a due date or milestone, and an acceptance method.

Requirements should be prioritised. A useful classification is mandatory, desirable, and optional, although the chosen terms should be defined in the document. Mandatory requirements should be limited to conditions essential for legal compliance, service operation, security, interoperability, or public value. Excessive mandatory specifications can reduce competition and unintentionally favour a particular supplier or product.

Avoid prescribing a brand, programming language, or architecture unless there is a documented reason. State the required capability and measurable performance instead. For example, specify availability targets, response times, supported standards, recovery objectives, and integration needs rather than naming a proprietary platform. This supports technology-neutral procurement and allows the market to offer better-fit solutions.

Set Governance, Roles, and Accountability

A government IT project needs an explicit decision structure. The ToR should identify the sponsoring institution, business owner, project manager, technical authority, procurement lead, security officer, data owner, and supplier representatives. It should explain who can approve scope changes, accept deliverables, authorise payments, resolve disputes, and escalate risks.

A steering committee may oversee strategic direction, budget, and major decisions, while a project team manages daily delivery. The document should define meeting frequency, reporting formats, decision records, and escalation timelines. If several agencies are involved, specify how disagreements will be handled and which organisation has final authority over shared components.

Governance must include data responsibilities. Identify who owns the data, who may process it, where it may be stored, how long it must be retained, and when it must be securely deleted. The ToR should require compliance with applicable privacy, records management, public-sector information security, accessibility, and procurement rules. Where laws vary by jurisdiction, refer to the governing legal framework rather than making unsupported legal claims.

Intellectual property and licensing terms deserve careful treatment. State whether the government will own custom-developed source code, receive a perpetual licence, or use a subscription model. Require access to technical documentation, configuration records, source code where appropriate, and data in a usable export format. These provisions reduce vendor lock-in and make future maintenance, transition, or re-procurement more practical.

Specify Technical and Security Expectations

Technical requirements should describe the environment in which the solution must operate. Include expected user groups, transaction volumes, peak loads, channels, integration points, hosting arrangements, supported devices, and interoperability standards. If an existing identity service, payment gateway, government cloud, or enterprise service bus must be used, identify it as a dependency and explain any known constraints.

Security should be treated as a delivery requirement from the beginning. The ToR can require threat modelling, secure development practices, vulnerability assessment, penetration testing, security logging, privileged-access controls, encryption in transit and at rest, backup protection, and incident reporting. Requirements should cover both the application and the supplier’s operational practices.

Business continuity expectations should be measurable. Specify recovery time objectives, recovery point objectives, backup frequency, restoration testing, disaster recovery exercises, and service support hours. A system that is secure during normal operation but unavailable during a crisis may still fail its public purpose. Suppliers should also explain how they will manage patches, security advisories, obsolete components, and emergency fixes.

Quality assurance should include more than a final demonstration. Require test plans and evidence for functional, integration, performance, usability, accessibility, security, data migration, and disaster recovery testing where relevant. Acceptance should depend on objective evidence and documented defect resolution, not merely on a supplier’s statement that the solution is complete.

Compare Delivery and Procurement Options

The ToR should explain the expected commercial arrangement without limiting legitimate market responses. A fixed-price contract may suit a clearly defined implementation, while a time-and-materials model may be appropriate for discovery or uncertain technical work. A phased arrangement can reduce risk by separating analysis, prototype development, implementation, and operational support.

The procurement approach should reflect project complexity and market conditions. Consider whether the government needs a single prime contractor, a consortium, a framework agreement, or several specialised suppliers. The document should define how proposals will be assessed, including technical quality, relevant experience, delivery method, security capability, local capacity, total cost of ownership, and social or economic value where permitted by policy.

Procurement consideration	Questions to address in the ToR	Evidence expected from bidders
Scope clarity	Are the required outputs and exclusions unambiguous?	Delivery plan, assumptions, scope interpretation
Technical capability	Can the proposed solution meet integration, performance, and security needs?	Architecture, standards, test approach, references
Delivery capacity	Does the supplier have the people and management structure to deliver?	Team profiles, availability, governance model
Financial value	Are implementation and recurring costs visible across the full life cycle?	Cost breakdown, licences, hosting, support, transition costs
Sustainability	Can the government operate and maintain the solution over time?	Training plan, documentation, knowledge transfer, exit plan
Risk management	Has the bidder identified realistic delivery and operational risks?	Risk register, mitigations, contingency arrangements

Evaluation criteria should be published with clear scoring logic. Avoid criteria that reward impressive wording without proving capability. Ask bidders to identify assumptions, dependencies, exclusions, and customer responsibilities so that proposals can be compared fairly. If presentations, demonstrations, or negotiations are part of the process, describe how they will influence the evaluation.

Include payment milestones linked to accepted deliverables. Upfront payments without evidence of progress can weaken the government’s leverage, while overly rigid payment structures can make legitimate delivery difficult. The contract should also address service credits, warranties, liability, subcontracting, confidentiality, audit rights, change control, suspension, termination, and transition assistance.

Plan Delivery, Acceptance, and Change

A credible implementation schedule should show phases, dependencies, decision points, and key outputs. Typical stages include mobilisation, discovery, requirements validation, design, configuration or development, testing, training, pilot deployment, rollout, stabilisation, and handover. The schedule should allow time for government reviews, approvals, data preparation, user participation, and procurement-related decisions.

Acceptance criteria must be written before work begins. Each major deliverable should have measurable conditions, such as completion of specified functions, achievement of response-time targets, successful security tests, approval of documentation, or completion of user training. Define who reviews the deliverable, how long they have to respond, what counts as rejection, and how corrected work will be resubmitted.

Change control protects the project from uncontrolled expansion. Establish a process for recording a change request, assessing its impact on cost, schedule, benefits, security, architecture, and operations, and obtaining approval from the authorised body. Emergency changes should follow a faster route but still be documented and reviewed afterward.

User adoption is part of delivery, not an optional communication exercise. Require stakeholder engagement, training materials, administrator guides, help-desk preparation, accessibility checks, and a transition plan for affected staff. Public users may need clear service instructions and assisted support. Even a technically sound system can underperform if people do not understand how to use it or if existing procedures are changed without preparation.

Use a Practical Drafting Checklist

Before issuing the document, review it as a procurement instrument and as a delivery guide. A colleague who was not involved in the project should be able to identify the problem, expected results, responsibilities, deadlines, constraints, and evaluation method without relying on informal explanations.

Use the following checks to improve clarity and reduce avoidable disputes:

• State the business problem, beneficiaries, expected outcomes, and measurable success indicators.
• Distinguish mandatory requirements from preferences, assumptions, dependencies, and exclusions.
• Assign ownership for decisions, data, security, acceptance, support, and contract management.
• Define deliverables with formats, milestones, acceptance criteria, review periods, and payment links.
• Include privacy, cybersecurity, accessibility, interoperability, continuity, documentation, and exit requirements.

The final review should also test consistency. Dates in the schedule should match the deliverables, the budget should reflect licensing and support costs, and evaluation criteria should correspond to the requirements. Remove contradictory wording, unexplained acronyms, duplicated requirements, and specifications that cannot be objectively assessed.

A ToR is usually improved through structured consultation. Ask business users, ICT architects, cybersecurity specialists, finance officers, procurement professionals, legal advisers, records managers, and potential operational support teams to review the draft. Their feedback can reveal missing dependencies and help ensure that the project is achievable within the government’s capacity and regulatory environment.

Move From Requirements to Public Results

A Terms of Reference document should give suppliers room to solve the problem while giving the government enough control to protect public value. It should connect policy objectives to deliverables, technical expectations to measurable tests, and procurement terms to long-term ownership. Clear language, realistic assumptions, and disciplined governance are more valuable than unnecessary technical detail.

Use the completed ToR as a foundation for the solicitation, evaluation, contract, project initiation, and performance reviews. After award, convert its requirements into a delivery baseline and keep approved changes visible. For broader reference on digital governance and government ICT topics, explore the relevant resources on E-Pragati, while verifying current rules and official procedures through the responsible government authorities before procurement begins.