A farm equipment distributor in Casablanca wants to replace its Excel stock tracking with a web application connected to its invoicing. The same request goes out to three providers. The answers come back at 95,000 MAD, 240,000 MAD and 610,000 MAD. The example is hypothetical; the spread is not.
The usual reflex is to drop the most expensive one and negotiate the cheapest. That is often the worst available decision, because a quote is not a price. It is a costed assumption about the work. Three widely separated numbers almost always mean three different readings of the requirement, not three margin levels.
So a quote should be read the way you read a document you intend to audit. Here are the mistakes buyers make most often at this stage, and what to do instead.
The first mistake: comparing totals instead of scope
Those three numbers do not describe the same project. The first may cover four data entry screens and an Excel export. The second may include migrating eleven years of history, an interface with the invoicing software and three weeks of acceptance testing. The third may add a mobile app for the sales team, a half-time project manager and twelve months of managed service. All three are defensible. None of them is comparable to the other two as written.
Comparing IT quotes therefore starts with comparing scope. Take your original request, list the deliverables you expect, then mark each one for each provider: included, excluded, or not mentioned. The third category teaches you the most, because silence in a quote usually turns into money halfway through the project. And if the three providers clearly did not understand the same thing, the problem is not on their side. It is in the request, which is exactly what a properly written IT RFP prevents.
What an IT quote Morocco buyers receive should contain
A usable quote lets you reconstruct the provider’s reasoning, not just their number. The following should all be there, and every missing item deserves a written question before any discussion about the amount.
- Detailed functional scope: named modules and use cases, not “stock management application”.
- Explicit assumptions and exclusions: data volumes, number of users, what is not included.
- Effort in person-days per role: project manager, developer, designer, tester.
- A schedule with milestones, plus the dependencies on your side (design sign-off, data delivery).
- A payment plan tied to those milestones rather than to calendar dates.
- Development, testing and production environments, and who pays for them.
- Acceptance terms: validation window, number of correction rounds included, what counts as a blocking defect.
- Post-launch warranty: duration and scope, fix versus enhancement.
- Maintenance and enhancements, priced separately.
- Third-party licences and subscriptions: who signs up, who pays, starting when.
- Price excluding VAT, the VAT itself, and how long the quote stays valid.
The person-days line is the most useful consistency check you have. A quote of 240,000 MAD for 60 person-days implies an average day rate of 4,000 MAD across all roles, which lets you ask who works on it, for how many days each, and compare that ratio between providers. A one-page quote with a single lump sum is not a quote. It is an intention.
The cheapest quote: look at what went missing
A price far below the others is neither automatically a bargain nor automatically a trap. Most of the time it reflects a scope stripped of the items clients forget to ask for: historical data migration, integration with the tools already in place, acceptance testing and corrections, user training, documentation, project management, go-live, the first year of hosting, security work.
Two pieces of arithmetic remove a lot of confusion. VAT first: 95,000 MAD excluding tax means 114,000 MAD to pay at the standard 20% rate, and not everyone quotes on the same basis. Effort second: a scope that visibly needs several months, promised in three weeks, means either the requirement was misread or the plan is to deliver a first version and bill the rest as change requests.
The provider’s profile explains part of the gap too. A solo freelancer carries no tester and no support structure; an IT services quote from a larger firm in Morocco includes those costs, and sometimes the ability to replace someone who leaves. That is not an argument for either option, just a way to read the numbers, and it depends on how critical the application is. The trade-off is covered on its own in this guide to choosing a Morocco IT services company.
Fixed price, time and materials, or subscription
Two quotes showing the same amount can expose you to opposite risks, depending on the billing model sitting behind the total.
Fixed price. The provider commits to a described scope and carries the technical overrun risk. In exchange, anything new goes through a change order. Look for the sentence that ties the price to a specific scope. If it is missing, the fixed price is not fixed.
Time and materials. You are buying days, not an outcome, and the total shown is an estimate. The giveaway words are “estimated”, “indicative”, “based on actual consumption”. It is a healthy model for an evolving product, as long as you impose a spending cap and weekly reporting of days consumed.
Subscription. Maintenance, hosting, support, sometimes all bundled. Check the monthly hour quota, whether unused hours roll over, the response time commitment, the lock-in period, automatic renewal and the notice period.
The costliest setup is an unannounced mix of all three. A quote showing 180,000 MAD of fixed-price development and, two pages later, 8,000 MAD per month of maintenance on a three-year auto-renewing term, actually commits you to 468,000 MAD. The number you were comparing was the wrong one.
The clauses people discover too late
IT vendor contract clauses should be reviewed with a lawyer. What follows is not legal advice, only the list of points that cause trouble once the project has shipped.
Code ownership
“Custom application development” gives you no rights over the code that gets written. The transfer of economic rights has to be in writing, tied to a specific event (usually full payment), and it has to say what is transferred: source code, deployment scripts, technical documentation, design files. Ask for the list of third-party components and their licences as well. If the provider built on top of its own proprietary framework, you can end up owning your application’s code without being able to hand it to anyone else.
Exit and handover
Plenty of projects end up, a few years later, with a different provider. The reversibility clause describes the exit kit: repository access, operations documentation, deployment procedure, length of the handover period and its cost. While you are there, check whose name the accounts are in: domain registrar, hosting, DNS, Apple and Google developer accounts. A domain registered in the provider’s name takes ten minutes to fix before signature and becomes a hostage afterwards.
Penalties, acceptance and warranty
A late delivery penalty clause is only worth having if it is symmetrical and capped, because your own sign-off delays push the schedule as much as theirs do. Set an acceptance window (ten working days after delivery, say, after which the delivery is deemed accepted), the number of correction rounds included, and the warranty period. Three to six months after go-live is common. Beyond that it is maintenance, and maintenance is paid work.
The CNDP and subcontracting clause most quotes skip
As soon as the provider touches a customer file, payroll or HR records, it is acting as a processor under Law 09-08. A lot of Moroccan quotes say nothing about it, including for projects that handle personal data from day one to the last day.
What the quote or contract should state: the purpose and exact boundaries of data access, a confidentiality undertaking covering the individuals assigned to the project, where hosting and backups physically sit, a ban on subcontracting to a third party without written consent, the security measures applied, what happens to the data at the end of the contract (return, then certified deletion), and who files the processing declaration.
Location is the point most often skipped. Hosting on a European or American cloud, or sending database extracts to an external AI tool, means transferring data outside Morocco, which is regulated and requires going through the CNDP. Check the current requirements on the CNDP website and hold the quote against this CNDP Law 09-08 compliance checklist. A provider who cannot answer this at quoting stage will not answer it any better in production.
Five questions to ask before you sign
Sent in writing to the two or three providers still in the running, these questions sort candidates better than any scoring grid.
- Who actually works on this, and for what share of their time? A project manager allocated at 5% does not exist.
- What is not included in this price? The quality of that answer tells you how the whole relationship will go.
- How is a change request estimated, approved and billed? Ask for the process and the turnaround, not just the day rate.
- What happens if we stop after phase 1? What you get back, in what state, at what cost.
- What does year 2 cost? Hosting, licences, maintenance, support. Total cost of ownership often decides differently from build price.
What is actually negotiable
The headline number barely moves. Past a few percent, a price cut with no scope cut means somebody has agreed to lose money on your project, and you will pay for it in availability, in team seniority or in testing quality.
What negotiates well: phasing, the payment plan (30% on order, 40% on acceptance, 30% on go-live beats 50% upfront), warranty length, knowledge transfer to your internal team, a cap on penalties, documentation being included, the day rate against a volume commitment, and the ownership clause.
Negotiating a freelance developer quote and negotiating with a services firm follow different logics. For one, the margin is their personal income. For the other, there are internal rate cards and sometimes room to move on the mix of junior and senior profiles. In both cases, asking for a smaller scope works better than asking for a flat discount.
What does not negotiate: acceptance testing, data migration, documentation and security. Deleting those lines does not reduce the cost of the project, it moves it onto your own staff and into next year. If the budget will not stretch, cut functional scope and deliver in two stages, along the lines described in the digital transformation roadmap for Moroccan SMEs.
Frequently asked questions
How many quotes should I request for an IT project?
Three is enough, provided they all answer the same reference document. Beyond that, comparison time outweighs the benefit. Below two, you have no reference point on price or on how differently the requirement can be interpreted.
Is a signed quote a contract in Morocco?
A quote signed with an acceptance mention binds both parties to what it contains, which is precisely the problem when all it contains is an amount. For anything structural, have a services agreement drawn up with the quote attached as an annex, and have the wording checked by legal counsel.
What deposit is normal?
A third on order is common practice. What matters more than the percentage is that later payments attach to verifiable milestones rather than dates, and that a meaningful balance remains payable after go-live.
What if the three quotes stay incomparable?
Send all three providers the same grid: your list of deliverables, one column for price, one for effort in days, one for exclusions. Whoever refuses to fill it in has already told you something useful.
Digital transformation consulting at Arrowlancer covers this exact moment: reading the quotes you received, rebuilding the scope behind each one, flagging the missing line items and the clauses to fix before signature, CNDP obligations included. If you have two or three proposals on your desk and a doubt about what you are actually comparing, tell us about the project, or look at our consulting and assessment services, which are meant to be used before you commit rather than after.