Web design agencies strategy: an evidence-led brief

What to take away

Define one user task and one buyer problem

A website plan starts with a problem an accountable owner recognises, not a redesign or a favourite supplier. Write the buyer problem first: what avoidable work or risk does the current site create?

Then write the user task in the person's own words. GOV.UK's service manual tells teams to start by learning user needs, including how people complete the task today. Stakeholder opinion stays an assumption until research supports it.

Keep acquisition decisions away from service decisions. A paid campaign that brings enquiries in says nothing about whether the form routes them correctly. The acquisition channels guide documents that split.

Example: one England service, one task and one acceptance test

Figures are illustrative. An England training provider handles course enquiries by phone and email, and staff answer the same eligibility questions.

Buyer problem: avoidable call handling. User task: decide whether the course fits, then send one enquiry with the right details.

Acceptance test: 8 of 10 recruited participants complete the task unaided in a moderated session, every test enquiry reaches the correct queue, and no critical accessibility or security finding is open at sign-off.

Service boundary: eligibility page, form, confirmation email, staff queue and phone alternative. Each line is checkable, and none can be replaced by the word modern.

Write the decision statement and the evidence packet

Start with one sentence.

By 31 March 2027, the operations lead will choose among keep, repair, in-house and agency options for course enquirers, because gate evidence will show whether the acceptance conditions can be met within budget.

Then complete the fields that give it meaning: options, population, evidence owner, acceptance conditions, constraints, review date and stop condition.

Give every assertion an evidence class:

Keep one evidence register with a row per assertion and these columns: the assertion, its class, the source and date, the population it covers, the owner, the acceptance condition it supports, and its status. A register with no unknowns is a warning, not a clean sheet.

For analytics, define the event, denominator, period, consent state and owner. Do not read visits as demand or an enquiry as a sale. The measurement system article supplies blank formulas and named evidence owners.

Draw the service boundary before you estimate

A page inventory is not a service map. Follow the person from trigger through confirmation, fulfilment, correction, retention and exit, and record the manual queues and assisted routes behind the visible page.

For each component, name the owner, inputs and outputs, data dependencies, acceptance evidence, rollback authority, and export or deletion terms. A polished front end must not pass while the confirmation email fails.

Keep the non-compensating gates separate

A strong visual test cannot offset a privacy failure, a missing right or an unsupported claim.

ICO guidance on cookies and similar technologies notes that PECR regulation 6 can cover technologies beyond cookies, and non-essential access generally needs a valid choice first. The Equality Act 2010 sets the reasonable-adjustments duty, which automated checks alone will not meet.

Security is a third stream. The NCSC's secure development and deployment principles cover the repository, build pipeline and continuing tests, but NCSC states they do not guarantee a secure product. The quality checklist keeps the three gates separate so you can sign off or hold each one.

Set a date to recheck the evidence

At the recheck, verify the ICO's current electronic-mail marketing guidance, consent wording, suppression routes and claim evidence against current requirements.

Set a recheck date, for example 31 March 2027. Re-test each gate and recheck the claim register against its evidence files.

The same decision sheet compares keep, repair, in-house and agency routes, and nothing is scored until the evidence is complete.

Treat directory listings as a shortlist starting point

Treat a directory listing as the start of a shortlist, not a verdict. Confirm what a listing can show: the registered company name and number on the Companies House register, and a data protection fee entry on the ICO register. Where an agency claims security credentials, ask for the certificate behind the claim, whether that is Cyber Essentials or ISO/IEC 27001.

Give every shortlisted web design agency the same brief: the buyer problem, the user task, the service boundary, the acceptance tests and the gate evidence you will require. Ask for a named lead, examples of the same task completed, and a written approach to the confirmation email and the staff queue behind it.

Score nothing on presentation. A striking homepage says nothing about whether an enquiry reaches the right queue. Keep the do-nothing option on the sheet until the evidence rules it out, and record why each candidate was dropped.

Common questions

What must the strategy document contain?

One decision statement, the buyer problem, the user task, the service boundary, the evidence packet and the dated gate verdicts.

How do I test acceptance before signing?

Set the task, recruit representative participants and record pass or fail against the written condition. Push a synthetic submission through the real queue and confirm no critical finding is open.

Which UK rules belong in the brief?

PECR and UK GDPR for consent and personal data, the Equality Act 2010 for reasonable adjustments, the CAP Code for claims, and written IP terms. Qualified advisers confirm how each applies.