Scope of work is useful to see but as with all service providers and particularly risk, scope is quickly ignored because when work needs to be done, it will get done. Either through an existing service provider or elsewhere.
The price of service provider should not be a factor in deciding who the second risk provider is. I believe this is a place where @AaveLabs @ACI or @bgdlabs should simply set a price for the 6 month engagement so that prospective service providers do not get into a bidding war.