Vendor Risk: The Questions to Ask Before You Sign
Most businesses run on other people's software. Payroll, scheduling, accounting, storage, the booking system customers actually touch. Each one is a sensible decision on its own. Together they mean a meaningful part of your operation sits on servers you do not control, run by companies you have never visited.
That is not a reason to panic. It is a reason to ask better questions before you sign, because almost none of them can be asked usefully afterwards.
The contract is the only leverage you will ever have
Before you sign, the vendor wants your business. After you sign, you want your data back, and the balance of power has moved.
This is the practical case for spending an hour on due diligence. Not because you expect a disaster, but because the terms you accept in month one are the terms you live with in year four, when you have three years of records in their system and no obvious way to leave.
Ask what happens when it stops working
Every vendor will tell you their uptime is excellent. The more useful question is what happens on the day it is not.
- How do we find out. A status page nobody watches is not a notification. Ask whether outages are emailed to a named contact.
- How long is normal. Ask for their target restore time, and whether it is in the contract or just on the website.
- What do we do meanwhile. This one is yours to answer, not theirs. If the booking system is down for a day, does your team have a way to keep taking bookings.
The third question matters more than the first two, and it is the one businesses skip.
Ask who can see your data, and where it lives
You do not need a legal opinion to ask three plain questions. Which country is the data stored in. Which of their staff can access it, and under what circumstances. Do they use subcontractors who can also see it.
A good vendor answers these quickly because they have answered them before. A vendor who is surprised by the question is telling you something useful.
If you handle customer records, health information, payment details or anything covered by a regulation in your industry, write the answers down. You will be asked for them eventually, usually by a customer running the same exercise on you.
A vendor's breach becomes your notification obligation. Their outage becomes your outage. You inherit their problems whether or not you inherited their controls.
Ask how you get out
Exit is the question almost nobody asks during a sales process, and the one that costs the most when it is missed.
Four things to settle in writing. Can you export your data in a usable format, not a PDF of a report. How long do they keep it after you cancel, and can you get a copy during that window. What is the notice period, and does the contract renew automatically. Who owns the content and records you put into the system.
The automatic renewal clause deserves a calendar reminder the day you sign. Businesses lose more money to quiet renewals than to any dramatic failure.
Ask what access they need from you
Plenty of vendors need a connection into your systems, a shared mailbox, a folder, an integration token, occasionally a login of their own. Each of those is an account that exists in your business and needs to be managed like one.
Give it an owner, an expiry date and a line on your offboarding checklist. The consultant's account that stayed active for three years after the project ended is one of the most common findings in any access review.
Match the effort to the risk
Not every purchase deserves the same scrutiny. A design tool used by one person for mockups is not the same as the system that holds your customer records.
A simple split works well enough. If the vendor holds customer or financial data, or the business cannot operate without them for a day, do the full set of questions and keep the answers on file. If neither is true, check the exit terms and the renewal date and move on.
Spending two weeks evaluating a fifteen dollar a month tool is its own kind of waste.
Keep a list
Whatever you ask, the answers are only useful if somebody can find them later. A single sheet with one row per vendor covers most of it. What they do, who owns the relationship internally, what data they hold, renewal date, notice period, and where the signed agreement lives.
Review it once a year. You will usually find at least one tool nobody uses any more and at least one relationship that has quietly grown more important than it was when you signed.
This is unglamorous work, and it is the kind of thing that only looks valuable in hindsight. Doing it before you sign takes an hour. Doing it after something goes wrong takes considerably longer.
Want help putting a vendor review together? Book a consultation, or visit www.expertechsolution.com.
