Developing Contracting Best Practices
Tue, 2009-01-06 17:20
Topic(s):

Let me wish you all a very happy and prosperous new year.  In keeping with that theme, I thought it would be useful to start the new year with a series of postings about contracting best practices.  Specifically, our focus will be on the basics of negotiating key terms in vendor agreements for technology-related goods and services.  I have previously made a number of postings relating to the integration of information security into the contracting process.  In these new postings, we will discuss other key contracting practices and terms.

Let’s begin with the most foundational information required to assess any proposed transaction.  That is, certain basic information should be marshaled before any new contract can be evaluated.  While this may seem self-evident, it is amazing how many times we have been asked to review a proposed contract only to discover the business proponents of the deal cannot provide this basic information.

So what are we talking about?  To evaluate any potential transaction, the information described below must be available for review.  The list is not intended to be exhaustive, but only to accumulate very basic information about the transaction.  Other issues unique to your particular business should be added and, of course, appropriate due diligence should be conducted of the vendor.

  • Executive Description of Engagement:  A paragraph or two describing in plain, non-technical English what the deal is about, including a clear statement establishing the business advantage to be gained by entering into the contract.
  • Useful Life:  The anticipated duration of the contract, including desired renewal terms.  In particular, if professional services will be rendered, what is the expected duration of those services (e.g., if software will be implemented, identify the duration of the implementation)?
  • Expected Fees:  Description of the compensation due the vendor over the life of the contract, including a breakdown of all first year fees (e.g., license, professional services, implementation, customization, hardware, and telecommunications fees).  If the fees cannot be completely defined at the outset.  Reasoned estimates should be provided.  If estimates are not possible, evaluation of the deal is likely premature.
  • Performance:  How critical is this service or product to the company?  Is this a customer-facing application?  Where will the services be performed?  Is the vendor located offshore?  Will the vendor use offshore partners or affiliates?  Does the vendor require the use of subcontractors?  If so, who are the intended subcontractors?  Will the vendor be performing services onsite or at its own facilities?  Will the vendor be providing hosting services of any kind (e.g., SaaS, ASP, etc.)?
  • Intellectual Property Issues:  Will the vendor be rendering any development or customization services resulting in intellectual property that the company will want to own?  Will the vendor have access to any highly sensitive company intellectual property? 
  • Other Unique Issues:  Identify information security issues, unique business risks, unusual performance constraints, regulatory issues, etc.

Many businesses now require the foregoing information to be recorded in an internal “deal memo” and circulated to all relevant stakeholders (e.g., risk management, legal, information security, and, of course, senior decision makers).  The deal memo is different from and should not be confused with a “term sheet,” which is designed to summarize the business terms of the deal.  The term sheet will be circulated between the vendor and the customer.  The deal memo is intended as a purely internal document to educate relevant company stakeholders regarding the transaction.

Next time, we will discuss the problem of identifying and controlling vendor revenue streams in technology contracts.

Post a comment
The content of this field is kept private and will not be shown publicly.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.
* Denotes a required field
VIRTUAL CONFERENCE
Security Directions: A Virtual Conference

Security Directions Available On Demand Sept. 30 - Dec. 30

Join us for a virtual event with candid, expert information on top security challenges and issues - all from the comfort of your desktop.

» Register Now

WEBCAST
Protecting PII: How to Work with IT to Manage Risk

Compuware Understand the critical nature of the test data privacy problem and get tips on how to work with IT to implement a test data privacy program.

» View this Webcast