Lesson15 min
The questions and clauses that matter
The fifteen questions
For a critical supplier, fifteen well-chosen questions beat a 120-item questionnaire. Each calls for evidence, not a statement.
Continuity and recovery
- What is your contractual RTO for this service, and how is it measured?
- When did you last test your plan? Provide the report.
- What gap did that test reveal, and where does remediation stand?
- Where is our data hosted, and where are the backups?
- Are your backups immutable or offline?
Dependencies
- Which subcontractors do you rely on for this service?
- Do those subcontractors themselves have critical dependencies?
- What is your geographic exposure?
Security
- Do you hold a current certification or independent audit report?
- Have you suffered a significant security incident in the last 24 months?
- How would you inform us, and within what timeframe?
Soundness and exit
- What is your financial position? Provide the last two years.
- What share of your revenue do we represent?
- In what format and within what timeframe would you return our data?
- How long would it take to transfer this service to another provider?
Question 13 is particularly revealing: a supplier for whom you are 60% of revenue carries a soundness risk; a supplier for whom you are 0.1% will give you no priority in a crisis.
The six clauses that matter
| Clause | Useful content | Trap |
|---|---|---|
| Service levels | Quantified targets, measurement method, penalties | Targets with no measurement method |
| Continuity | Obligation to maintain a plan, test it, share the results | "The provider undertakes to implement the necessary means" |
| Audit | On-site audit right, with notice period and frequency | An audit right "on justified request", unenforceable |
| Incident notification | Quantified deadline, channel, minimum content | "As soon as practicable" |
| Sub-outsourcing | Prior written authorisation, notification of changes | A blanket authorisation granted at signature |
| Exit | Mandatory assistance, return format, transition period length | An exit clause with no assistance obligation |
The three verifications
A clause is worth only as much as the verification of its performance. Three mechanisms, in increasing order of cost:
- Annual documentation review — test report, certification, financial statements. Low cost, moderate value.
- Joint testing — the provider takes part in your exercise, or you take part in theirs. Moderate cost, high value: it is the only mechanism that reveals interface incompatibilities.
- On-site audit — high cost, reserved for the most critical dependencies or triggered by a negative signal.
Joint testing is the most cost-effective mechanism and the least practised. It systematically reveals gaps documentation does not show: stale contacts, escalation channels different from those planned, divergent readings of the service scope.
Key takeaways
- Ask for evidence, not statements
- The audit right needs a timeframe and a modality
- An untested exit clause is an intention