Vendor Contract Red Flags Checklist for Ops Teams

Three vendor PDFs sat in the inbox and you skimmed the monthly fee. A vendor contract red flags checklist is the ops screen of any supplier paper — facilities, payroll, logistics, or software — before anyone countersigns. Freeze the packet — the exact file set that will be signed — match the legal entity, write the all-in price and the notice date, then score High, Medium, or Low and either escalate named Highs or proceed with a written log.

In August 2026, Dana — ops lead, 34-person UK e-commerce — must get a 3PL and a payroll bureau signed before month-end. The 3PL quote is £2,400 a month. The T&Cs auto-renew for 12 months unless written notice is received 90 days prior, cap liability at three months of fees, and allow unnamed subcontractors. The payroll paper has no DPA — a data processing agreement. Finance filed a certificate of insurance. Companies House shows a 14-month-old Ltd, not the trading brand. Sales wants Friday.

Disclaimer: Checkory provides AI support, not legal advice. Consult a qualified lawyer for binding decisions.

How do you lock identity, scope, and the real price?

Write the legal name, what is in and out of scope, and the all-in number before you touch renewal. The quote on page 1 is rarely the lifetime price. If you cannot state the exclusions in one paragraph, stop. Typical mistake: ticking the monthly fee and calling the paper cheap.

Match the contracting name on GOV.UK Companies House — or the equivalent registry — to page 1, not the trading brand. Signer mismatch is High: stop and escalate to counsel — a qualified lawyer. Freeze quote + MSA — a master services agreement, the frame vendors hang order forms on — plus T&Cs, SOW, any DPA, and the insurance exhibit — an attached schedule.

Add overages, pass-throughs, and any “vendor may adjust fees” line. Legislate (22 June 2026): value is not risk. ContractRev (11 August 2026) prices a three-year US deal at $500,000 with a three-month fees cap — colour, not a UK tariff. If a later SOW can override MSA liability, flag it High.

• Do: write one legal name, one all-in number, and the exclusions in a single paragraph.
• Do not: treat the trading brand, the quote, or a low monthly fee as the deal.

What renewal, termination, and lock-in dates should you calendar?

Calendar the notice deadline the day you proceed — not the term-end party. Write initial term, renewal length, how notice must arrive, and whether you have a convenience exit. A 90-day received-not-sent window plus a full-year rollover is lock-in, not a courtesy.

Flag 60–90+ day windows, a termination fee equal to remaining value, and a vendor-only convenience exit. Rob Melton pairs evergreen with a long notice window and a long renewal term. For example, Dana’s 3PL wants notice received 90 days prior on a 12-month rollover. If the paper is a cloud subscribe pack, run the SaaS checklist after this screen.

• Do: write one notice date, the method, and a named owner the day you proceed.
• Do not: calendar the end date and hope finance remembers.

What belongs in a liability, indemnity, and insurance screen?

Find the cap — or the word “none” — whether it is one-sided, and whether insurance is required. Then stop. Do not size carve-outs or super-caps here; if the cap is the deal issue, open the MSA liability cap review. Ask for the endorsement that names you, not only a certificate of insurance.

LegalClarity (18 June 2026): a certificate of insurance does not modify the policy — only the insurer endorsement does. Typical mistake: finance files the COI and ticks “insurance done.” High on this screen: no cover on on-site or professional work; COI only; a one-to-three-month fees cap on a critical or data-holding vendor.

• Do: match the insured entity and ask for the endorsement.
• Do not: treat a COI PDF as insurance closed, or start cap math here.

When do data, subcontractors, and audit become High?

A low monthly fee does not make a processor low-risk. If the vendor touches employee or customer personal data, UK GDPR Article 28 requires a written contract with sub-processor authorisation and audit rights. An NDA — a non-disclosure agreement — plus a COI is not that contract. Unnamed subcontractors on a 3PL, payroll, or IT paper with no flow-down is High.

The ICO controller–processor guide (live 27 August 2026) requires a written contract and prior authorisation before a sub-processor is engaged. ICO’s Article 28(3) list is the ops screen: types of data, security, delete or return, audits. Cite UK GDPR Article 28 — do not paste it. No personal data still needs confidentiality and return-of-materials.

• Do: require written Art. 28 terms, authorised subs, and an audit right when they process personal data.
• Do not: skip the DPA because the fee is £2,400.

Which rows belong on a first-pass severity table?

Score each live issue High, Medium, or Low against harm, not against the monthly fee. High means a human must verify before anyone proceeds. Fill the table from the frozen packet, then pick escalate, proceed-with-log, or walk. If the paper is software-as-a-service, finish this screen first, then open the SaaS checklist.

When do you escalate versus proceed with a log?

A High flag — an item scored high severity — goes to counsel or you walk. Medium becomes a written ask. Low proceeds only with a dated log: owner, flags accepted, notice date. The log is residual risk, not a clearance.

Success bar: fill one page — legal name + Companies House check → scope → all-in price → notice date → cap / insurance / endorsement → data + DPA / subs / audit → High / Med / Low → escalate / log / walk — and name the three items you will not decide alone. In practice: packet → identity → scope + price → lock-in → insurance/cap → data/subs/audit → score → escalate or log.

A first-pass — the first machine pass that extracts clauses before a human reads every page — can highlight rows. Checkory marks them; a human still opens the quote.

• Do: escalate named Highs, or proceed only with a dated owner-and-flags log.
• Do not: stamp the paper cleared because legal will “read it later.”