Software Vendor Due Diligence Checklist: Red Flags & Scoring

Choosing a software modernization vendor is a high-impact decision, yet the typical selection process has gaps. Standard RFPs let polished sales pitches obscure operational realities, which leads to predictable failures: budget overruns, missed deadlines, technical debt.

This guide lays out the red flags worth checking before you sign, a pricing transparency scorecard, and a weighted risk framework for comparing vendors. The scenarios below are illustrative, not measured cases.

The Hidden Cost of Inadequate Due Diligence

Most vendor failures trace back to a check that was skipped. Each of the failure types below has a cheap diligence step that would have exposed it before signature.

Failure Type	Root Cause	Diligence Step That Catches It
Mid-project vendor bankruptcy	No financial health check	Credit report (such as D&B) and audited financials
Data breach through the vendor	No SOC 2 validation	Review of the SOC 2 report and its scope
IP ownership dispute	Ambiguous contract terms	Legal review of the IP clause
Scope creep	No fixed-price or change-order mechanism	Procurement review of the statement of work
Performance SLA violations	No reference checks	Structured calls with recent clients

Key principle: Diligence costs a small fraction of a single contract dispute. Spend the money before signature, when it can still change the decision.

Red Flag Analysis

Financial Health Red Flags

Red Flag	What It Signals
Current ratio below 1.0 (current liabilities exceed current assets)	Vendor may not be able to cover near-term obligations
Debt-to-equity above 3.0	Overleveraged; little room to absorb a bad quarter
Negative cash flow for 2+ quarters	Vendor is burning cash; payroll and delivery risk
PAYDEX score below 70	Late payments to suppliers; subcontractors may walk off your project

Illustrative scenario: failed vendor (healthcare modernization)

Project: $18M mainframe-to-cloud migration
Vendor: Mid-tier consultancy (120 employees)
Due diligence gap: No financial statements requested
Outcome: Vendor filed Chapter 11 mid-project
Client impact: Sunk cost on the work already paid for, plus months lost restarting with a new vendor
Prevention: A credit report would have shown a current ratio well under 1.0 and a heavy debt load

Compliance Red Flags

Issue	Typical Impact	When It Surfaces
Expired certifications (SOC 2, ISO 27001)	Audit failure	During the project
Scope mismatch (certification excludes your service type)	Compliance violation	Post-launch
No GDPR data processing agreement (for EU data)	Regulatory fines and liability exposure under GDPR	Legal review
Subcontractor non-compliance	Contract breach	Client audit

Illustrative scenario: GDPR violation

Vendor: Cloud migration specialist
Client: EU-based bank
Issue: Vendor subcontracted to a non-EU data center without a data processing agreement
Discovery: During a routine compliance audit, months into the project
Impact: Regulatory exposure for the bank and a liability dispute with the vendor
Should have been caught: Subcontractor disclosure and a data residency clause review

Security Red Flags

Vendor security posture is easiest to judge from the attestation they hold and what it covers:

Vendor Security Posture	What It Tells You
No SOC 2 (or expired)	No independent assurance that controls exist
SOC 2 Type I only	Controls were designed correctly at a point in time; operating effectiveness is untested
SOC 2 Type II (current)	Controls were tested over a review period (commonly 3 to 12 months)
SOC 2 plus ISO 27001	Two independent attestations; confirm both cover the services you are buying

Illustrative scenario: vendor breach liability

Project: Patient portal modernization ($12M)
Vendor: Healthcare IT consultancy
Security claim: "We follow HIPAA best practices"
Reality: No SOC 2, no pen testing, no incident response plan
Breach: Ransomware through vendor VPN access, late in the project
Client impact: Patient records exposed and a large settlement
Vendor liability: The contract capped liability at $500K, and the vendor could not cover losses beyond that
Prevention: Require SOC 2 Type II, and verify cyber liability insurance and a liability cap proportionate to the project

Pricing Transparency Scorecard

Compare proposals on how much of the real cost they disclose. This scoring approach is a suggested method for comparing proposals, not a published benchmark.

Transparency score (0-100):

+20 pts: Fixed-price contract with clear deliverables
+15 pts: Itemized cost breakdown (labor, tools, licenses)
+15 pts: Change order process documented with rate card
+10 pts: Not-to-exceed cap on T&M components
+10 pts: Transparent subcontractor markup disclosure
+10 pts: Data egress/storage costs specified
+10 pts: Post-launch support pricing (years 2-5)
+10 pts: Exit/transition costs documented

Where hidden costs tend to appear:

Vendor Category	Common Hidden Costs
Large consulting firms	T&M overages, offshore/onshore mix changes
Boutique specialists	IP licensing, tool costs
Offshore providers	Currency fluctuation, turnover backfill
Product plus services vendors	Professional services escalation

Typical overrun patterns in proposals: a fixed price that excludes a required "optimization services" T&M block, perpetual licensing that was never itemized, and change orders that accumulate across dozens of scope changes. Ask for each of these to be priced in the proposal.

Operational Capacity Red Flags

Delivery Capacity

Vendor size shifts the trade-off but does not settle it. Larger vendors tend to cost more in absolute terms; smaller vendors tend to be more flexible on scope changes. Check three things regardless of size:

Delivery history on projects like yours: ask for on-time and on-budget records for comparable scope, and confirm them in reference calls.
Bench depth: who replaces a senior architect who leaves mid-project?
Team composition: the ratio of onshore architects and project managers to offshore developers, and whether that ratio is written into the contract.

Red flag: offshore/onshore bait-and-switch

Proposal: 50/50 offshore/onshore mix
Reality: Closer to 85/15 after the first few months, once senior architects rotated off
Detection: Reference checks revealed the same pattern across several clients
Contract fix: Lock onshore ratios contractually, with liquidated damages for violations

Contract Red Flags

Top 10 Contractual Red Flags

Red Flag	Typical Impact
No IP ownership clause	Vendor retains code, client pays license
Liability cap far below project value	Client assumes most of the breach risk
No termination for convenience	Locked into a failed partnership
Vague acceptance criteria	Never-ending "bug fixes"
Auto-renewal without notice period	Unwanted multi-year extension
No SLA penalties	No recourse for poor performance
Vendor-favorable arbitration clause	Expensive, biased dispute process
No data deletion upon termination	Compliance/privacy violation
Unlimited change order authority	Project manager can approve large changes unilaterally
No source code escrow	Vendor bankruptcy means lost access

Illustrative scenario: IP ownership disaster

Project: Custom CRM modernization ($22M)
Contract gap: The IP clause stated "joint ownership" without defining it
Dispute: The client wanted to sell the business; the vendor claimed a share of the code's value
Litigation: A long dispute with heavy legal fees
Settlement: The client paid the vendor for full IP rights
Prevention: A standard work-for-hire clause, which a short legal review would have added

Reference Check Framework

Questions That Reveal Truth

Reference calls are most useful when every vendor gets the same questions and you listen for hesitation:

Question	Red Flag Response
"Did the project finish on time and on budget?"	Hesitation before "yes"
"Describe how the vendor handled an unexpected challenge"	"They blamed us" or a vague answer
"Would you use them again?"	"Probably" instead of a strong "yes"
"How was knowledge transfer?"	"We had to figure things out"
"Rate communication 1-10"	Below 7

Reference check red flags:

Vendor provides fewer than 3 references: performance problems on other projects are more likely
No references from the last 12 months: recent team or process changes may be hiding
No references matching your project type: the vendor may struggle with your complexity
Reference is a vendor employee's personal contact: likely biased or incomplete

Illustrative scenario: reference fraud

Vendor: Claimed $180M in annual modernization revenue
References: Five glowing testimonials
Red flag: All five references were more than two years old
Investigation: LinkedIn research showed three were ex-employees and one was an investor
Reality: The vendor was a small team with a fabricated portfolio

Business Continuity Red Flags

Disaster Recovery Gaps

Gap	Typical Impact	When It Surfaces
No DR plan	Complete project halt during an incident	Too late (during the incident)
DR plan never tested	Recovery takes far longer than claimed	During a client-requested test
Single data center (no failover)	Regional outage takes down the project	During a cloud region outage
No backup supplier for critical tools	Tool vendor price increase hits the project budget	Contract renewal

Key principle: A vendor's response to a disruption shows how mature their continuity planning is. Ask what share of the delivery team already works remotely, and ask to see the last DR test result. A vendor with no tested remote or failover capability will stall when an incident hits.

Due Diligence Scoring Framework

Weighted Risk Scorecard (0-100 Scale)

The weights and pass thresholds below are a starting point. Adjust them to your risk profile, then apply the same scorecard to every vendor you compare.

Category	Weight	Pass Threshold	Your Vendor Score
Financial health	25%	>70	__/100
Compliance posture	20%	>80	__/100
Security maturity	20%	>75	__/100
Operational capacity	15%	>70	__/100
Pricing transparency	10%	>60	__/100
Reference quality	5%	>75	__/100
Contract fairness	3%	>70	__/100
BCP/DR readiness	2%	>65	__/100

Weighted Total Score: __/100

Score interpretation:

85-100: Greenlight; low-risk vendor
70-84: Proceed with enhanced monitoring and contract protections
55-69: High risk; require a remediation plan before contract
<55: Reject; risk exceeds potential value

Illustrative scoring example:

Category	Raw Score	Weight	Weighted Score
Financial health	92 (current ratio 2.1, profitable)	25%	23
Compliance	88 (SOC 2 Type II, ISO 27001, current)	20%	17.6
Security	82 (pen test 6 months old, incident plan)	20%	16.4
Operational	76 (references report mostly on-time delivery)	15%	11.4
Pricing	64 (itemized but no change order cap)	10%	6.4
References	81 (4 strong, 1 lukewarm)	5%	4.05
Contract	58 (IP unclear, no termination for convenience)	3%	1.74
BCP	71 (plan exists, tested 18 months ago)	2%	1.42
Total			82.01

Decision: Proceed with contract amendments (IP and termination clauses). Monitor quarterly.

Implementation Checklist

Phase 1: Initial Screening (Week 1-2)

Request 3 years audited financials
Run D&B credit report + PAYDEX score
Verify SOC 2 Type II (current, scope matches your needs)
Check litigation history (PACER, state courts)
Request 5 references (3 current, 2 former clients)

Phase 2: Deep Dive (Week 3-5)

Financial ratio analysis (current, D/E, profit margin)
Compliance matrix (all required certs with expiration dates)
Security questionnaire (CAIQ or custom)
Request penetration test results (last 12 months)
Conduct reference calls (standardized questions)
Site visit or virtual team intro (assess team depth)

Phase 3: Contract Negotiation (Week 6-8)

Legal review of MSA, DPA, SLA
Negotiate IP ownership (work-for-hire clause)
Add termination for convenience (30-60 day notice)
Define acceptance criteria (measurable, testable)
Cap liability (both parties, with carve-outs for breach)
Require source code escrow
Add SLA penalties (liquidated damages, not "credits")
Lock pricing transparency (itemized costs, change order cap)

Phase 4: Ongoing Monitoring (Post-Signature)

Quarterly compliance re-checks (cert renewals)
Semi-annual financial health review (D&B updates)
Annual contract health assessment (SLA performance)
Continuous reference checks (speak to new clients)

Red Flag Summary: When to Walk Away

Treat each of these as a stop. Either the vendor fixes it in writing before signature, or you walk away. A single one is enough.

Red Flag	Why It Matters
Bankruptcy risk indicators (current ratio below 1.0, negative cash flow)	The vendor may not survive the project
No SOC 2 for data handling	No independent assurance on how your data is protected
Fabricated references	Ethical failure, and the vendor's true capability is unknown
No IP assignment clause, and the vendor refuses to negotiate one	Vendor retains your code
Liability cap far below contract value (for example under $1M on a $10M+ project)	Inadequate coverage for a major failure
Won't disclose subcontractors	Hidden compliance and security risk