Skip to content
TrustList
Due diligence

Due diligence on an IT services provider

What to verify about a firm before you hand it a project: who will actually do the work, what is committed in writing, and what happens when the delivery date moves.

22 questions13 deal-stoppersv1.0 · reviewed 19 September 2026
Download as Markdown

Buying services is not buying software. There is no product to trial, the thing you are paying for does not exist yet, and the single largest risk is that the people in the pitch are not the people who turn up. Every question below is aimed at that gap.

Who you are contracting with

Start with the public record. It is free, it takes twenty minutes, and it settles several questions the firm would otherwise answer about itself.

  1. What is the legal entity, its registration number, and are its accounts filed on time?

    Deal-stopper

    The contracting entity is often not the brand on the proposal, and may be in a different country with different recourse.

    Ask for: Registration number and the registry record, checked yourself.

    Red flags

    • Contracting entity differs from the brand without explanation
    • Accounts overdue
    • Entity younger than the track record claimed

  2. How long has this entity traded, and under how many names?

    Deal-stopper

    A long track record presented by a recently incorporated entity usually belongs to a predecessor — sometimes an insolvent one.

    Ask for: Incorporation date and any previous names from the registry.

    Red flags

    • Repeated re-incorporation
    • Prior entity dissolved while owing creditors

  3. What professional indemnity cover is held, at what limit, and is it per claim or in aggregate?

    Deal-stopper

    A limit in aggregate across all clients in a year is a very different protection from one per claim, and the distinction is rarely volunteered.

    Ask for: A current certificate of insurance naming the limit and basis.

    Red flags

    • No cover
    • Limit below the contract value
    • Certificate expired

  4. Can the firm carry your project's cash flow?

    Important

    A supplier that needs your first invoice paid to make payroll is a supplier whose team will be pulled onto whichever client pays fastest.

    Ask for: Filed accounts, or for a small firm, a statement on funding and runway.

    Red flags

    • Persistent negative working capital
    • Late filings
    • Payment terms demanded far in advance of delivery

Who does the work

This is the section that most often predicts how the engagement goes, and the one most often skipped.

  1. Name the people who will be on this project, and show us their recent work.

    Deal-stopper

    Pitch teams and delivery teams are frequently different. Naming individuals in the contract is the only reliable protection.

    Ask for: Named individuals with roles and allocation, written into the statement of work.

    Red flags

    • Roles named but not people
    • Senior people allocated at 5%
    • Team confirmed only after signature

  2. What happens if a named person leaves the project?

    Deal-stopper

    Substitution is inevitable over a long engagement. What matters is whether you get notice, a say, and a handover.

    Ask for: A key-personnel clause with notice, approval rights and a handover period.

    Red flags

    • Unrestricted substitution
    • No handover obligation

  3. Is any of this subcontracted, and to whom?

    Deal-stopper

    Work you believed was in-house being passed on changes who holds your data, which laws apply and who you can actually chase.

    Ask for: A written statement of what is subcontracted and to which entities in which countries.

    Red flags

    • Subcontracting discovered rather than disclosed
    • Chain of more than one layer

  4. What is average staff tenure, and what share of staff left last year?

    Important

    Turnover is the mechanism behind most delivery slippage: knowledge leaves faster than it is written down.

    Ask for: Stated figures, ideally with a headcount trend to sense-check them.

    Red flags

    • Turnover above a third with no explanation
    • Figures unavailable

  5. What is the seniority mix on our team, and how is it billed?

    Important

    A blended rate can hide a team that is mostly junior. Ask for the mix and the rate card separately.

    Ask for: Rate card by grade, plus the proposed mix for your project.

    Red flags

    • Blended rate only
    • Mix changes without a rate change

What is committed in writing

A proposal is marketing. Ask which of its promises survive into the contract.

  1. Is there a written service level agreement, and what is the remedy when it is missed?

    Deal-stopper

    Most services contracts commit to effort, not outcome. Knowing which one you are buying changes what you should pay.

    Ask for: The SLA clause with targets and remedies.

    Red flags

    • Targets without remedies
    • 'Reasonable endeavours' throughout

  2. What share of projects in the last twelve months were delivered on the agreed date?

    Deal-stopper

    Every firm says most. A firm that measures it can give you a number and explain the misses.

    Ask for: A stated figure with the number of projects behind it.

    Red flags

    • No measurement
    • Dates 'reset by scope change' as a matter of routine

  3. How is a change to scope priced and approved?

    Deal-stopper

    Change control is where a fixed price becomes an open one. The process should be written down before there is a dispute about it.

    Ask for: A change-control procedure with who approves, how it is estimated and how disputes are handled.

    Red flags

    • No written procedure
    • Changes approved verbally
    • Estimates not itemised

  4. What are the acceptance criteria, and what happens if we reject?

    Deal-stopper

    Without written acceptance criteria, 'done' is whatever the supplier says it is, and payment usually follows their definition.

    Ask for: Acceptance criteria per deliverable, a testing window, and a remedy path for rejection.

    Red flags

    • Acceptance deemed on elapsed time
    • No rejection process
    • Payment on delivery rather than acceptance

  5. After delivery, how long are defects fixed at no extra cost?

    Important

    A short warranty transfers the cost of the supplier's own mistakes to you within weeks of going live.

    Ask for: The warranty period and what it covers.

    Red flags

    • No warranty
    • Warranty excludes anything found in production

Intellectual property and data

Two questions that are cheap to settle before work starts and expensive to settle afterwards.

  1. Who owns the work product, and when does ownership transfer?

    Deal-stopper

    Ownership on final payment is common and reasonable. Ownership retained by the supplier, or a licence rather than an assignment, is a different deal from the one most buyers think they are making.

    Ask for: The IP clause, stating assignment and the trigger.

    Red flags

    • Licence rather than assignment
    • Transfer not tied to payment
    • Contractors not assigned to the supplier in the first place

  2. What third-party and open-source components will be used, and under which licences?

    Important

    A copyleft licence in a product you intend to distribute can force obligations you did not plan for, and the time to find out is before it is embedded.

    Ask for: A dependency list with licences, updated at delivery.

    Red flags

    • No list
    • Licences unreviewed
    • Supplier reuses code from other clients without saying so

  3. What production data will the team touch, and under what controls?

    Deal-stopper

    Development teams routinely end up with copies of live data. That is a processing activity with your name on it.

    Ask for: A data processing agreement, named locations, and whether live data is used in development environments.

    Red flags

    • Live data copied to laptops
    • No DPA
    • Offshore access undisclosed

  4. What security certification does the firm hold, and what is its scope?

    Important

    For a supplier with access to your systems, the certificate scope matters more than the certificate.

    Ask for: Certificate number, registrar and scope statement, checked on the register.

    Red flags

    • Logo without a certificate
    • Scope covers an office, not delivery

Checking the track record

Case studies are written by the supplier. These are the ways to test them.

  1. For the case study you showed us, can we speak to the client named in it?

    Deal-stopper

    It tests the case study and the relationship at once. A supplier on good terms with a past client can usually arrange it.

    Ask for: A call with the named client.

    Red flags

    • Case studies anonymised without reason
    • Client contact declined for all examples

  2. Show us a project of similar size and complexity, delivered in the last two years.

    Important

    Capability at one scale does not transfer to another, and a firm's largest project is usually prominent in its portfolio.

    Ask for: A comparable engagement with dates, team size and outcome.

    Red flags

    • Nothing comparable
    • Comparable work is years old
    • The example is the firm's own product

  3. Tell us about a project that went badly, and what changed afterwards.

    Important

    Every firm has one. A candid answer is a strong signal; a denial is a stronger one in the other direction.

    Ask for: A specific account with a specific change.

    Red flags

    • Claim that none has gone badly
    • Blame placed entirely on the client

  4. How quickly do they answer you now, before you are a client?

    Worth asking

    Pre-sale responsiveness is the best case. Post-sale is rarely faster.

    Ask for: Your own record of response times during the evaluation.

    Red flags

    • Slow responses while still selling
    • Single point of contact unreachable

This checklist is general guidance, not legal, security or financial advice, and it does not replace your own advisers on anything contentious. It was last reviewed on 19 September 2026. Tell us if something here is wrong or missing.

Keep exploring

More on TrustList