The money sits in the SOW. The risk sits in the MSA.
Negotiating attention follows spend, so statements of work get line-by-line review while the master terms are waved through as boilerplate. That inverts the real exposure: every future SOW, signed by people who may never read the master, silently inherits its liability caps, its IP defaults, its escalation formulas and its exit mechanics. An organisation planning to work with a supplier for years is not signing one agreement. It is writing the constitution for a relationship whose disputes have not happened yet.
A liability cap is only as real as its carve-outs
The headline cap, commonly an amount tied to twelve months of fees, is the number everyone negotiates and the number that least often decides a dispute. Disputes are decided by the carve-out list: whether breaches of confidentiality, data protection failures, IP infringement and wilful default sit inside the cap or outside it, and whether a separate, higher cap applies to data incidents. A supplier holding your customer data behind a cap of one year's fees is an exposure your insurers and your board would both expect to have seen quantified before signature.
Own the deliverable, license the toolkit, and say which is which
IP clauses fail through vagueness rather than malice. The draft will distinguish deliverables from the supplier's pre-existing materials and improvements, and the boundary between them is where value leaks. If the supplier embeds its proprietary framework in your deliverable, owning the deliverable without a perpetual licence to the embedded material is hollow: you own a document you cannot lawfully keep using. Pin down three things in plain language: bespoke work is assigned to you, embedded supplier material is licensed to you irrevocably, and improvements to supplier tools generated on your engagement do not become a way of charging you twice.
Exit, escalation and audit: the mechanics that bite later
- Termination for convenience: check the notice period, wind-down charges and whether committed spend survives the exit. A right that is priced badly is not a right.
- Rate-card escalation: an index-plus formula compounds across a five-year term into a materially different price. Name the index, cap the uplift and build in a mid-term re-benchmark.
- Audit rights: specify frequency, notice, who bears the cost and which records are in scope, or the clause will not survive its first attempted use.
- Order of precedence: decide deliberately whether the MSA or a SOW wins in a conflict, and whether a SOW can override the master where both parties expressly intend it.
Legal review answers a narrower question than most boards assume
Counsel will confirm the clauses are enforceable and flag legal risk, and will do it well. What legal review does not tell you is whether the cap is thin relative to your data exposure, whether the escalation formula sits above the market, or whether the exit fee makes leaving economically irrational. Those are commercial judgements, not legal ones. The gap is best filled by people who have lived with agreements like this after signature: operators who have tried to enforce an audit clause, exit a master mid-term or contest a carve-out, and know which drafting held and which did not.
