Selection

ERP contract negotiation checklist for Australian businesses

A practical checklist for aligning ERP scope, fees, service levels, security, data rights, renewal terms, and exit obligations before signing.

An ERP proposal can look complete while the contract leaves critical assumptions unresolved. Software subscriptions, implementation services, third-party apps, integrations, data migration, support, and cloud terms may sit in separate documents with different renewal dates and responsibilities.

The commercial goal is not to remove every project risk. It is to make scope, decision rights, payment triggers, service obligations, and exit costs clear enough that both sides can manage the risks they control.

Use this checklist with commercial and legal advisers before signing. It is practical buyer guidance, not legal advice.

1. Reconcile every contract document

• Build one document register covering the order form, statement of work, software terms, implementation terms, support agreement, service levels, privacy terms, security schedule, third-party app terms, and any partner proposal incorporated by reference.
• Set an order of precedence so the parties know which document controls when the proposal, statement of work, and standard terms conflict.
• Record the contracting entity, currency, GST treatment, start date, initial term, renewal date, notice period, and governing law for every supplier.
• Ensure commitments made during demonstrations and negotiations appear in the signed scope or an attached requirements schedule.

2. Turn scope into testable outcomes

• Tie scope to named business processes, entities, sites, integrations, reports, data objects, roles, and non-functional requirements rather than broad module labels.
• Separate included configuration from custom development, third-party products, customer tasks, assumptions, exclusions, and work that will require a change request.
• Define deliverables and acceptance criteria for each phase. A milestone should be payable because agreed evidence exists, not merely because a date has arrived.
• State what happens when a deliverable fails acceptance, including remediation time, retesting, disputed invoices, and the point at which persistent failure becomes a material breach.

3. Expose the complete cost and renewal model

• Price software, user types, devices, environments, storage, transactions, AI consumption, implementation, integrations, data migration, testing, training, travel, support, and third-party apps as separate lines.
• Model at least three years with user growth, extra environments, volume bands, support indexation, exchange-rate exposure, minimum commitments, and likely add-ons.
• Confirm whether subscription billing begins at signing, environment provision, implementation start, or production use. Paying full recurring fees throughout a long implementation can materially change the project economics.
• Define renewal notice, price-change notice, auto-renewal, price protection, downgrade rights, unused licence treatment, and the consequences of reducing users or modules.

4. Make delivery governance contractual

• Name the supplier roles that matter, the expected seniority, subcontracting rules, location of delivery, availability assumptions, and the process for replacing key personnel.
• Define the governance cadence, decision owners, escalation path, risk reporting, status evidence, and who can approve scope, budget, design, and changes.
• Require each change request to state the cause, scope impact, price, schedule impact, testing effect, recurring-cost effect, and alternatives considered.
• Protect the schedule from silent assumption failures by requiring early written notice when customer dependencies or supplier constraints threaten a milestone.

5. Allocate security, privacy, and incident duties

• Create a shared-responsibility schedule covering identity, privileged access, configuration, logging, vulnerability management, backups, integrations, incident response, and decommissioning.
• Record where business and personal information will be stored, accessed, supported, backed up, and transferred, including subcontractors and offshore locations.
• Define security-incident notification timeframes, escalation contacts, evidence preservation, investigation cooperation, remediation ownership, and customer communication responsibilities.
• The Australian Cyber Security Centre recommends documenting and sharing the security responsibilities of suppliers and customers. It also treats supplier risk across design, delivery, operation, maintenance, and decommissioning as part of procurement.

6. Protect data, configuration, and continuity

• State that the customer can access and export its data in a usable format during the term and for an agreed period after termination.
• Clarify ownership and reuse rights for configuration, extensions, reports, integration code, documentation, test assets, and other project deliverables.
• Require current solution design, interface inventories, deployment instructions, credentials handover, and administrator documentation rather than relying on individual consultants.
• Define backup, recovery, service continuity, maintenance-window, and support obligations across the ERP and partner-managed components.

7. Negotiate liability and service remedies in context

• Review liability caps, exclusions, indemnities, warranties, insurance, service credits, and sole-remedy clauses against the financial and operational impact of the ERP services.
• Do not treat service credits as a substitute for recovery obligations or termination rights when repeated failures materially affect the business.
• Check whether liability caps apply separately or in aggregate across software, implementation, support, privacy, security, intellectual property, and confidentiality obligations.
• Australian small businesses may have protections against unfair terms in standard form contracts. The ACCC says the current test can cover businesses with fewer than 100 employees or annual turnover below $10 million for new or varied standard form contracts from 9 November 2023. Obtain legal advice on your circumstances.

8. Design the exit before signing

• Define termination for breach, persistent service failure, insolvency, security events, convenience, and prolonged delay, including notice and cure periods.
• Price transition assistance, data export, knowledge transfer, archive access, integration shutdown, environment retention, and deletion evidence before leverage disappears.
• Align termination rights across the software vendor, implementation partner, managed service provider, and critical app vendors so one failed relationship does not trap the wider arrangement.
• Require reasonable cooperation with a replacement provider and set a practical period for retrieving records needed for audit, tax, payroll, customer service, and statutory obligations.

Final contract review questions

• Can finance reproduce the full three-year cost from the signed documents without relying on a salesperson’s spreadsheet?
• Can process owners point to the acceptance evidence required before each implementation payment?
• Are security, backup, integration, and incident responsibilities assigned to a named party without gaps?
• Can the business export its data and operate through a partner change or contract termination?
• Do renewal dates, notice periods, price changes, and minimum commitments appear in a contract calendar with accountable owners?
• Have commercial, technology, security, privacy, finance, and legal reviewers resolved their material issues before signature?

Sources used

• Australian Competition and Consumer Commission: Contracts and small business unfair contract terms.
• Australian Government business.gov.au: Suppliers; Negotiate a contract; Prepare a contract; End a contract.
• Australian Cyber Security Centre: Guidelines for procurement and outsourcing, June 2026.