Most failed operational software fails before a line of code is written. It fails in the specification, where a document describes the process as the manual says it runs rather than as it actually runs, and in an evaluation that scores vendors on features rather than on what happens after handover.
These are the clauses we would want on the other side of the table, offered in the knowledge that they make our own work harder to win and easier to hold to.
Ask for the source, in writing
Not a licence to use it. Possession of it, in a repository the institution controls, updated continuously rather than delivered at the end. A vendor unwilling to agree has told you their commercial model depends on you not having it.
Require a build by someone else
Before final payment, have a third party build and deploy the system from the delivered source, using only the delivered documentation. This single clause catches almost everything: undocumented environment variables, a dependency that only exists on one laptop, a deployment that was always done by hand. It is the difference between owning software and owning a folder.
Score the exit, not just the entry
- Can all data be exported in a documented, non-proprietary format, by your own staff, without vendor cooperation?
- Is there a written runbook aimed at an engineer who has never met the vendor?
- Are the credentials, DNS records and infrastructure accounts in the institution's name, or the vendor's?
- What specifically happens if the vendor ceases trading during the contract?
That last question is not rude. It is the most important one on the list, and a serious supplier will have a considered answer.
Pay for the boring parts
Monitoring, backups, restore drills, documentation and training rarely survive budget pressure, because they demonstrate nothing in a steering committee. They are also the entire difference between a system that runs for a decade and one that is quietly abandoned in year two while the paper process resumes.
Insist on a restore drill before go-live. A backup that has never been restored is not a backup; it is a belief.
Scope from the floor
Before agreeing a specification, have the vendor spend a day watching the work — a full shift, at the busiest site, standing where the officers stand. Any supplier who considers that unnecessary is planning to build from the document, and the document is wrong. It is always wrong, in the same way: it describes the process as designed, not the accumulated set of workarounds that is actually keeping the port moving.