Contract Risk Audit in India: Commercial Agreements, Liability, Indemnity, Termination, Payment & Dispute Controls 2026

A contract risk audit reviews the company’s agreement portfolio as a business-risk system rather than as isolated legal documents. The objective is to identify where contractual commitments can produce unrecoverable receivables, uncapped liability, abrupt termination, operational dependency, regulatory non-compliance, confidentiality loss, intellectual-property disputes or litigation in an unsuitable forum.

Many companies negotiate each agreement independently. Over time this creates inconsistent positions: one customer receives unlimited indemnity, another has a broad liability cap carve-out, a critical vendor can terminate without transition support, and several contracts expire automatically because renewal dates are not tracked.

1. Build a complete contract universe

Start with customers, vendors, distributors, channel partners, landlords, technology providers, cloud and SaaS vendors, consultants, contractors, logistics partners, lenders, insurers, IP licences, NDAs, franchise arrangements, joint ventures and other material commercial relationships.

For each agreement capture entity, counterparty, purpose, value, term, renewal, notice period, governing law, dispute forum, liability cap, indemnity, insurance, data obligations, assignment/change-of-control restriction, key service levels and business owner.

Missing agreements should be treated as a separate risk category. Revenue or procurement supported only by emails, purchase orders or oral arrangements creates evidentiary and commercial uncertainty.

2. Payment and receivable risk

Review payment milestones, invoicing conditions, acceptance procedures, credit periods, disputed-invoice mechanism, withholding rights, interest, set-off, suspension rights and consequences of delayed customer approvals.

Common problems include payment linked to vague acceptance, no deemed-acceptance mechanism, customer right to withhold unrelated amounts, open-ended rejection rights, absence of interest or suspension, and payment terms inconsistent with working-capital assumptions.

For vendors, check advance-payment protection, milestone evidence, performance security, refund rights and whether the company pays before receiving deliverables or goods-receipt confirmation.

3. Scope, deliverables and change control

A large proportion of commercial disputes begins with vague scope. The agreement should identify deliverables, exclusions, dependencies, customer responsibilities, assumptions, timelines, acceptance standards and how changes affect price and schedule.

Where project teams routinely agree changes by email without formal change orders, revenue leakage and scope disputes can accumulate. The contract audit should test whether business practice matches the signed change-control mechanism.

4. Limitation of liability

Review the liability cap, basis of calculation, excluded damages, carve-outs, multiple claims, aggregate versus per-event language and whether the cap is commercially aligned with contract value and insurance.

High-risk drafting includes unlimited general liability, broad exclusions from the cap that swallow the protection, liability for remote consequential loss, no reciprocal cap, and customer-specific penalties that are not reflected in pricing.

Risk should be assessed in context. A modest contract handling sensitive customer data may carry exposure far beyond annual fees, while a high-value supply agreement may have relatively predictable direct-loss risk.

5. Indemnity architecture

Indemnity clauses should be reviewed for trigger, scope, causation, defence control, settlement authority, notice, mitigation and interaction with the liability cap. Broad language covering “all losses arising in any way” can materially expand exposure.

Separate contractual indemnity should be considered for specific risks such as third-party IP claims, confidentiality breach, data incidents, tax obligations, employment claims caused by the vendor, statutory non-compliance or property damage—depending on the transaction.

6. Termination and exit risk

Check termination for cause, cure periods, termination for convenience, insolvency, regulatory trigger, change of control, prolonged force majeure and material breach. Then assess the commercial effect: outstanding payments, refund, data return, handover, transition support, asset return, employee transfer, licence cessation and survival clauses.

A business-critical vendor with a short convenience-termination right and no transition obligation is an operational risk. A customer that can terminate at will after the company makes significant upfront investment creates revenue risk.

7. Service levels, warranties and remedies

Service-level commitments should be objectively measurable. Review uptime, turnaround times, quality standards, response time, service credits, liquidated damages where appropriate, cure periods and termination thresholds.

Warranties should match what the company can actually control. Avoid absolute promises relating to outcomes dependent on third-party systems, customer inputs or external events unless commercially justified.

8. Confidentiality, data and cyber clauses

Review what qualifies as confidential information, permitted use, need-to-know access, subcontractors, compelled disclosure, return/destruction, survival, security obligations and incident notification.

Where personal data is processed, the contract should be aligned with the legally operative data-protection framework, including purpose, processor obligations, security, breach cooperation, retention, deletion and audit rights where appropriate. Cyber clauses should also align with operational incident-response capability; contractual notification promises cannot be managed if the company has no internal escalation process.

See Employee Data Leakage & Confidential Information Investigation in India.

9. Intellectual property ownership and licensing

Confirm ownership of pre-existing IP, newly developed work product, customer-specific deliverables, third-party components, open-source dependencies, licences and post-termination usage rights.

Technology contracts should clearly distinguish ownership from licence. A customer may need broad use rights without requiring transfer of the supplier’s background technology. Conversely, a company should ensure that critical code, designs or content created for it by contractors are properly assigned or licensed.

10. Governing law, arbitration and dispute architecture

Review governing law, jurisdiction, arbitration seat, institution or ad hoc mechanism, number of arbitrators, appointment process, language, interim relief and notice provisions. Dispute clauses copied from foreign templates can create unnecessary cost or uncertainty.

The audit should also check whether different documents in the same transaction contain inconsistent dispute clauses. A master agreement, purchase order and statement of work should not send the same dispute to three different forums.

11. Regulatory and statutory contract risk

Contracts cannot override statutory obligations. Review sector-specific licences, tax allocation, labour responsibility, subcontracting, data protection, anti-bribery, export/import obligations, insurance and any applicable statutory payment regime.

Where a counterparty qualifies under a special statutory framework—such as eligible micro or small enterprises—payment and dispute implications should be checked under the law applicable to the specific transaction rather than assumed from standard commercial terms.

12. Contract-deviation control

A contract audit should examine not only signed terms but how deviations were approved. Define clauses that business teams may accept, clauses requiring legal approval and “red clauses” requiring CFO, CEO or board-level authority.

13. Contract portfolio analytics

Management dashboards can show contracts expiring within 90 days, agreements without liability caps, customers with convenience termination, vendors lacking data clauses, contracts without executed copies, agreements with auto-renewal, foreign dispute forums, high-value contracts without insurance requirements and concentration of non-standard indemnities.

The objective is to make contract risk visible before a dispute occurs.

14. Board-ready deliverables

• material contract inventory;
• contract risk heat map;
• critical deviation schedule;
• expiry and renewal tracker;
• liability and indemnity comparison matrix;
• termination and change-of-control schedule;
• data/IP clause gap report;
• unsigned or incomplete contract list;
• renegotiation priority list;
• contract approval matrix; and
• standard clause playbook.

See the main Corporate Risk Mitigation in India pillar.

15. 30/60/90-day remediation plan

0–30 days: locate missing contracts, flag critical liability/termination exposure, stop uncontrolled deviations and create a central repository.

31–60 days: renegotiate priority agreements, issue approved templates, create clause playbooks, standardise approval workflows and implement renewal alerts.

61–90 days: establish portfolio dashboards, periodic contract sampling, deviation analytics and board reporting for material exceptions.

16. Frequently asked questions

Authoritative references

• Indian Contract Act, 1872 — India Code
• Arbitration and Conciliation Act, 1996 — India Code
• Specific Relief Act, 1963 — India Code

Author: Adv. Govind Bali, Fastrack Legal Solutions LLP.