audit-a-vendor-exit-plan

# audit-a-vendor-exit-plan ## When to use - Use before contract renewal, termination, insolvency risk, internalization, replacement, or acquisition integration. - Do not trigger production termination while untested dependencies or unrecoverable data remain. ## Procedure 1. Define services, entities, jurisdictions, contracts, exit triggers, dates, owners, materiality, and acceptance criteria. 2. Inventory data, content, credentials, domains, code, configuration, devices, licenses, subprocessors, records, and knowledge. 3. Map business processes, integrations, people, regulatory duties, customer commitments, and hidden concentration risks. 4. Test export format, completeness, provenance, portability, restore, access transfer, documentation, and replacement capacity. 5. Review notice, assistance, pricing, IP, escrow, audit, retention, deletion, transition staff, disputes, and insolvency rights. 6. Stage continuity, communications, freeze, cutover, rollback, revocation, evidence return, deletion, and residual monitoring. 7. Record gaps, mitigations, owners, deadlines, cost, decision authority, and signed exit acceptance. ## Failure plan - Delay irreversible termination or invoke continuity rights when critical data, service, authority, or legal evidence cannot transfer safely. ## Worked example A retailer discovers its marketing vendor also controls a domain, consent history, and a unique audience model not covered by the export clause. ## Done - A vendor exit audit records assets, data, access, dependencies, rights, transition, continuity, deletion, cost, gaps, and owners - Export, restore, access, cutover, rollback, revocation, deletion, and business-acceptance evidence verifies readiness