Contract Review Checklist for Small and Mid-Size Businesses (MSAs)
Updated: 4 hours ago
By Trenton Roberts and Rachel Jones
Circular 230 / general information notice. This article is general information only. It is not tax, legal, or accounting advice. Reading it does not create an attorney-client relationship. Tax results depend on your facts and on law that can change. Consult your own attorney and CPA before taking any action. This article was not written to be used, and cannot be used, to avoid tax penalties.
A master services agreement and the statements of work under it allocate scope, payment, intellectual property, risk, and exit rights. A contract review checklist helps us review an MSA for a growing company in a consistent order. When we review an MSA, we are not hunting for theoretical issues. We are checking whether the paper matches how the company actually delivers work, gets paid, and walks away if the relationship fails. That focus on operations makes us less patient with clauses that look fine in a redline and fail in practice.
Contract review checklist: scope, change orders, and deliverables
Vague scope is still the most common source of disputes we see. The MSA should say what services are included, what is out of scope, how deliverables are accepted, and how change orders are priced and approved. If the MSA relies on SOWs, the SOW process has to be usable in real life: who can sign, what happens if work starts before an SOW is signed, and whether email can create a change order.
Red flag: "services as reasonably requested" with no rate card and no change-order mechanic. That language invites unpaid scope creep.
Sample approach we often push for on the provider side: SOW controls for scope and fees; MSA controls for legal terms; work outside an executed SOW requires written approval (email acceptable if named) at stated rates.
Payment, expenses, setoff, and tax on the invoice
Read payment timing, late fees, expense reimbursement, and audit rights against cash-flow reality. Customer forms sometimes shift Net-60 or Net-90, add broad audit rights, and bury setoff language that lets the customer withhold for unrelated disputes.
A worked example: the provider invoices $50,000 under a Net-30 MSA. The customer has an unrelated $8,000 dispute on a prior SOW and, if the setoff clause is unlimited, withholds that amount from the new invoice, or in a worse draft withholds the entire $50,000 until the $8,000 is resolved. Limit setoff to undisputed amounts on the same SOW, or at least require written notice and a cap on what can be held back. Also watch "deemed accepted if not disputed within a stated number of days," late-fee language that needs to be clear under the chosen law, audit rights limited in frequency, notice, and cost-shifting, and whether "fees" include pass-through expenses without a markup rule.
Two tax points belong in the same payment section, and both should be run past the CPA. First, say who is responsible for collecting and remitting sales or use tax on the fees, in which jurisdictions, and what happens if a later audit assesses tax that the invoice did not collect. Many professional services are not subject to Texas sales tax, but that is not a universal rule across service types or across states, and a silent MSA leaves the parties arguing after an assessment. Second, if the provider is an individual or a single-member entity, confirm whether the relationship is employment or an independent-contractor engagement, and whether a Form 1099-NEC or payroll reporting is required. We cover the IRS classification test in what a fractional general counsel does. An MSA does not, by itself, make a misclassified worker an independent contractor.
Intellectual property and confidentiality
Who owns work product? Who owns pre-existing materials and tools? What license does each side receive? Confidentiality terms should match how information is actually shared with contractors and subcontractors.
On the provider side, we usually want: company retains pre-existing IP and tools; customer owns custom deliverables upon payment; provider keeps a residual license to use general skills and non-confidential know-how. On the customer side, we usually want: assignment of work product created specifically for the customer; limits on provider reuse of customer confidential information; flow-down to subcontractors.
Brand and content issues may also connect to trademark and copyright planning.
Indemnification and limitation of liability
Indemnification and limitation-of-liability clauses allocate risk for third-party claims and direct damages. Mutuality, carve-outs (confidentiality, IP infringement, willful misconduct, data breach in some deals), and cap amounts deserve careful reading. There is no single market standard that fits every deal.
A cap stated as "fees paid in the prior twelve months" is not a fixed number. Suppose the MSA is $15,000 a month. At the end of month three, the cap is $45,000. At the end of month twelve, it is $180,000. A customer with a $200,000 claim in month four is looking at a $45,000 cap unless a carve-out applies. Providers should understand that the cap is small early in the term. Customers should understand that the cap grows with spend and should not assume it equals a year of fees from day one. If the parties want a floor, say so: a cap equal to the greater of a stated dollar amount and trailing twelve-month fees.
Practical positions we see often in middle-market commercial paper:
Cap at fees paid in the prior 12 months (or fees under the applicable SOW), sometimes with a floor, and with carve-outs for confidentiality breach, IP infringement indemnity, and willful misconduct
Exclude consequential damages, with negotiation over whether confidentiality and data breach sit inside or outside that exclusion
IP indemnity tied to the indemnifying party's materials, not to the other party's modifications or combinations
Red flag: unlimited liability on one side with a low cap and broad consequential damages waiver on the other, plus an indemnity that covers the counterparty's own negligence without limit.
Term, termination, auto-renewal, and transition
Understand auto-renewal, termination for convenience, termination for cause, cure periods, and what happens to data and transition assistance on exit. Vendors and customers often care about different ends of the same clause. We look for notice periods that match operational reality; survival of confidentiality, IP, and payment terms; transition assistance priced or capped; and return or deletion of data with a workable timeline.
Auto-renewal clauses are easy to miss and expensive to unwind. We look for renewal term length, notice windows (60 or 90 days is common), and whether notice must be in a specific form. Calendar the notice date the day you sign. Waiting until the last week of a term is how companies get stuck for another year on paper they already outgrew. Termination for convenience should say whether the customer pays for work in process, unused prepaid fees, or a wind-down fee, and whether the provider must keep staffing the account through the notice period.
Insurance, security addenda, and subcontractors
Customer paper increasingly includes insurance requirements, data-security addenda, and audit rights. Confirm required insurance is available and affordable before signing. Security obligations should match what the company actually does, not aspirational language copied from a larger vendor's form.
If your company uses subcontractors, check whether the MSA requires flow-down of confidentiality, data protection, or IP terms. Gaps between prime contracts and subcontracts create avoidable exposure. We also check whether subcontracting needs prior consent and whether the company remains fully responsible for subcontractor performance.
Dispute resolution, venue, and non-solicit of personnel
MSAs often set governing law, venue, and sometimes arbitration. Growing companies should confirm those clauses match where they are prepared to litigate or arbitrate. Defaulting to a counterparty's distant venue may be acceptable commercially, but it should be a conscious choice.
Many service MSAs also include a non-solicitation of employees or contractors. Read the definition of "solicit," the duration, and whether a general job posting is carved out. A clause that treats any hiring of the other party's people, even after an unsolicited application, as a breach is a different deal than a true non-solicit. If the clause is mutual and short, it is often workable. If it is one-sided and long, it deserves a mark-up.
How outside counsel helps
A fractional general counsel relationship can keep contract review consistent across the company's forms. We also advise on complex commercial contracts as part of services, including MSAs and related agreements.
Practical checklist before signature
Match scope language to how delivery actually happens.
Confirm payment timing, setoff limits, and who handles sales or use tax, against cash flow and the CPA's advice.
Decide IP ownership and licenses in writing, including pre-existing tools.
Read the liability cap and carve-outs as a package, and model the cap in month three as well as month twelve.
Price termination, auto-renewal notice, and transition before you need them.
Verify insurance can meet the certificate requirements.
Flow down obligations to subcontractors.
Confirm venue, governing law, and any personnel non-solicit consciously.
Save the signed MSA and every SOW in one place.
Update playbook fallback positions after hard negotiations.
How we can help
We review and negotiate MSAs and related commercial contracts for growing businesses, and we build playbooks so internal teams can move faster on repeat paper. Office: 1921 Greenville Avenue, Suite 200, Dallas, TX 75206.
For ongoing contract coverage after the MSA is signed, see our business law services.
FAQ
Should every vendor sign our paper?
Using your paper improves consistency, but customers with leverage may require their forms. A written playbook of fallback positions helps either way. We would rather see a short list of must-haves than a blank insistence on "our form only."
Is an MSA the same as an NDA?
No. An NDA focuses on confidential information. An MSA governs ongoing services and commercial terms, though confidentiality often appears inside the MSA as well.
Our customer sent a data security addendum we cannot meet. What now?
Do not sign aspirational security language. Either negotiate to what you actually do, price the uplift to meet the standard, or walk. A signed addendum you cannot perform is worse than a lost deal.
Next step
If this is on your desk right now, you can reach us at info@robertsandwillie.com or (469) 910-4017. Sending a message does not create an attorney-client relationship.
Disclaimer. This article is for general information only and is not tax, legal, or accounting advice. It does not create an attorney-client relationship. Tax law changes and depends on your specific facts. Do not act on this article without consulting your own attorney and CPA. This article is not intended or written to be used, and cannot be used, by any taxpayer for the purpose of avoiding penalties that may be imposed under the Internal Revenue Code or other applicable law. Attorney Advertising. Roberts & Willie, PLLC, Dallas, Texas; Trenton Roberts, responsible attorney.
Comments