Tools and providers
Part of Franchise opportunities tools and providers: due diligence
Franchise vendor due diligence: service loss, continuity and exit terms
Vendor due diligence for franchise systems, focused on what happens when a supplier fails or leaves: service-loss tiers, continuity questions and exit terms.
A supplier is hardest to assess when it fails, changes hands or leaves, yet that is when a franchise network feels it on every site at once. A payroll processor, point-of-sale platform and public design tool should not face identical assurance demands. The questions below cover the exit case and what stops, what must come back and who owes you help.
What to take away
- Classify what a four-hour, two-day and permanent loss would stop before asking supplier questions.
- The contracting entity, not the sales brand, carries the exit and data obligations.
- Ask about notice, data access and transition support rather than predicting corporate events.
- Price exit assistance and data export as their own lines, with a sample export in hand.
- Finish with an evidence register so gaps become contract conditions, mitigations or reasons to reject.
Classify what a loss would stop
Classify the effect of a four-hour, two-day and permanent loss of each service, and scale your questions to the consequence. A booking engine or loyalty app outage stops bookings and repeat visits across every site. A public design tool does not carry that weight.
List the business processes, locations, users and data the supplier handles. Identify integrations, privileged access and downstream suppliers. Ask what continues offline and how accumulated transactions reconcile after recovery.
The NCSC's supply-chain cyber guidance describes typical supplier relationships and the ways organisations are exposed to vulnerabilities and cyber attacks through the supply chain. Scale the questions to the consequence, but do not leave a critical dependency undocumented.
Confirm who owes you the exit
Exit duties bind the contracting entity, not the sales brand. Match the contracting name, company number, registered address and bank details. Identify parent companies, resellers and sub-contractors involved in delivery, and obtain the actual terms, service description and order form for the quoted edition.
If the sales brand and contracting entity differ, record the relationship and which body carries support, data and refund obligations.
Confirm who is selling
- Match contracting name and company number
- Match registered address and bank details
- Identify parent companies and resellers
- Identify sub-contractors in delivery
- Obtain actual terms and order form
- Record which body carries support obligations
Use Companies House guidance to review free company information, filings, officers, charges and insolvency records. Note the register's limitations rather than treating a filing as validation of performance.
Continuity questions for a supplier that changes
For a financially important vendor, consider what happens if the supplier is acquired, stops a product or loses a critical sub-contractor. Ask about notice, data access and transition support rather than trying to predict corporate events. The response should connect to enforceable terms or a workable contingency.
| Event | Question to put | Evidence to file |
|---|---|---|
| Supplier is acquired | What notice and approval follow assignment or change of control? | The clause reference |
| Product is stopped | What notice, data access and transition support are offered? | A written answer |
| Sub-contractor is lost | Which sub-processor approval and security duties apply? | The sub-processor list |
| Service goes down | What continues offline, and what do service credits cover? | The service description |
Ask two operational references to discuss the same service, module and scale where possible. Prepare questions about implementation effort, outages, unresolved tickets and changes after renewal. References chosen by a supplier are not independent market evidence, but specific answers can identify contract clauses or demonstration tests that deserve attention.
Personal data on the way out
Decide whether the supplier acts as processor, controller or another role for each activity, because the role decides who must delete or return what at the end. Describe permitted purposes and documented instructions.
Review sub-processor approval, rights assistance, deletion, return and audit provisions. Ask for the supplier's security, privacy and records-management documents, and check what the contract says about data held in the supplier's own sub-service chain.
The ICO says that under Article 28(3)(g) the contract must require the processor, at the end of the contract and at the controller's choice, to delete or return all the personal data it has been processing, and to delete existing copies unless UK law requires storage.
Certificates and their limits
Request the scope, issuer and expiry of ISO 27001, SOC 2 or Cyber Essentials certificates, and the coverage of any independent report.
Name the scheme and the report: a Cyber Essentials certificate covers a baseline set of controls, a SOC 2 report covers a stated period, and an ISO 27001 certificate covers a defined scope. A certificate may support one answer, but it should not be stretched beyond the systems, period or controls it covers. Also ask which controls the customer must configure and monitor, and where the provider stores the data.
Price the exit line by line
Price the exit separately from the subscription. Obtain a sample export, the deletion process and costed exit assistance, and ask for exit assistance as a fixed one-off fee. The quote will depend on data volume, the number of sites and the export format.
| Exit line | Ask for | Check that |
|---|---|---|
| Sample export | A file made from your own data in the format you need | It opens and reconciles to your records |
| Deletion process | Written steps and a confirmation | It matches the data-return clause |
| Exit assistance | A fixed one-off fee | It states the volume, sites and format assumed |
| Renewal mechanics | Notice period and any right to change fees or functionality | The dates are in your calendar |
Name the clauses you are pricing: assignment and change of control, sub-processor approval, audit rights, service credits, price variation, renewal and notice, data return and deletion, and exit assistance. A set of connected contracts may place each one in a different document.
Mark VAT, one-off and recurring costs separately in the budget, and record implementation, migration, training, support, integrations, storage and usage charges next to the exit line so the whole term can be compared.
Finish with an evidence register
Keep a register with the question, response, supporting file, reviewer, date, gap and decision. Material gaps should become contract conditions, mitigations or reasons to reject the supplier. A polished demonstration should never be the only durable record of due diligence.
Give each open gap a named owner, as in a selection checklist. How to choose the tool in the first place, with requirements and acceptance tests, sits in franchise tools and providers.
Before you act
- Classify the effect of four-hour, two-day and permanent service loss.
- Match contracting name, company number, address and bank details.
- Ask what notice, data access and transition support follow a change of owner.
- Decide whether the supplier acts as processor or controller.
- Obtain a sample export, deletion process and costed exit assistance.
- Record every gap in an evidence register with a decision.
Common questions
Why does the contracting entity matter for exit?
Because exit, support, data and refund obligations bind the entity that signs, not the sales brand. Record the relationship between the two when they differ.
What should I ask about a supplier that is acquired or stops a product?
Ask about notice, data access and transition support, and tie the answer to an enforceable term or a workable contingency.
How do I price the exit?
Treat the sample export, deletion process and exit assistance as their own lines, and ask for exit assistance as a fixed one-off fee stated against data volume, sites and export format.
