The contract audit: a method for taking stock of your contracts

A contract audit is an organized review of a set of contracts. It answers three questions: which contracts do we have, what do they provide, and are they being applied?

It is not the same as reviewing a single contract. Its subject is the portfolio, or part of it. Several situations can justify one:

• a sale, a financing or a reorganization that requires the right contracts to be gathered quickly;
• a new head of legal who is discovering the portfolio;
• a regulatory change that may affect a category of contracts;
• an incident, such as an unwanted renewal or a dispute, that reveals a lack of visibility;
• the choice of a tool, which requires knowing what already exists.

An audit without limits never ends. Scoping comes down to five decisions, written on one page:

• The question. What do you want to know? For example: which supplier commitments expire within the next twelve months?
• The scope. Which companies, which types of contracts, which amounts, which period?
• The depth. All contracts, or a sample for routine contracts?
• The owners. Who leads, who reviews, who settles legal points, who decides on actions?
• The expected output. A register, a ranked list of findings and a dated action plan.

Also set confidentiality rules from the start. An audit circulates sensitive contracts, and the findings themselves often are sensitive too. Limit distribution to the people who need it.

Start from known storage locations: shared folders, e-signature tools, email inboxes, paper archives. Then ask the teams that sign or use contracts: procurement, sales, human resources, IT, finance.

A cross-check helps spot what is missing. Compare the list of contracts with the list of suppliers paid and customers invoiced over the period. A regular payment with no contract found deserves a question. An active contract with no flows at all deserves another.

Record each gap rather than working around it. A contract that cannot be found, an unsigned copy or a missing annex are already audit findings.

The register is the foundation of the audit. It must be short enough for everyone to fill it in the same way. Here is a base to adapt to your question:

• the type of contract, the parties and the internal owner;
• the signed version, and any amendments and annexes found;
• the effective date, the end date and the notice deadline;
• the renewal mechanism and the applicable notice period;
• the amount or the pricing method, and its revision;
• the points specific to the chosen scope, recorded with a reference to the relevant passage.

Record the text as written, with its reference. Interpretation comes later. Separating recording from analysis lets you assign the first to a wider team, and keep the second for lawyers.

Pay attention to duration concepts. The French Civil Code distinguishes in particular the open-ended contract, which either party may terminate with the agreed notice or, failing that, reasonable notice (Article 1211 of the French Civil Code), the fixed-term contract (Article 1212), its renewal, which gives rise to a new open-ended contract (Article 1214), and tacit renewal (tacite reconduction), which has the same effects (Article 1215). The wording of the contract or a specific statute may change the analysis: it is up to the lawyer to classify each situation.

The grid depends on the starting question. It can be organized around six checks, which record facts and do not validate any drafting:

• Completeness. Is the contract signed, complete and up to date with its amendments?
• Duration and exit. Which deadlines are approaching, and has a decision been made for each one?
• Financial commitments. Do the price applied and the revisions match what is provided?
• Specific events. Are an assignment, a change of control or subcontracting addressed in the contracts concerned?
• Compliance. Do contracts that entrust personal data to a service provider include the framework required by Article 28 of the GDPR?
• Performance. Does what happens on the ground match the contract: deliverables, service levels, reports, penalties?

The last check is often the most revealing, and the hardest. It requires talking to the teams that live with the contract, because the document alone does not say how it is applied.

A long list of findings does not lead to action. Ranking makes priorities visible. Two criteria are usually enough:

• Severity: what would the consequences be if the issue materialized, financially, legally or operationally?
• Urgency: by when must a decision be made, given the contract dates?

Define three levels, with written criteria set before you start. A close notice deadline on a major contract comes, for example, before a vague provision in a low-value contract. These levels are yours: they reflect your business and your risk tolerance.

Have the ranking validated by a lawyer. A tool, an AI or a less experienced reviewer can flag an issue. Legal classification and the final call remain a team decision.

Each finding that is kept receives an action, an owner and a date. Actions fall into three families:

• Fix. Find a copy, get a document signed, send a decision ahead of an upcoming deadline.
• Renegotiate. Prepare the topics to raise at the next deadline, with the business teams.
• Prevent. Review a template, an approval workflow or a filing rule.

Present a short summary to management: what was reviewed, what was not, the main findings, the decisions required. Stating the limits of the audit matters as much as its results.

Finally, keep the register. Without updates, it goes out of date with the next contract signed. Appoint an owner, plan a periodic review, and define how new contracts are added. This is what saves you from starting over in two years.

Docform can serve as the home for this register. Contracts are bulk-imported into the contract repository, including scanned PDFs, and AI suggests the parties, dates, duration and notice period, which your team validates. You then filter by counterparty, status, date or attribute, and export the list to Excel or CSV.

Your analysis playbook sets the rules, their severity and your positions. The assistant flags deviations, citing the relevant passage, and the lawyer checks and decides. Reminders on end dates and notice dates then take over, and the audit log records the actions taken.