Contract Risk Scoring and Approval Thresholds: A Worked Example for Indian Mid-Market Teams
A worked example of scoring risk in an Indian vendor MSA, a sample approval-threshold matrix, and the Indian compliance dates every obligation tracker should hold.
"Legal is a bottleneck" usually means one of two things: every contract goes to the same person regardless of risk, or nobody can tell which contracts are risky until something goes wrong. Both are fixed by the same two tools, a risk score and an approval matrix, and neither needs enterprise software to start. This article walks through both with an Indian vendor master services agreement (MSA) as the example, then shows which Indian compliance events belong in the obligation tracker. Position as of October 2026.
Step 1: Decide what "risk" means for your business
A risk score is only useful if it reflects what actually hurts you. For most Indian mid-market companies the list is short:
- Money at stake: contract value, uncapped liabilities, payment terms.
- Legal exposure: indemnities, limitation of liability, IP ownership, data obligations.
- Operational dependence: can you switch vendor, is there an exit plan, does the vendor hold your data.
- Regulatory touchpoints: personal data (DPDP Act), MSE supplier payment timelines (MSMED Act), sector rules (RBI, IRDAI, SEBI) if you are regulated.
Score each on a simple 0-3 scale. Keep it to five or six factors; a 40-factor model will not be used.
Step 2: Worked example — a vendor MSA with two deviations
A SaaS company receives a vendor's MSA for a customer-support outsourcing arrangement. Contract value is Rs 1.8 crore a year. Two clauses deviate from the company's standard position:
Deviation A — Limitation of liability. The vendor's draft caps its total liability at "fees paid in the preceding three months" and excludes all indirect loss. The company's standard is twelve months' fees with carve-outs for breach of confidentiality, data protection obligations and gross negligence.
Deviation B — Indemnity. The vendor indemnifies only for third-party IP claims. The company's standard also requires an indemnity for regulatory penalties caused by the vendor's breach of data obligations.
Why Deviation B matters more than it looks: under section 8(1) of the DPDP Act, 2023, a Data Fiduciary is responsible for compliance "irrespective of any agreement to the contrary", and under section 8(5) it must protect personal data "including in respect of any processing undertaken ... on its behalf by a Data Processor". If the support vendor mishandles customer data after sections 3-17 commence on 13 May 2027, the penalty (up to Rs 250 crore under the Schedule for failing to take reasonable security safeguards) lands on the company, not the vendor. A three-month cap on the vendor's liability with no regulatory-penalty indemnity leaves that exposure almost entirely with the company.
Sample scoring:
| Factor | Score (0-3) | Reason |
|---|---|---|
| Value | 2 | Rs 1.8 crore p.a., multi-year |
| Liability cap | 3 | 3 months' fees, no carve-outs |
| Indemnity | 3 | No cover for data/regulatory loss |
| Data processing | 3 | Vendor handles customer personal data |
| Switching cost | 2 | 90-day transition realistic |
| MSE payment timing | 0 | Vendor is not an MSE |
| Total | 13 / 18 | High |
A 13/18 contract does not go to a sales manager for approval. It goes to legal and the data protection owner, with the two deviations flagged.
Step 3: Build the approval matrix
An approval matrix routes a contract to the right approver by risk band and value, so routine contracts stop queueing behind risky ones.
| Risk band | Value (p.a.) | Approver | Typical examples |
|---|---|---|---|
| Low (0-5) | Up to Rs 25 lakh | Function head | Standard NDAs, pre-approved SaaS subscriptions |
| Medium (6-10) | Rs 25 lakh - 1 crore | Function head + legal review of flagged clauses | Vendor agreements on your template with minor deviations |
| High (11-14) | Above Rs 1 crore, or any personal-data processing | Legal + finance + data owner | Outsourcing with customer data, non-standard liability |
| Critical (15-18) | Any | CFO / CEO sign-off | Exclusive dealing, unlimited liability, regulated activity |
Two rules make it work: deviations from your template always add to the score regardless of value, and the matrix is reviewed every six months against what actually went wrong.
Step 4: Put Indian compliance dates into the obligation tracker
Risk does not end at signature. These are the post-signature events an Indian obligation tracker should hold, with the source:
- MSE supplier payments: due within the agreed period not exceeding 45 days of acceptance, or 15 days with no written agreement (MSMED Act s. 15). Missing it defers your tax deduction to the year of payment (Income-tax Act s. 43B(h)).
- Personal data breach: notify affected individuals and the Data Protection Board "without delay", detailed report to the Board within 72 hours (DPDP Rules r. 7; commences 13 May 2027). The vendor contract must require the vendor to tell you in time to meet this.
- Data erasure: when consent is withdrawn or the purpose ends, erase and cause the processor to erase (DPDP Act s. 8(7)).
- Renewal and auto-renewal notice windows: typically 30-90 days before expiry; the contract states the window, the tracker enforces it.
- GST input tax credit: under the second proviso to section 16(2) of the CGST Act, 2017, if the supplier is not paid within 180 days of the invoice, the credit claimed must be reversed with interest. Long payment terms have a GST cost.
- Regulated entities: RBI's 2025 outsourcing Directions require exit plans, audit rights and incident reporting from vendors; track the vendor's reporting obligations as dated events.
What efficiency actually looks like
With a score and a matrix in place, three things change. Low-risk contracts are approved by the business within a day. Legal reviews only flagged clauses, not whole documents. And the obligation tracker fires on dates that carry real money, rather than on everything. None of this requires a large legal team; it requires consistent intake data and a place to store it.
Where Legatio fits. A CLM platform like Legatio captures the intake data the score depends on, routes contracts by band, records approvals, and tracks post-signature dates with reminders to the right owner. The scoring and matrix are yours to define.
Position stated as of October 2026. The worked example is illustrative; the scoring weights and approval thresholds are suggestions to adapt, not legal or regulatory requirements.