Every Vendor Is a Co-Defendant in Waiting: A Due Diligence Framework for Outsourced Risk

When a mid-market company hands its payroll to a third-party processor, the executive team typically congratulates itself on a smart operational decision. The vendor is vetted for price, uptime, and customer service. Rarely does anyone ask the more consequential question: what has this contract done to our legal position?

At Brown-Scofield, we have watched this pattern repeat across dozens of engagements. Companies sign software-as-a-service agreements and outsourcing contracts at a steady clip — data analytics platforms, background-check providers, benefits administrators, compliance hotlines — with little appreciation that each relationship is a new channel through which regulators, litigants, and plaintiffs' counsel can reach them.

The Illusion of the Firewall

The most persistent misconception in vendor management is that a well-drafted indemnification clause functions as a wall. It does not. Indemnity is a promise to pay after harm occurs; it does nothing to prevent a plaintiff from naming your company in the first pleading. When a vendor mishandles employee data, botches a wage calculation, or fails to deliver a legally required notice, the injured party does not sue the vendor in a vacuum. They sue everyone plausibly connected to the harm — and the company that hired the vendor is always plausible.

Consider the joint-employment doctrine under the Fair Labor Standards Act and the National Labor Relations Act. A company that outsources HR functions to a provider who then advises on discipline, scheduling, or wage classifications may find itself characterized as a joint employer, absorbing liability for decisions it did not directly make. Similar entanglements arise under the ADA, FMLA, and state privacy statutes, where courts ask who controlled the relevant function, not whose logo appeared on the vendor's website.

Three Questions Before the Signature

We counsel clients to subject every material vendor relationship to three inquiries before counsel is asked to mark up the paper.

First, what does the vendor touch? A vendor that merely supplies tooling — software the company's own employees operate — presents a materially different risk profile than one that exercises discretion over a regulated function. The former is a product purchase. The latter is, in effect, a delegation of a legal duty, and delegations of legal duty are never complete. Map the vendor's role against the underlying obligations: wage-and-hour compliance, records retention, data breach notification, employee leave administration. Where the vendor touches a statutory duty, the company retains exposure for the vendor's failures.

Second, what will this vendor hand over if subpoenaed? Discovery risk is the dimension most leaders never consider. Vendor systems often contain communications, records, and data that are squarely within the company's custody or control for discovery purposes — particularly where the company has contractual rights to access them. A compliance hotline vendor, an internal survey platform, or a document management provider can become the place where an opposing party goes fishing. Contracts should address litigation holds, data retrieval obligations, and the vendor's duty to preserve records upon notice. A vendor that cannot commit to prompt, complete production in a discovery context is a liability magnet regardless of how good its product is.

Third, who else uses this vendor, and how? Regulators increasingly view shared service providers as systemic chokepoints. A data breach at a widely used payroll processor implicates every client simultaneously, and the Department of Justice's expectations around effective compliance programs — including the 2020 evaluation guidance and its successors — direct prosecutors to examine whether companies performed diligence on third parties and managed them on an ongoing basis. A vendor relationship that is never revisited after onboarding signals to a regulator that the company's compliance program exists on paper only.

Diligence as a Standing Discipline

The framework above is not a one-time gate; it is a cadence. We recommend that companies of moderate size maintain a simple vendor register that records, for each material provider: the regulated functions touched, the data categories accessed, the contractual discovery and preservation commitments, the indemnity and insurance posture, and the date of the last review. The register itself is unglamorous. Its absence, however, is expensive — because the first question a regulator, auditor, or opposing counsel asks after an incident is what the company knew about its vendor and when.

Two further practices repay the effort. First, involve counsel before the commercial terms harden, not after. Operations and finance leaders often negotiate SaaS agreements to the point of signature and then circulate them for a legal review that is, functionally, a formality. The highest-value legal input occurs while terms are still negotiable — when data access rights, preservation duties, and audit provisions can still be won. Second, match diligence depth to consequence. A thirty-dollar-per-seat scheduling tool does not warrant the scrutiny applied to an HR outsourcer administering leave for a workforce of thousands. Proportionality keeps the discipline sustainable.

Counsel and Clarity

None of this argues against outsourcing. Delegation of operational functions is often the correct business decision, and the vendors in question are frequently better at their work than any internal department could be. The argument is narrower: that the legal dimensions of a vendor relationship deserve the same rigor as its price and performance, and that rigor is most affordable before the ink dries.

The vendor who knows too much — who touches your payroll data, your employee records, your compliance communications — is not merely a service provider. It is an extension of your legal footprint. Treat the relationship accordingly, and the exposure stays where it belongs: with the people equipped to manage it.