How to Prepare for a Contract Audit (Checklist)

What is a contract audit? A contract audit is a structured review of your organisation's contracts to confirm they exist, are valid, are being followed, and carry acceptable risk. It can be internal (your own legal, finance or compliance team checking the portfolio) or external (an auditor, acquirer or regulator reviewing it for a transaction, a financial audit or due diligence). Either way the goal is the same: to show that the company knows what it has agreed to, is meeting its obligations, and can find and prove every commitment. A contract audit answers questions like: Do we have a signed copy of every active contract? Are we meeting the obligations and deadlines in them? Are any auto-renewing or expiring without anyone noticing? Are the commercial and risk terms within policy? Who signed them, and did they have authority? This article is general guidance, not legal advice. ## The contract audit checklist Work through these in order. Tick each contract, or each sample, against the list. Existence and completeness

• A signed, final copy exists for every active contract.
• All schedules, annexures, amendments and side letters are attached.
• The signatory had authority to sign (matches the delegation of authority matrix).
• The counterparty details and legal entity names are correct. Key terms captured
• Start date, term length and end date recorded.
• Renewal type (auto-renew, renew on notice, or fixed) and notice period recorded.
• Value, payment terms and any price-escalation recorded.
• Governing law and dispute resolution recorded. Obligations and performance
• Each party's key obligations listed.
• Deliverables, service levels or milestones and their deadlines tracked.
• Evidence that obligations are actually being met.
• Any breaches, waivers or disputes noted. Risk terms
• Liability caps and exclusions reviewed.
• Indemnity obligations reviewed.
• Confidentiality and data-protection terms reviewed.
• Termination rights and exit terms reviewed.
• Insurance, warranty and compliance obligations reviewed. Compliance and storage
• Contract follows internal policy and approval rules.
• Regulatory or statutory requirements met (for example stamping where required).
• Stored in the single approved repository, correctly named and searchable.
• Access restricted to the right people. ## Step by step: how to prepare 1. Build the inventory first. You cannot audit what you cannot find. Pull every active contract into one list with counterparty, type, value, dates and owner. Gaps in the inventory are themselves a finding.

2. Define the scope. Decide whether you are auditing everything, a risk-weighted sample, or one category such as supplier or customer contracts.
3. Gather the documents. Collect signed copies, all amendments, and the supporting approval records.
4. Check existence and authority. Confirm each contract is signed by someone with authority and that nothing is missing.
5. Extract and verify key terms. Capture dates, value, renewal and risk terms, and check them against what your systems say.
6. Test performance. Pick obligations and confirm they are being met, with evidence.
7. Flag the risks. Record missing documents, unfavourable terms, lapsed or auto-renewed contracts and policy breaches.
8. Report and fix. Summarise findings, rank by risk, assign owners and deadlines, and track the fixes to closure. ## What auditors look for (the red flags) - Missing or unsigned contracts. An agreement being performed with no signed copy is a classic finding.

• Missing amendments. The signed original says one thing, but a later side letter changed it and nobody filed it.
• Signed without authority. The signatory was not authorised under the delegation of authority matrix.
• Silent auto-renewals. Contracts that renewed automatically because no one tracked the notice date.
• Expired but still used. Services continuing on a contract that lapsed, leaving the relationship ungoverned.
• Uncapped liability or broad indemnity. Risk terms that sit outside policy.
• No stamping or registration where required. A document that may be inadmissible or attract penalty because a formality was missed.
• Obligations not met. Service levels, reporting or compliance duties being missed.
• No single source of truth. Copies scattered across inboxes and drives, so the portfolio cannot be relied on. ## Common mistakes to avoid - Starting without a complete inventory. Every later step depends on knowing the full population.
• Auditing only the paper, not the performance. A perfect contract that nobody follows is still a risk.
• Ignoring amendments and schedules. The current deal is the original plus every change, not just the signed PDF.
• Treating it as a one-off. Risk builds continuously, so a single annual scramble misses most of it.
• No follow-through. Findings with no owner and no deadline do not reduce risk. ## A note on jurisdiction What a contract audit must check depends on where you operate. In India this can include stamp duty under the relevant state Stamp Act, registration where the law requires it, and company-law formalities under the Companies Act, 2013. Validity sits under the Indian Contract Act, 1872, and electronic signatures under the Information Technology Act, 2000. Requirements such as stamping, registration and retention periods vary by jurisdiction, so a company operating across markets should check local rules rather than assume one standard. Last verified October 2026. ## Where a workspace helps Most of the pain in a contract audit is finding things: the signed copy, the latest amendment, the renewal date, the proof an obligation was met. When contracts live in email and shared drives, the audit becomes an archaeology project every time. A single AI contract workspace keeps signed contracts, versions and amendments in one place, extracts key dates and obligations, shows per-clause risk, and records every action on a live timeline that doubles as an audit trail. Tools such as Adira are built around that idea of drafting, review, tracking and compliance in one tuned workspace, while contract platforms like Ironclad, LinkSquares, Evisort and Icertis also offer repository and obligation-tracking features. The checklist is still the standard; a workspace is what makes meeting it routine instead of a fire drill.