Quick answer
The business records that matter are the ones that test whether the draft describes a deal the parties can actually approve, price, perform and exit. Gather the authority matrix, procurement approvals, demand and volume history, budgets, cost model, capability evidence, dependency register, vendor due diligence, insurance proof, intellectual-property inventory, data map, incident history and service-performance baseline.
How to use this guide
These are not substitutes for the proposed agreement and schedules. They are the operational evidence used to challenge assumptions hidden in the draft. Keep each record's owner, system, period and reliability visible; an attractive dashboard total without its definition or source can be more misleading than no number at all.
Authority and approval records
Start with the internal decision path. Identify the business sponsor, budget owner, procurement approver, security and data reviewers, board or delegated authority, and final signatory. Preserve the approval limits and any condition attached to them. If the contract is with another company, verify its registered identity and claimed signatory details independently.
The Companies Act provides the governance framework for company decision-making, subject to the memorandum of incorporation and delegations. CIPC records can verify registration facts and recorded directors, but they do not conclusively establish transaction-specific authority. Record what was checked, the date and which authority question remains open.
Demand, volume and utilisation history
Pull actual data for the units that drive scope or price: users, transactions, locations, tickets, hours, devices, cases, storage, messages or projects. Show monthly ranges, peaks, seasonality, growth assumptions and data gaps. A service priced for an average load may fail commercially if the contract charges for peaks or imposes a minimum above real use.
Align each metric with the draft's definition. “Active user,” “incident,” “business day” and “transaction” can have different operational meanings. If acceptance or service credits depend on a percentage, retain the denominator, exclusions, measurement tool, time zone and reporting period. Do not sign around a metric the organisation cannot reproduce.
Budget, cost and pricing evidence
Bring the approved budget, business case, quotation comparisons, incumbent spend, implementation cost, tax assumptions, currency exposure and internal cost of customer dependencies. Model the total term, not just the monthly headline. Include annual increases, minimum consumption, transition services, travel, third-party charges, data export, storage after termination and renewal pricing.
Keep the procurement record explaining why the supplier and pricing model were chosen. For public or specially regulated buyers, additional procurement rules may govern; do not treat a commercial checklist as authority to bypass them. Where the service arrangement defers payment and imposes fees, charges or interest, record those mechanics for a proper National Credit Act scope enquiry rather than assuming the label “business invoice” settles the issue.
Capability and performance records
Compare the promised service with the supplier's actual delivery capacity. Relevant material can include staffing plans, qualifications, subcontractor reliance, implementation history, reference checks, uptime or response reports, support coverage, recovery tests and unresolved customer incidents. Use date ranges and distinguish audited, independently verified, self-reported and marketing data.
For the customer's obligations, gather readiness records: available staff, legacy-system quality, decision lead times, access permissions, content, facilities and migration inputs. A provider should not be able to blame an undefined “customer delay,” while a customer should not accept a timeline that ignores its own dependency backlog.
Third-party and supply-chain records
Map critical subcontractors, cloud platforms, carriers, payment services, consultants and component suppliers. Record the service they provide, location, contract term, change rights, access to customer information and replacement plan. Ask whether the service agreement permits subcontracting and whether the primary provider remains responsible.
For regulated insurance evidence, confirm the entity through an official register where appropriate, then examine the actual policy or broker confirmation. An FSCA search may assist with regulated status; it does not establish that a specific indemnity, cyber event or professional error falls within the policy.
Intellectual-property and licence records
Inventory pre-existing code, designs, data, methodologies, templates, brands, documentation, stock assets and open-source components. Link each to its owner, creator, employment or contractor arrangement, licence terms and proposed contract use. Include prior assignments and restrictions on sublicensing, modification or transfer.
The Copyright Act does not make payment a universal ownership rule. Its first-ownership provisions vary, and an assignment must meet a written-signature formality. Operational records should expose any gap between what the draft promises to transfer and what the supplier is entitled to provide.
Personal-information and security records
Build the data map from real systems and processes: data subjects, categories, purpose, source, user roles, subprocessors, storage location, transfer destination, retention, deletion and incident escalation. Add risk assessments, security controls, access reviews, backup tests and relevant breach history. Remove irrelevant personal information from the review pack.
POPIA differentiates roles and imposes safeguards according to actual processing. An operator arrangement should be supported by the real instructions, controls and incident workflow. A vendor questionnaire marked “compliant” is not proof that the proposed service design meets every obligation.
Baseline, acceptance and exit records
Capture the current service level before promising an improvement or accepting a new measurement. Retain raw performance exports and calculation methods. Define which baseline will be used for migration success, acceptance, credits and termination assistance.
For exit, identify the record formats, retention duties, ownership, deletion evidence, licences, staff knowledge and alternative suppliers needed to transition. Estimate the time and cost from actual inventories. A termination clause that promises “reasonable assistance” is difficult to value without these records.
Build a record-to-clause matrix
Make one row per material clause with the supporting record, owner, period, finding and unresolved question. Mark whether the evidence confirms, contradicts or cannot test the draft assumption. Keep working calculations reproducible and preserve native exports separately.
This operational matrix is the distinct value of business records: it tells the negotiators whether the words can be implemented. It should not be repurposed as proof that a future breach or legal remedy is guaranteed.
Important limitation
This is general South African information about operational records for contract review. It does not verify a counterparty, establish authority, certify compliance or predict performance.
FAQs
Which usage records should I compare with a proposed service fee?
Use the actual units that drive price and performance, with monthly ranges, peaks, seasonality and definitions. Preserve the source export so the proposed minimums and overage charges can be recalculated.
Can a vendor questionnaire prove that a supplier is POPIA compliant?
No. It is one due-diligence record. The actual processing roles, instructions, systems, safeguards, subprocessors, transfers, retention and incident process must match the agreement and service design.
What should an intellectual-property inventory show before a services contract is signed?
List customer inputs, provider tools and expected outputs with their creators, owners, licences and restrictions. This exposes whether the party promising an assignment or licence actually controls the necessary rights.
Does an FSCA search confirm that an insurer will cover the contract risk?
No. An official search may help verify regulated status. Coverage depends on the policy wording, insured entity, period, limits, exclusions, deductible, territory and the particular event.
Related Lexuno paths
Related articles
Source notes
Legal note
This article is general legal information for South African readers. It is not legal advice. Speak to a qualified legal professional about your specific facts before taking action.