Review Master Services Agreement For Contract Risk Issues

---
name: review-msa-contract-risk-issues
task_id: intellectual-property/review-master-services-agreement-for-contract-risk-issues
description: Reviewing a vendor-form master services agreement and related exhibits from the customer's perspective to produce a risk-categorized issue memorandum using a document-hierarchy, cross-exhibit, and issue-spotting workflow.
activates_for: [planner, solver, checker]
---

# Skill: Review Master Services Agreement for Contract Risk Issues

## 1. Subject-matter triage

When source materials include a master services agreement body plus separate exhibits, schedules, statements of work, order forms, or policy attachments, review the full document set as one contract package. Treat the main agreement as the baseline allocation of commercial and legal risk, and treat each exhibit as potentially modifying or superseding baseline terms.

First identify the document hierarchy and any order-of-precedence clause. Then map which terms are general and which are service-specific, operational, or data-specific. If the materials include multiple counterparties, service lines, product modules, or effective dates, enumerate them before analysis so each can be tested against the same framework.

## 2. Failure modes the skill is correcting

- Reviewing the main agreement in isolation and missing exhibit-level terms that shift pricing, service levels, security duties, IP ownership, or transition obligations
- Missing internal conflicts between the agreement and attached schedules because the hierarchy clause was not applied
- Treating operational terms as boilerplate even though they materially change risk allocation
- Analyzing provisions in the abstract without tying them to the transaction’s scope, criticality, or data sensitivity
- Stopping at issue identification without stating severity, interplay with other clauses, and concrete client impact
- Omitting a clear next-step recommendation tied to who must act and when

## 3. Legal frameworks / domain conventions that apply

- Limitation of liability: identify the cap structure, excluded damages, carve-outs, and any asymmetry; assess whether the allocation fits the service’s operational importance and downstream exposure under common contract-risk principles
- Indemnification: test whether coverage is limited to third-party IP claims or extends to data incidents, security failures, bodily injury, confidentiality breaches, regulatory claims, or third-party misuse as the deal context requires; read in conjunction with liability caps and exclusions
- Service levels and remedies: determine whether service credits are exclusive, whether repeated failure triggers escalation or termination, and whether cure rights are realistic in light of the stated metrics
- Force majeure: assess whether the excusing event definition is overbroad, whether ordinary labor, supply, technology, cyber, or vendor-subcontractor risks are improperly swept in, and whether performance and payment obligations are treated consistently
- Data handling and privacy: if sensitive, regulated, or personal data is in scope, check that the privacy or security terms operationalize required confidentiality, access control, incident notice, retention, deletion, subcontractor flow-down, and audit rights, and that they do not conflict with the main agreement
- Intellectual property: review ownership of pre-existing materials, custom deliverables, configurations, modifications, derivative works, and reuse rights; identify any license-back or vendor residual rights that need separate tracking
- Termination and transition: confirm convenience termination rights, notice periods, wind-down assistance, data return/deletion, and continuity obligations; test whether the customer can exit without operational lock-in
- Pricing and payment: review fee mechanics, minimum commitments, escalators, pass-through charges, overages, true-ups, credits, and invoice dispute windows; assess whether charges are sufficiently defined and capped
- Dispute and compliance terms: check governing law, venue, injunctive relief, audit, sanctions, export, anti-corruption, insurance, and subcontracting provisions for consistency with the service and risk profile
- Controlling authority: where the issue depends on a legal rule rather than a contract term, cite the governing statute, regulation, rule, or common-law doctrine that supports the proposition

## 4. Analytical scaffolds

1. Start with the document hierarchy: identify the main agreement, all attachments, and any precedence language.
2. Review the agreement for standard risk buckets: liability, indemnity, confidentiality, data security, IP, term/termination, dispute resolution, insurance, subcontracting, and compliance.
3. Review each exhibit or schedule for operational changes: pricing, service levels, implementation scope, support commitments, security controls, data processing, acceptance, and transition.
4. Compare each exhibit against the main agreement and mark inconsistencies, overrides, and missing cross-references.
5. For each issue, state: the relevant provision, the risk problem, the controlling rule or convention if one is needed, the client consequence, and the preferred contract position.
6. Assign an ordinal severity level uniformly across issues and use the same scale throughout.
7. Where the source set contains multiple counterparties, services, sites, data sets, or time periods, analyze each separately before synthesizing the issue set.
8. Tie each issue to the transaction’s actual scope or exposure using figures, thresholds, terms, or operational commitments found in the source set; do not invent new economics.
9. End each issue with a concrete recommendation that names the action, the responsible role, and the timing anchor.

## 5. Vertical / structural / temporal relationships

Use the contract’s internal structure to determine what controls what. The main agreement may supply baseline legal terms while exhibits may control pricing, service descriptions, security appendices, or special business terms. Treat later-in-time documents, amendment language, and precedence clauses as potentially superseding earlier boilerplate.

Also test temporal sequencing. Implementation duties, go-live dates, measurement periods, cure windows, audit rights, renewal mechanics, notice deadlines, and transition assistance often operate on different clocks. If the deal includes phased rollout or multiple service periods, separate the analysis by phase.

Where a clause only makes sense when read with another clause, analyze the pair together rather than in isolation. In particular, connect liability with indemnity, service levels with termination, force majeure with payment and performance, and privacy obligations with security and audit rights.

## 6. Output structure conventions

- Produce an issue memorandum organized by risk category using conventional headings rather than the rubric’s internal checklist
- Define a uniform severity scale at the outset and apply it to every issue entry
- For each issue, include:
  - the implicated section, exhibit, or schedule
  - a short issue statement
  - the severity level
  - the contract language or source term driving the issue
  - the related provision, exhibit, or hierarchy term that interacts with it
  - the legal or commercial consequence for the client
  - the preferred analytical position or fallback ask
  - a concise recommendation with an imperative action, responsible role, and timing anchor
- Where a legal proposition is relied on, identify the controlling authority or recognized contract principle supporting it
- Include a separate section for cross-document conflicts and precedence problems
- Keep the writing issue-focused and operational; avoid mere restatement of the agreement