For multinational companies, buy-side contracts are one of the most consequential — and least systematically reviewed — sources of compliance risk. Vendor, supplier, manufacturing, and logistics agreements often determine who controls data, who bears regulatory risk, who makes representations to government authorities, and who is responsible when something goes wrong. Yet in many organizations, these contracts are negotiated primarily for price, delivery, and commercial flexibility, with compliance considerations addressed late in the process or inconsistently across regions.

Regulators increasingly assess not only whether companies have compliance programs, but whether those programs are embedded in contractual relationships that shape real-world behavior. Buy-side contracts are a key mechanism for operationalizing compliance expectations, allocating risk, and enforcing standards across complex global supply chains. Weak or inconsistent contracting practices can undermine even well-designed compliance programs — particularly where third parties control manufacturing, sourcing, logistics, data processing, or regulatory interactions.

This self-check is designed to help companies assess whether they have a structured, risk-based approach to managing buy-side contracts, rather than a fragmented or purely commercial one. It focuses on governance, risk assessment, contracting processes, oversight, and remediation — not on specific regulatory clauses or legal doctrines. A “no” answer does not automatically indicate a contractual failure or compliance breach, but it may signal a systemic gap that warrants attention, particularly where suppliers operate in higher-risk jurisdictions or perform compliance-critical functions.

I. Governance & Ownership

• Is there clear ownership for buy-side contracting standards across legal, compliance, procurement, and business teams?
• Are roles and responsibilities defined for: (1) contract drafting and negotiation; (2) compliance review and approval; and (3) ongoing contract oversight?
• Are escalation paths clearly defined when a supplier resists compliance-related terms?

II. Risk Assessment & Contract Scoping

• Does the company apply a risk-based approach to determining which buy-side contracts require enhanced compliance review?
• Does the risk assessment consider: (1) supplier location and jurisdictional risk; (2) nature of goods or services provided; (3) access to data, systems, or regulated activities; (4) use of sub-suppliers or subcontractors.
• Are contract requirements scaled to risk, rather than applied uniformly or inconsistently?

III. Contract Standards & Consistency

• Does the company maintain baseline contracting standards or templates for buy-side agreements?
• Are compliance-related provisions: (1) clearly drafted and commercially workable; (2) consistent across regions and business units; (3) updated periodically to reflect evolving risks?
• Is there a defined process for approving deviations from standard compliance terms?

IV. Integration with Compliance Programs

• Do buy-side contracts reinforce the company’s broader compliance framework, including: (1) codes of conduct or supplier standards; (2) audit and access rights; (3) information-sharing and cooperation obligations.
• Are suppliers contractually required to flow down relevant obligations to sub-suppliers where appropriate?
• Are compliance expectations clearly communicated to suppliers, not just embedded in legal text?

V. Contract Lifecycle Management

• Is there a process to ensure contracts are reviewed, updated, or renegotiated when risk profiles change?
• Are contracts revisited following: (1) regulatory changes; (2) changes in supplier operations; (3) Incidents, regulator audits, or enforcement actions?
• Are any ongoing obligations from expired or legacy contracts identified and addressed?

VI. Tariff & Trade Cost Risk Allocation

• Do buy-side contracts clearly allocate responsibility for tariffs and import-related charges, including how such costs are calculated and invoiced?
• Are Incoterms® expressly specified, current, and used consistently with the parties’ actual logistics and commercial practices?
• Do contracting teams understand how selected Incoterms affect: (1) importer of record designation; (2) responsibility for customs clearance; and (3) exposure to duties, tariffs, and taxes?
• Do contracts address unexpected or newly imposed tariffs, including: (1) changes in tariff rates or classifications; (2) new trade remedies (e.g., safeguard, antidumping, or retaliatory tariffs); and (3) country-of-origin rule changes or enforcement shifts.
• Is there a defined contractual mechanism for price adjustments, cost sharing, or renegotiation in response to significant tariff changes? Are there provisions relating to how to handle any tariff refunds?
• Do contracts prohibit or restrict unilateral pass-through of tariffs without notice or substantiation?
• Are suppliers required to provide accurate and timely information necessary to manage tariff exposure, such as: (1) country of origin; (2) production locations and processes; (3) and tariff classifications and valuation data?
• Are suppliers contractually obligated to notify the company of changes that could affect tariff treatment, including changes in sourcing, manufacturing, or routing?
• Are audit, cooperation, and information-access rights sufficient to verify tariff-related representations?
• Is there a defined process for addressing tariff disputes, including documentation, escalation, and potential recovery of overpaid duties?

VII. Monitoring, Enforcement & Remediation

• Are there mechanisms to monitor supplier compliance with contractual obligations?
• Do your contracts require that the suppliers submit annual questionnaires?
• Is there a defined process for addressing: (1) suspected breaches; (2) non-cooperation; (3) repeated compliance failures?
• Are contractual remedies — such as remediation plans, suspension, or termination — used in practice when warranted?