Scottish Procurement Policy Note SPPN 08/2004 Date 7th September 2004

Transcription

1 Scottish Procurement Policy Note SPPN 08/2004 Date 7th September 2004 RISK ASSESSMENT IN THE PROCUREMENT PROCESS Purpose 1. To advise you of guidance on risk assessment in the procurment process. Background 2. The Scottish Procurement Directorate recognises that the procurement function must have in place effective frameworks for taking informed decisions about risk. SPD has published Risk Assessment Guidance to provide an outline of risk management and the practical tools to assess and manage risks. See guidance annex attached. 3. The Risk Assessment Guidance provides an assessment tool which can be used on high value/complex procurement projects or divisional business plans. The guidance describes the process of identifying, prioritising and assigning risk owners in the form of a Risk Register in order to mitigate the impact of the risk and control the desired outcome. Dissemination 4. I would be grateful if this paper could be brought to the attention of all relevant staff in agencies and NDPB s and other sponsored public bodies within your field of responsibility. Enquiries 5. For further information, please contact the Policy and Best Practice Branch, Scottish Procurement Directorate on or lorraine.hook@scotland.gov.uk Scottish Procurement Directorate Merdian Court Glasgow

2 RISK ASSESSMENT GUIDANCE ANNEX Introduction This guidance outlines how to assess the risks presented during the procurement process. A risk assessment would typically be carried out for a high value/complex procurement exercise. Risk can be defined as uncertainty of outcome (whether positive opportunity or negative threat). All projects contain risks that may affect their costs and quality, and the time taken to complete them. Risk management is a planned and systematic process consisting of: Identification: determine what the risks are; Assessment: determine the likelihood of the risks occurring and their potential impacts; and Monitoring and Response: identify options for dealing with risks or their impacts and monitor implementation of the preferred options. Risk Identification The initial identification of as many risks as possible is essential in terms of understanding the project. Potential major risks should be documented in the risk register. Risks may be divided into 4 categories: Strategic/corporate: Commercial, financial, political, environmental, strategic, cultural, acquisition, political and quality risks. Programme: Procurement/acquisition, funding, organisational, projects, security, safety, quality and business continuity risks. Project: Personal, technical, cost, schedule, resource, operational support, quality and provider failure. Operations: Personal, technical, cost, schedule, resource, operational support, quality, provider failure, environmental and infrastructure failure. Risk Assessment The purpose of risk assessment is to assess the probability of risks occurring and their potential impact. Probability (or likelihood) is the evaluated probability of a particular outcome actually happening (including a consideration of the frequency with which the outcome may arise).

3 Impact is the evaluated effect or result of a particular outcome actually happening (usually considered in terms of effect in cost, scheduling and quality). Risk probability is usually categorised by developing a risk probability framework. An example of a typical risk probability framework is shown below. Very Low Low Medium High Very high 0 5% (Extremely unlikely, or virtually impossible) 6 20% (Low but not impossible) 21 50% (fairly likely to occur) 51% 80% (More likely to occur than not) >80% (Almost certainly will occur) Risk Monitoring One of the most common approaches to monitoring responses to risks is the use of a risk register or risk log. The risk register is set up during the start of the project, ready to record all the identified risks and the results of their analysis and evaluation, see Annex A for a Risk Register template. Information on the status of the risk is also included. An example of a typical risk register/log is shown below: Risk ID No. Description of Risk Probability /Impact Control Action Required Owner Target Date Next review date 1 Ineffective contract monitoring H/H Develop Key performance indicators (KPIs) to monitor contract Liaise with An Other, and (prior to finalisation of ITT) secure their involvement in tendering process An Other N/a 3/04 2 Inability to identify all sub-contractors or subcontracting requirements at outset leading to a lack of control of subcontracted prices H/H Develop system to identify prices as and when known reserving right to accept / reject as appropriate Managed by An Other / Customer with Reviews 6 monthly An Other 12/03 2/04 Key: VH = Very High H = High M = Medium L = Low VL = Very Low

4 A risk register may have an associated summary risk profile which is a simple mechanism to increase visibility of risks by charting levels of impact and likelihood. It is a graphical representation of information normally found on the existing risk register and an example of a typical summary risk profile is shown below. Very High High Probability Medium Risk Low Tolerance Very Low Line = Risk Very Low Low Medium High Very High Impact Allocation of Risks Ownership if risk must be clearly defined and documented within the Risk Register and agreed with the individual owners, so that they understand their various roles, responsibilities and ultimate accountability. Individual owners should have the capability, authority and experience to deal with risk/s allocated to them. Control The risk assessment process requires that risks logged on the register are controlled. Responses to risk can be divided into four response categories: Transfer: For some risks the best response may be to transfer them. This might be done by conventional insurance, or it might be done by paying a third party to take the risk in another way. Tolerate: Ability to do anything about some risks may be limited, or the cost of taking any action may be disproportionate to the potential benefit gained. In these cases the response may be toleration. Treat: By far the greater number of risks will belong to this category. The purpose of treatment is not necessarily to obviate the risk, but more likely to contain the risk to an acceptable level. The actions that an organisation takes in treating risk are called internal control - they are actions instigated from within

5 the organisation (although their effects may be felt outside of the organisation) which are designed to contain risk to acceptable levels. Terminate: Some risks will only be treatable, or containable to acceptable levels, by terminating the activity. It should be noted that the option of termination of activities may be severely limited in government when compared to the private sector; a number of activities are conducted in the government sector because the associated risks are so great that there is no other way in which the output or outcome, which is required for the public benefit, can be achieved. Tools typically employed to control risk Identified risk can be controlled within the procurement process and the tools typically employed by the buyer to enable this control are described below. Bonds and guarantees A bond is a legally enforceable financial guarantee given by a third party (the guarantor) to a purchaser (the client) to guarantee the obligations of a supplier of goods, works or services (the contractor) under a contract. The guarantor agrees to pay the client a sum of money if the contractor defaults on its obligations. The purpose of requiring a bond is to help the client meet the extra expenses to remedy the default and/or complete the contract. More information is available on bonds and guarantees at Annex B. Escrow 'Escrow' is a legal term which means 'money, goods or a written document, held by a trusted independent third party (Escrow agent), pending the fulfilment of some condition'. Escrow agreements are applicable to all types of business critical material most commonly the source code for bespoke software, or intellectual property. More information is available on escrow at Annex C. Conditions of Contract Conditions of contract ensure clear contract arrangements and will normally contain a number of clauses that will protect the organisation against a variety of risks, for example: property and risk; patents, information and copyright; indemnity and insurance; intellectual property, etc. It is Scottish Executive policy to contract under our terms and conditions. More information is available on conditions of contract at Annex D. Contingency Plans A contingency plan may be produced that provides an outline of decisions and considers the programme s effects on public services and ensure that decisions are taken about those for which contingency arrangements will be needed. For example, take up of a new service is delayed and/or much less than expected, so the previous delivery options have to continue to run in parallel. Milestones

6 relating to contingency measures should be defined in plans, and ongoing checks that the milestones are being achieved as expected. A typical contingency plan is likely to contain: Plan description: brief description of the scope of the activity, planning assumptions, pre-requisites and constraints Information concerning the event/incident that is the trigger for implementation of the contingency plan Activity Network or overall schedule information Information on key (outcomes and/or products) and/or Benefits (dis benefits) expected Budgetary information Table of resource requirements (to be assigned should the defined circumstances occur). Resource allocation may be dependent on contractsin this case details of contracts should be included Risks and Issues Plan owner Details of distribution and storage (showing how people will get a copy of the plan so that they can take the appropriate action). Risk Assessment Process The following tables outline is a practical risk assessment guide to assist the Client and buyers through each stage of the procurement process, including links to further information and useful guidance. 1. At the Strategic assessment stage: Areas to probe Best Practice 1.1 Have the major risks been identified? Potential major risks (including strategic, political and legislative risks) should be documented in the risk register. The risks of success (e.g. take-up or usage greater than expected) will need to be considered and contingencies identified. 1.2 How will risks be managed? Determine how risks will be allocated (to whom allocated and why) with high-level plans for managing them. 1.3 Have assurance measures for the programme been put in place? Ensure that stakeholders to the programme (e.g. internal audit, specialists and/or peer reviewers co-opted onto the programme board) are appointed, to challenge assumptions, decisions and risks. 1.4 Is there a contingency plan? Consider the programme s effects on public services and ensure that decisions are taken about those for which contingency arrangements will be needed. Milestones relating to contingency measures should be defined in plans, and ongoing checks that the milestones are being achieved as expected.

7 2. At the Business justification stage: Areas to probe 2.1 Are there processes to identify, assess, allocate and monitor current, anticipated and emerging risks? Best Practice There must be a risk management strategy, with named individuals who have responsibility for managing specific risks. For IT-enabled projects, the risk assessment should include information security risks; for e-government, risks relating to poor take-up should be considered. For construction projects, risks relating to health and safety should be included in the project brief. See Section 5 of Scottish Executive s Construction Works Procurement Guidance, Have the risks for each of the options been evaluated? See OGC s risk management workbook for recommended approaches to risk evaluation. For construction projects, see Scottish Executive s Construction Works Procurement Guidance, Have the risks for the preferred option been fully assessed? 2.4 Have the worst case implications associated with these risks been assessed? 2.5 Are the costs and time implications of managing the risks included in the cost and time estimate or treated as a separate risk allocation? 2.6 Has the project assessed whether it is breaking new ground in any areas? 2.7 Should the project be broken down into a series of small steps? (Note: this is mandatory for IT-enabled projects and recommended for complex projects) Assessment of costs, benefits and risks should be documented in the options appraisal section of the business case. There should be plans for managing and allocating the risks associated with the preferred option. Details should be set out in the Project Plan, Project Initiation Document or equivalent; for construction projects this information should be in the updated Project Execution Plan. Risks should be financially assessed and an allowance quantified for the risks. Costs and time for managing risks should be identified as a separate risk allocation. For construction projects, residual risk will also have to be considered. To make a meaningful comparison, carry out a high level assessment of similar projects in departments and or relevant private sector projects; seek expert advice if required, where innovation is identified as high risk. Consult with the market to help refine the approach, identify risks and ways in which risks might be mitigated. Modular or incremental approaches to the project help to break it down into manageable components and reduce risk and, importantly, how to reassemble the components as a coherent whole.

8 3. At the Procurement strategy stage: Areas to probe 3.1 Are the major risks identified, understood, financially evaluated and considered in determining the procurement strategy? Best practice There should be an overarching risk management strategy. Plans for risk management must include plans for managing the risks that cannot be transferred, such as business and reputational risk; useful guidance on Risk Allocation in Long Term Contracts is available at As at Business justification stage For construction projects, health and safety risks for the whole life of the project should be identified, see Section 5 of Scottish Executive s Construction Works Procurement Guidance, For IT-enabled projects, risks relating to IT security should be identified. For e-government projects, additional risks such as poor take-up of a service will need to be considered. 3.2 Are there risk management plans? There should be risk management plans that cover all of the risks, with responsibilities for managing each risk clearly identified and allocated; a risk reporting process in place for upward referral of risks and a contingency plan if required. 3.3 Have all the issues raised in previous review(s) been satisfactorily resolved? 3.4 Are the external issues being addressed? These include the statutory process, communications, public relations and environmental issues. The risk register should be regularly reviewed by the project team and a record kept of appropriate action taken. External risks must take account of the current business environment, the stakeholders, their expectations and priorities, which should be managed through a communications strategy.

9 4. At the Readiness for service stage: Areas to probe 4.1 Have the risks and issues that arose in the contract award and implementation phase been properly managed? 4.2 If there are unresolved issues, what are the risks of implementing rather than delaying? 4.3 Are there arrangements to minimise the risks to the business in the event of major problems during implementation and rollout? Best practice The risk register should show that outstanding actions have been addressed. The remaining risks should only be those concerned with commissioning and operational service delivery; there should be risk management strategies to deal with these. Updated Project Plans should include an assessment of all remaining issues and risks and a way forward supported by sensitivity analysis. If delay is inevitable, project manager must approve the revised plan for implementation. Business Continuity Plans and Contingency Plans should be in place in the event of late delivery and/or failure by end-users to take up new services; these should be tested and agreed with stakeholders and suppliers. For IT-enabled projects, there should be evidence of information assurance including risk assessment and management. 4.4 Does the contract reflect standard terms and conditions and (where applicable) the required level of risk transfer? 4.5 For longer term partnering contracts, have the re-competition issues been considered? Standard forms of contract should be used; if not, the reasons for a different approach should be justified. Any changes to standard terms and conditions will need to be assessed for their impact, legality and acceptability. Plans for risk transfer should be analysed against the risk management strategy. Appropriate conditions of contract e.g. escrow, performance bonds, should be used to control risks to service continuity. Re-competition issues should be addressed before letting this contract and appropriate handover clauses included in the contract.

10 ANNEX A RISK REGISTER TEMPLATE Risk Register for «Project Title» Reference «Project reference» Risk ID No. Description of Risk Probability /Impact Control Action Required Owner Target Date Next review date Probability/Impact Key: VH = Very High H = High M = Medium L = Low VL = Very Low For example:- 1 Ineffective contract monitoring H/H Develop Key performance indicators (KPIs) to monitor contract Liaise with An Other, and (prior to finalisation of ITT) secure their involvement in tendering process An Other N/a 3/04

11 ANNEX B BONDS AND GUARANTEES References to the EU rules are to the EEC Treaty, the EU procurement directives as implemented in UK legislation, rulings of the European Court of Justice and other relevant EU law. 1. INTRODUCTION A bond is a legally enforceable financial guarantee given by a third party (the guarantor) to a purchaser (the client) to guarantee the obligations of a supplier of goods, works or services (the contractor) under a contract. The guarantor agrees to pay the client a sum of money if the contractor defaults on its obligations. The purpose of requiring a bond is to help the client meet the extra expenses to remedy the default and/or complete the contract. 2. SCOPE This guidance covers some of the practical considerations when using bonds, the issue of calling on demand, and deals with five types of bond or guarantee: -unconditional on-demand bonds; -performance bonds; -parent company guarantees; -advance payment bonds; and -retention bonds. Buyers are strongly advised to seek appropriate professional and legal advice on the use, choice, and drafting of bonds for a particular contract. 3. PRACTICAL CONSIDERATIONS 3.1 Bonds are generally provided by the financial market, either by a bank or a surety company. The contractor and the guarantor will seek to establish the terms and conditions under which the bond can be called. Buyers, for their part should want to know that the guarantor issuing the bond is a sound, reliable and responsible corporate body and be satisfied that if there is need to call the bond for payment the guarantor will comply promptly. 3.2 There are at present no standard forms of bond for use in government. The wording of commercial bonds can vary depending on which organisation is providing the bond, who is involved in drawing it up and what the bond is expected to deliver. There is often intense negotiation over the precise wording of bonds and legal advisers should always be involved. 3.3 Generally, the additional cost of a bond is relatively small in comparison with the price of the contract. This will depend to some extent on the terms and conditions the client requires (whether the bond is on-default, or more onerous,

12 on-demand) and the degree of risk the guarantor attaches to the ability of the contractor to give a counter indemnity and to repay any sum that is called. 3.4 The size of the bond is very important, because this impacts on the contractor s bonding capacity. To require a large value bond has the same effect as an equivalent number of smaller bonds. Generally, contractors will be unwilling to use up their bonding line on large bonds for smaller projects and this can restrict competition. 3.5 In most cases, on-demand bonds are provided by banks who may regard them as open credit notes and may require provisions to be made from borrowing facilities against contingent liabilities. This can affect the contractor s financial resources and its ability to compete for and undertake other work. A requirement for an on-demand bond may therefore deter firms who would otherwise have tendered for the contract and/or inhibit their ability to tender in the future. 3.6 In raising a bond or a line of bonding credit from a bank or a surety company, the contractor may undergo independent professional financial vetting, Whilst the extent of the cover which the market is willing to provide may give some indication of the contractor s financial standing and prospects, the procedures applied vary greatly and will not always involve a detailed check of performance or record. 3.7 A guiding principle of procurement best practice is that normally a contract should not be placed with a contractor if there are reasonable doubts about the contractor s ability to meet the terms and conditions of the contract satisfactorily. Such doubts may arise in relation to the adequacy of the contractor s management and technical resources to deliver on time and to the required quality standard, or where information available suggests the contractor may have inadequate financial resources with consequent risk to Exchequer funds Bonds are not always necessary and are no substitute for considered judgements about the risks of a particular contract and the capabilities and financial resources of the available contractors. A decision to require a bond must be part of an overall approach to risk management and should take account of available measures to reduce the risk of default, including a proper prequalification of tenderers. Buyers will need to exercise careful judgement in assessing the costs and benefits of using bonds, many of which may not be easily quantifiable. 4. UNCONDITIONAL ON-DEMAND BONDS 4.1 The terms and conditions of a bond determine the circumstances and mechanism by which the bond can be called. An unconditional on-demand bond allows the client to call the bond at any time. Unconditional on-demand bonds are only provided by banks and are in effect certified cheques. 4.2 Because they are not linked to the performance of the contractor, unconditional on-demand bonds can be called by the client at any time and

13 without having to show any cause or justification. The findings of the courts have been consistent that there is no implied requirement for the calling to be fair or reasonable. Unconditional on-demand bonds can, therefore, be used unfairly, usually as a threat to persuade the contractor to do something it would not otherwise do, or which it is not contracted to do. Unconditional on-demand bonds are essentially unfair and Ministers have said that they should not be used in government procurement. 5. PERFORMANCE BONDS 5.1 A performance bond is usually provided at contract award, for an agreed percentage of the total contract value (normally 10 per cent). Normally, the value does not reduce, but performance bonds should have an expiry date (not necessarily a calendar date - it can be linked to an event so that time slippage is automatically taken into account). If the value of the contract increases, or the duration of the contract extends, then the bond may need to be amended accordingly. A performance bond will not of itself ensure that contracts are carried out efficiently and to time, but it will be one of a number of commercial pressures on the contractor to perform well. A performance bond can provide some compensation if the contractor defaults on its obligations. 5.2 There are two basic forms of performance bond: the conditional on-default bond and the much more onerous conditional on-demand bond. Conditional on-default performance bonds 5.3 Usually these can be called only following a serious breach by the contractor of the agreed terms and conditions of the contract (which will include becoming bankrupt and would normally allow the client to terminate the contract). 5.4 Conditional on-default performance bonds are fairly common within UK industry and are mainly provided by surety companies. They have been criticised because they are often written in outdated and obscure language. This has meant that when calls have been made, guarantors have sometimes looked to the wording of the bond for reasons not to pay. Properly expressed conditional on-default performance bonds provide a third party guarantee that the contractor will not default from a contract it has freely entered into. They should be required where there are identifiable risks of default by the contractor, subject to value for money considerations. Buyers should seek legal advice that the wording clearly expresses the true transaction and not assume that traditional wording will be appropriate. They must be prepared to pursue this with the guarantor.

14 Conditional on-demand performance bonds 5.5 These are bonds which although on-demand should include within their terms and conditions: -a mechanism for calling (so that the bond may be called only if certain procedures have been followed, requiring senior personnel within the client s organisation to approve the calling): -a requirement for the client to identify the reason for calling (which reason may be questioned and contested); and -a cooling off period (during which the contractor may remedy the default). 5.6 There is a place for the use of conditional on demand performance bonds where the costs or other consequences of default by the contractor are very high and, provided it is properly called, the guaranteed sum will be paid without risk of dispute. Such bonds retain some features of an unconditional on-demand bond. They can be called at the sole discretion of the client, but only if the agreed conditions for calling are met. This should prevent the client from acting in an arbitrary or unreasonable way and protect the contractor from the bond being called without the due and proper consideration of responsible people in the client s organisation. A cooling off period should allow the contractor time to investigate and remedy a default. Buyers should be aware of the burden that on-demand bonds can place on a contractor. Conditional on-demand performance bonds should be used sparingly on high risk and/or high value projects where the costs and/or other consequences of default by the contractor are high and only after careful consideration, including appropriate professional and legal advice. 6. PARENT COMPANY GUARANTEES 6.1 This form of guarantee is given by a parent company (or holding company) to guarantee the proper performance of a contract by one of its subsidiaries (the contractor), and can only be given where the contractor is owned by a parent company or is the subsidiary of a larger group. Such a guarantee is free of cost to the client, but may give less certainty of redress than a bond because it is not supplied by an independent third party. However, whilst accepting less independence, parent company guarantees for the proper performance of the contract can be more advantageous than bonds. Rather than receiving a fixed amount in compensation, the parent company is obliged to complete the contract (see paragraph 6.3). Costs for completion are borne by the parent company - and these costs may be significantly more than the compensation provided for in a bond. In addition, further recompense can be sought for time delays in completion through the normal clauses incorporated in the contract. 6.2 The conditions of a parent company guarantee will usually give the parent company the opportunity to remedy any default within a period of notice before

15 the guarantee is called. The liability can take several forms including a financial guarantee of completion of the project itself or the employment of another contractor to complete the project. 6.3 Where problems arise under the contract, this form of guarantee should discourage the parent company from putting the contractor into liquidation solely to avoid losses in completing the project or in paying damages for late or noncompletion. Provided that the parent company is financially sound and the guarantee is properly worded, the performance and the completion of the contract can be safeguarded, but the way in which the project is completed if the contractor defaults can to some extent, be at the discretion of the parent company. 6.4 Because the financial strength of the parent company may be linked to that of the contractor, a parent company guarantee will be acceptable only if the parent company (or holding company) is financially strong and its financial resources are largely independent of those of the contractor, and is permitted in its memorandum of association to provide guarantees. Checks should be made to ensure that the parent being offered is not another subsidiary of the same group. It is also preferable if the overall parent of the group signs the guarantee. Buyers should be aware when vetting the contractor that a parent company guarantee is only as good as the parent company (or holding company) itself. If the financial position of the holding company is inadequate, then the guarantee should be given by the ultimate parent company, if this is justified by its own financial standing. 7. ADVANCE PAYMENT BONDS 7.1 HM Treasury has issued guidance explaining why advance payments should be avoided and has advised that any advance payment made under a contract should be secured by a bank guarantee. 7.2 Where the advance payment reduces with time as, for example, stage payments are made against goods and/or services delivered under the contract, then the value of the guarantee should reduce to reflect the outstanding amount of the advance payment. 7.3 Normal practice is to require a conditional reducing on-demand advance payment bond issued by a bank so that, provided it is properly called, the guaranteed sum will be paid without risk of dispute. Advance payments should be avoided wherever possible. In all cases where they cannot, they must be independently secured by a conditional on-demand advance payment bond issued by a bank. Buyers should take legal advice that the wording expresses the true intention of the transaction.

16 8. RETENTION BONDS 8.1 These bonds are still rare in the UK but their use is likely to increase. They are provided so that contractors (and their subcontractors) may be paid without the client deducting retention money. As work is completed, the contractor is paid fully under the terms of the contract. Normal practice is to provide conditional retention bonds issued by a surety company that increase in value as payments are made in accordance with the contract. The client is protected against default at the end of the defects liability or guaranteed maintenance period up to the amount of the bond. 8.2 The traditional retention system is to withhold a percentage from payments made during the course of the contract to accumulate a fund that is available to the client if the contractor fails to rectify defects in accordance with the contract (usually 5.0 per cent of the value of the contractor s work up to certified completion, reducing to 2.5 per cent up to final acceptance). Usually, the first half (in legal terms a moiety ) of retained money is paid to the contractor on certified completion and the second on final acceptance that the contractor has fulfilled its contracted obligations. The cost of that anticipated loss of cash flow is reflected in a contractor s tender pricing. Retention bonds give contractors better and more certain cash flow through full payment at all stages (without the deduction of retention money). 8.3 The use of retention bonds transfers financing cost from the contractor to the client (who is required to pay in full earlier) and will pass cash flow benefits to the contractor. Their use will only result in a lower cost to the client if contractor are prepared to reduce their tender prices accordingly. The option to offer a retention bond should be included in the tender documents at enquiry stage. The conditions of a retention bond should relieve the client from failure by the contractor to rectify defects in accordance with the contract up to the value of the bond. Buyers will need to consider the balance of costs and benefits in deciding whether to require and/or accept retention bonds. When used they should be conditional on-demand, issued by a surety company. Buyers should take legal advice that the wording expresses the true intention of the transaction. 9. USING BONDS IN BUILDING AND CIVIL ENGINEERING CONTRACTS This guidance deals with the use of bonds and guarantees for all types of procurement. Further guidance on using bonds in construction works projects is available in the Scottish Executive s Construction Works Procurement Guidance available on the SPD website at

17 ANNEX C - ESCROW AGREEMENTS 'Escrow' is a legal term which means 'money, goods or a written document, held by a trusted independent third party (Escrow agent), pending the fulfilment of some condition'. Escrow is a tripartite agreement made between the supplier, the buyer and Escrow agent governing release of material. This ensures that if a key supplier's business should fail, or they are unable to maintain their contractual obligations, the material can be accessed and released both safely and quickly - assuring continuity of business. Escrow agreements are applicable to all types of business critical material most commonly the source code for bespoke software, or intellectual property. In a typical Software Escrow Agreement the supplier of the software provides a copy of the database content, website, instructions/ support manuals, other Intellectual Property, source code to an escrow agent. The agreement sets outs certain events under which the above can be released to a licensed user of the software (the buyer). For example if the supplier goes into bankruptcy or liquidation, a merger or acquisition takes place, or fails to properly maintain the software or perform under the Licence Agreement. Due to the technological advancements in the IT industry more and more organisations are reliant upon third parties to supply bespoke software for their needs and to provide a maintenance service for the same. Such an agreement is therefore essential in order to protect the buyer from such a risk.

18 ANNEX D - CONDITIONS OF CONTRACT The Scottish Executive like many organisations has standard terms and conditions of contract which are available from the SPD website Purchase of goods reference SETC1 Purchase of Services reference SETC2 Purchase of Consultancy Services reference SETC3 The Supply of goods reference SETC4 The Sale of Goods reference SETC5 Careful consideration must be given to what terms and conditions of contract should be applicable to the contract. While the Scottish Executive Standard Conditions of Contract should be used, consideration should also be given as to whether these are wholly appropriate for the circumstances of the contract in question, and if in doubt advice should be sought from Scottish Executive Solicitors. Examples of clauses, relevant to risk are outlined below but should only be viewed as such legal advice on clauses most appropriate to the specific project should be sought in all cases. Intellectual Property Rights (IPR) Scottish Executive standard terms and conditions (SETC s) include a condition covering IPR. It is very important to include such a condition in all contracts where intellectual property is involved and there is any possibility of the contractor producing or having access to, any material, which is subject to copyright. Alternative provisions will be required if it is intended that intellectual property rights are to remain with the contractor. If this is the case the contractor should issue a licence permitting the client to use those rights. For example:- The Contractor hereby grants to the Client a non-exclusive licence to use, reproduce, modify, adapt and enhance the material which is generated in the performance of the Contract. Such licence shall be perpetual and irrevocable. SETC s also include a condition containing an indemnity where there is any possibility of the contractor using any third party intellectual property without permission, to protect the Executive against any claim for infringement of that third party s intellectual property rights. The conditions set out will need to be expanded upon in certain types of contract which involve complex IPR arrangements; guidance should always be sought from Scottish Executive Solicitors in such circumstances.

19 Extract from: Scottish Executive standard terms and conditions of contract 1. PATENTS, INFORMATION AND COPYRIGHT 1.1 It shall be a condition of the contract, except to the extent that the Goods or Services incorporate designs furnished by the Purchaser, that nothing done by the Supplier in the provision of the Goods or Performance of the Services shall infringe any patent, trade mark, registered design, copyright or other right in the nature of intellectual property of any third party and the Supplier shall indemnify the Purchaser and the Crown against all actions, claims, demands, costs and expenses which the Purchaser or the Crown may suffer or incur as a result of or in connection with any breach of this Condition. 1.2 All rights (including ownership and copyright) in any reports, documents, specifications, instructions, plans, drawings, patents, models or designs whether in writing or on magnetic or other media: (a) furnished to or made available to the Supplier by the Purchaser shall remain vested in the Crown absolutely. (b) prepared by or for the Supplier for use, or intended use, in relation to the performance of this Contract are hereby assigned to and shall vest in the Crown absolutely, and (without prejudice to Condition 20.2) the Supplier shall not and shall procure that his servants and agents shall not (except to the extent necessary for the implementation of this Contract) without the prior written consent of the Purchaser use or disclose any such reports, documents, specifications, instructions, plans, drawings, patents, models, designs or other material as aforesaid or any other information (whether or not relevant to this Contract) which the Supplier may obtain pursuant to or by reason of this Contract, except information which is in the public domain otherwise than by reason of a breach of this provision, and in particular (but without prejudice to the generality of the foregoing) the Supplier shall not refer to the Purchaser or the contract in any advertisement without the Purchaser's prior written consent. 1.3 The provisions of this Condition shall apply during the continuance of this Contract and after its termination howsoever arising. Extract from Scottish Executive bespoke conditions of contract for an IT services contract 1. OWNERSHIP OF RIGHTS IN THE DELIVERABLES AND SOFTWARE LICENCES 1.1 Title to and risk in any tangible property embodying all Deliverables and Specially Written Software shall vest in the AUTHORITY upon acceptance thereof. 1.2 All right, title and interest of whatever nature and all Intellectual Property Rights (including but not limited to copyright and patent application rights) to the Specially Written Software and associated technical documentation shall vest in and belong to the AUTHORITY

20 free from any interest of the CONTRACTOR or any third party, upon acceptance thereof. The CONTRACTOR by its signature of the Contract assigns to the AUTHORITY with full title guarantee all Intellectual Property Rights (including without limitation thereof future copyright) in the Specially Written Software. The CONTRACTOR will do anything which the AUTHORITY may reasonably require in order effectively to vest such rights in the AUTHORITY whether before or after the termination of the Contract. 1.3 The CONTRACTOR shall supply the AUTHORITY with a copy of the Source Code of any Specially Written Software upon acceptance of the relevant element of the Specially Written Software. As regards the Intellectual Property Rights in the Deliverables, other than the Specially Written Software, the CONTRACTOR shall grant, or shall procure that the owner(s) of the Intellectual Property rights in the said Deliverables grants, to the AUTHORITY a non-exclusive, royalty-free licence to Use, reproduce, modify, adapt and enhance the said Deliverables. Such licence shall be perpetual and irrevocable. The AUTHORITY shall be entitled to engage a third party to Use, reproduce, modify, adapt and enhance the said Deliverables on behalf of the AUTHORITY, provided that such third party shall have entered into a