Your future ERP is selected after six months of tendering. Client references are solid, the demo convinced the executive committee, the integrator is available for a January go-live. All that remains is to sign.
This is precisely the moment when most organisations forget a fundamental question: what is the financial state of the vendor that is about to host seven to ten years of your business processes?
Vendor risk is the blind spot of every ERP evaluation. Functional criteria, licence costs, integrator maturity — all are scrutinised. The vendor’s financial solidity, debt levels, R&D team stability: rarely. Yet a vendor acquired by an extractive private equity fund, facing cash-flow trouble, or losing technical momentum can turn a successful ERP project into a forced migration three years after go-live.
This guide gives you 8 concrete signals to detect, how to source them, and the contractual safeguards to embed before you sign.
Vendor Risk: The Blind Spot of ERP Evaluation
What happens when your vendor changes hands — or disappears
The history of the mid-market ERP sector is peppered with acquisitions that went badly for customers. Infor, for example, changed owners several times before being acquired by Koch Industries in 2020 under a mountain of structural debt. Epicor was bought and sold multiple times in under 15 years, with each transition generating uncertainty around roadmaps and support continuity.
These are not exceptions. The mid-market ERP space has been heavily consolidated since 2010, with waves of private equity acquisitions aimed at building software platforms by stacking vertical vendors. The outcome for customers: price hikes at renewal, frozen roadmaps, departing support teams, and sometimes an end-of-maintenance notice with 24 months’ warning.
Why the Gartner Magic Quadrant does not measure financial health
The Magic Quadrant measures product vision and execution capability. It does not measure debt-to-EBITDA ratios, R&D team turnover, or customer concentration. A vendor positioned as a “Challenger” can be in serious structural financial difficulty without that fact appearing anywhere in the report.
Financial due diligence on your ERP vendor is your responsibility — not the analysts’.
The 8 Warning Signals to Monitor
Signal 1: Excessive customer concentration (one client accounting for more than 15% of revenue)
Why it is risky. A vendor whose single largest customer represents more than 15% of revenue is structurally vulnerable. If that key client terminates, is acquired, or migrates to another solution, the vendor’s financial trajectory can deteriorate sharply — with immediate effects on headcount and support quality.
How to detect it. Request the vendor’s annual report (available via Companies House for UK-registered entities, or Bureau van Dijk Orbis for European vendors). Ask your account manager about the revenue split by sector. At user conferences, notice whether the same three or four company names recur in every case study.
Contractual safeguard. Include a termination clause triggered if the named major client leaves the vendor within the first 18 months of your contract, with licence restitution provisions.
Signal 2: Debt-to-EBITDA ratio above 5x
Why it is risky. A debt-to-EBITDA ratio above 5x signals a leveraged buyout. The owning fund has loaded debt onto the vendor itself, which must now generate cash flows to service it. Expected consequences: price increases, cost reductions in support and R&D, and preparation for a rapid resale.
How to detect it. Companies House (UK), Bureau van Dijk Orbis, or Dun & Bradstreet for international vendors. Look for LBO (leveraged buyout) mentions in specialist press (PE Hub, The Information, Pitchbook). Crunchbase shows ownership structure and funding history.
Contractual safeguard. Require a bank guarantee or security deposit equivalent to 12 months of maintenance. Request source code escrow with an independent third party (NCC Group, Iron Mountain, Escrow Europe), activated if the ratio breaches this threshold.
Signal 3: High R&D turnover (more than 30% in 12 months)
Why it is risky. Developers are the first to leave a sinking ship. High R&D turnover signals problems with technical leadership, software debt, or uncertainty about the product’s future. The roadmap shown in the demo may never arrive if the people who were supposed to build it have left.
How to detect it. LinkedIn is your best tool. Filter former employees who left within the past 12 months. Look at their next role and the comments they left on Glassdoor. If the product is open source, GitHub commit activity gives a direct read on R&D momentum.
Contractual safeguard. Request a signed roadmap with quarterly milestones. Include a penalty clause if fewer than X% of announced features are delivered within 18 months of signing.
Signal 4: Frozen roadmap for more than 18 months
Why it is risky. A roadmap that has not evolved in 18 months suggests either underinvestment in R&D, a technical dead end, or preparation for a sale (you do not invest in a product you are about to sell to a competitor). Your evolving needs — including regulatory compliance — risk not being met.
How to detect it. Review the vendor’s public release notes (typically on their customer portal or community site). Compare features announced 18 months ago with what was actually delivered. User forums (Odoo Community, SAP Community, Microsoft Dynamics Community) reveal the gap between promises and reality.
Contractual safeguard. Include a “minimum roadmap” clause: the vendor commits to delivering at least N minor releases per year, with a list of dated regulatory features (e-invoicing mandates, sustainability reporting under CSRD).
Signal 5: CEO succession within 3 years (more than 2 changes)
Why it is risky. Leadership instability reflects tensions between shareholders and management, performance issues, or strategic drift. Each CEO change calls product priorities, integrator partnerships, and sometimes pricing direction into question.
How to detect it. LinkedIn shows leadership history. Crunchbase lists executive team changes. Trade press (CIO, Computerworld, The Register) covers C-level appointments and departures at mid-market ERP vendors.
Contractual safeguard. Meet the CTO or VP of Product — not just the sales director — before signing. Include a clause naming a key contact on the vendor side with a mandatory handover obligation within 60 days of their departure.
Signal 6: Acquisition by a private equity fund with no SaaS track record
Why it is risky. Not all PE acquisitions are harmful. Some operational funds genuinely invest in R&D and help the vendor accelerate. But a fund operating a purely extractive model (debt acquisition + price increases + resale in 3–5 years) produces a predictable cycle: frozen product investment, departure of senior engineers, degraded support, aggressive price hikes at renewal.
How to detect it. On Crunchbase or PE Hub, identify the owning fund and check its history in software. A fund with positions in retail, real estate, or industrial services that acquires an ERP vendor is a red flag. Look for exit multiples cited in their LP (Limited Partner) communications.
Contractual safeguard. Negotiate a mandatory notice obligation: in the event of a sale to a third party within 3 years, the vendor must notify you 6 months in advance and maintain current pricing for 18 months post-sale.
Signal 7: Declining number of active certified partners
Why it is risky. The integrator ecosystem is a leading indicator of a vendor’s health. Certified partners invest time and money in certifications. When they leave, it means they no longer see future business — either because the client base is stagnating or because the commercial terms for partners are deteriorating.
How to detect it. Check the vendor’s official partner directory and compare it with an archived version (Wayback Machine for public sites). Attend or watch replays of the annual partner conference: the number of partners present and the tone around certifications are revealing. Ask two or three competing integrators directly — they know exactly who is rising and who is falling.
Contractual safeguard. Verify that at least 3 independent certified integrators are active in your region before signing. That competition between integrators is your best protection against a de facto monopoly on your installation.
Signal 8: Gradual degradation of SLAs and longer support response times
Why it is risky. Support degradation is the first visible sign of operational cost-cutting. This signal is all the more significant because it often precedes an announcement of end-of-maintenance or a forced migration to a “next-generation version” — which is frequently a different product that needs to be re-configured from scratch.
How to detect it. G2, Capterra, and TrustRadius publish reviews with dates. Filter reviews from the past 12 months and look for a trend in “support” and “customer service” scores. Community forums (Reddit, vendor-official forums) show real-time user sentiment. Ask your reference customers directly: “How long did you wait the last time you opened a critical ticket?”
Contractual safeguard. Embed SLAs with financial penalties: P1 response within 4 hours, P1 resolution within 24 hours, proportional maintenance rebate for breaches. Without penalties, an SLA is just a sales promise.
How to Conduct Financial Due Diligence on an ERP Vendor
Free sources (accessible to any CIO)
- Companies House (UK) / Bureau van Dijk Orbis: annual accounts, balance sheets, results, share capital, leadership history for European entities
- LinkedIn: current and former employee history, headcount trends by department
- Glassdoor: employee reviews with trends on leadership, outlook, and culture
- G2 / Capterra / TrustRadius: customer reviews with dates, ratings by category (support, value for money, features)
- Wayback Machine: historical snapshots of the vendor site, partner directories, release notes
- Crunchbase: ownership structure, funding history, acquisitions
Paid sources (for mid-market and enterprise accounts)
- Dun & Bradstreet: financial scoring, failure probability, comparative sector analysis
- Creditsafe / Experian Business: financial rating for UK and European entities
The 5 questions to ask the vendor directly
These are not trick questions. They signal that you are conducting a serious evaluation. A financially solid vendor will answer without hesitation.
- “What percentage of your 50 largest clients are still running version N-2 or older?” (measures forced obsolescence)
- “What share of your 2025 revenue came from maintenance contracts versus new licences?”
- “How is your current ownership structured, and who are your three principal shareholders?”
- “Do you have a source code escrow programme with an independent third party?”
- “What is your roadmap for mandatory e-invoicing compliance in the markets where we operate?”
The Exit Clause in Your ERP Contract
Recovering your data in a usable format
Reversibility is your ability to leave without losing your data. It must be negotiated before signing, not after a crisis. Require:
- Complete SQL export of all business data tables (not just a partial CSV export)
- Data schema documentation
- REST or GraphQL API with documentation to facilitate migration
- Delivery timeline: maximum 30 days after contract termination
Source code escrow: who needs it, when, and how
Source code escrow is a mechanism whereby the vendor deposits the source code with an independent third party (NCC Group, Iron Mountain, Escrow Europe). If the vendor fails (liquidation, cessation of activity, inability to maintain the product), you can recover the code and have it maintained by a third party.
This is relevant for mid-market organisations (200 to 5,000 employees) whose management system is business-critical. The annual cost of an escrow agreement is typically £3,000–£8,000, modest relative to the risk covered.
Notice period and service continuity in the event of acquisition
Negotiate a 12-month notice period in the event of product discontinuation or end of maintenance, with current pricing maintained throughout that period. Without this clause, a struggling vendor can announce end-of-support at 6 months’ notice with a paid migration proposal to its successor product.
What to Do If Your Vendor Is Acquired or in Difficulty
The 3 possible scenarios
Benign industrial acquisition. A competitor or complementary player acquires the vendor to integrate the technology into their offer. Teams are retained, the roadmap accelerates, pricing is stable in the short term. This is the best outcome for existing customers.
Extractive PE acquisition. A fund acquires the vendor for valuation and resale in 3–5 years. The first 18 months appear normal, then signals gradually deteriorate: R&D turnover, extended support times, price hikes at renewal, frozen roadmap. Prepare your Plan B at the first signs.
Liquidation or cessation of activity. Rare but possible for small vertical vendors. If you have negotiated an escrow and an exit clause, you have 12 to 18 months to migrate under reasonable conditions. Without these protections, you are in crisis mode.
Exit plan: a 12–24 month horizon
A well-prepared ERP exit plan anticipates things in advance:
- Map critical data from go-live: which modules are essential, which data must be migrated first
- Identify 2 credible alternative solutions in your sector — without going as far as a formal tender process
- Maintain living documentation of your configuration, workflows, and integrations (something integrators have little incentive to hand over spontaneously)
- Review your exit clause at every contract renewal
Vendor Scoring Framework: 40 Points
Use this table before signing. A score below 25/40 justifies strengthened contractual clauses or a second look at your vendor choice.
| Signal | Max score | Criteria |
|---|---|---|
| 1. Customer concentration | 5 | 5 pts if < 10% per client, 3 pts if < 15%, 0 pt if > 15% |
| 2. Debt-to-EBITDA ratio | 5 | 5 pts if < 2x, 3 pts if 2–4x, 0 pt if > 5x |
| 3. R&D turnover | 5 | 5 pts if < 15%, 3 pts if 15–25%, 0 pt if > 30% |
| 4. Roadmap activity | 5 | 5 pts if major release < 12 months, 3 pts if < 18 months, 0 pt if frozen |
| 5. Leadership stability | 5 | 5 pts if same CEO > 3 years, 3 pts if 1 change, 0 pt if > 2 |
| 6. Ownership quality | 5 | 5 pts if industrial/management-owned, 3 pts if PE with SaaS track record, 0 pt if extractive PE |
| 7. Partner network | 5 | 5 pts if growing network, 3 pts if stable, 0 pt if declining |
| 8. Support quality | 5 | 5 pts if G2 > 4.5/5 in 2025–2026, 3 pts if > 4/5, 0 pt if negative trend |
Score < 25: strengthened contractual clauses are mandatory (escrow, penalised SLAs, 12-month notice). Score < 15: reconsider your vendor choice before signing.
These 8 signals are your first line of defence. The second line is what you put in the contract. To go further on contractual clauses, read our guide ERP Contract Negotiation: 12 Clauses Checklist, our analysis of ERP Vendor Lock-In and Exit Strategy, and if you are looking to optimise your current ERP costs, our guide on ERP Cost Optimisation After Go-Live.
