Custom software development carries significant risk. The wrong partner can waste hundreds of thousands of dollars and delay your business by a year or more. Due diligence before signing a contract is the most important investment you will make.
What to Prepare
Requirements Documentation
Agencies cannot estimate accurately without understanding your needs:
- Business problem statement and success criteria
- User types and their key tasks
- Functional requirements (features and capabilities)
- Non-functional requirements (performance, security, compliance)
- Integration requirements (systems that must connect)
- Data migration needs (existing data that must transfer)
Budget and Timeline
- Realistic budget range (not a single number)
- Hard deadlines and why they exist
- Phasing preferences (MVP first, then iterate, versus full build)
Decision Criteria
Define what matters most before evaluating options:
- Technical expertise in your specific domain?
- Cultural and communication fit?
- Cost efficiency?
- Speed to market?
- Long-term partnership potential?
Evaluation Framework
Domain Experience
An agency that has built similar software has already solved many of the problems you will encounter:
- Have they built software for your industry?
- Have they worked with similar technical requirements?
- Do they understand the compliance standards relevant to your domain?
- Can they reference specific project challenges they avoided because of past experience?
Domain experience reduces risk more than any other single factor.
Technical Due Diligence
Go deeper than portfolio screenshots:
- Architecture capability: Ask them to describe the architecture approach for your project. Evaluate whether it is appropriate for your scale and requirements
- Code quality evidence: Request a code review or ask about their code quality standards. Look for testing practices, documentation habits, and style consistency
- Technology rationale: They should explain why they recommend specific technologies based on your requirements, not just default to their preferred stack
- Security practices: Ask about their approach to authentication, data protection, vulnerability management, and incident response
- DevOps maturity: CI/CD pipelines, infrastructure as code, monitoring, and deployment automation should be standard
Team Assessment
- Who specifically will work on your project? Meet the actual developers, not just senior partners who will disappear after signing
- What is the team's experience level? A team of juniors supervised by one senior is different from a team of mid-to-senior engineers
- How stable is their team? High turnover means constant knowledge transfer and lost context on your project
- Will team members work on multiple projects simultaneously?
Project Management
- What methodology do they use and how strictly do they follow it?
- How frequently will you see working software?
- Who manages the backlog and prioritization?
- How do they handle disagreements about scope or approach?
- What tools do they use for project tracking, communication, and documentation?
References Deep Dive
Ask references specifically:
- "Were there significant budget or timeline overruns? How were they handled?"
- "How did the team handle technical problems they did not anticipate?"
- "What was the quality of documentation and knowledge transfer?"
- "How is the ongoing maintenance relationship?"
- "If you were hiring again, what would you do differently?"
Engagement Models
Fixed Price
- You pay a set amount for a defined scope
- Risk: Scope must be precisely defined upfront. Changes cost extra
- Best for: Well-understood, clearly defined projects
Time and Materials
- You pay for actual hours worked
- Risk: Budget can overrun without disciplined scope management
- Best for: Projects with evolving requirements or R&D components
Dedicated Team
- You pay for a team (by person-month) who work exclusively on your project
- Risk: You manage the work. Underutilization wastes money
- Best for: Long-term products requiring ongoing development
Hybrid
- Fixed price for defined phases (discovery, MVP), time and materials for iteration
- Often the most practical for real-world projects
Risk Management
Start Small
Before committing to a large engagement, hire the agency for a small project or paid discovery phase. Evaluate their work quality, communication, and process on low-risk work before staking your major project on them.
Insist on Source Code Access
You should have continuous access to the source code repository from day one. Any agency that resists this is creating lock-in.
Require Regular Demos
Working software demonstrated every two weeks is non-negotiable. This is how you catch misalignment before it becomes expensive.
Plan for Transition
What happens if the engagement ends? Ensure documentation, knowledge transfer, and code ownership are contractually defined so you can transition to another team if needed.
Define Quality Standards
Include acceptance criteria in the contract. Every deliverable should have measurable standards for functionality, performance, and security.
Red Flags
"Yes" to Everything
An agency that agrees to every requirement without pushback or questions is not evaluating feasibility. They are telling you what you want to hear.
No Discovery Phase
Custom software requires understanding before estimation. Agencies that quote fixed prices without a discovery phase are guessing, and you will pay for their wrong guesses through change orders.
Opaque Pricing
If you cannot understand how they arrived at their estimate, you cannot evaluate whether it is appropriate.
Single Technology for All Problems
Every project has different needs. An agency that uses the same stack for everything is not selecting the right tool for your job.
No Post-Launch Discussion
If the proposal does not address ongoing maintenance, monitoring, and support, the agency is focused on project completion, not product success.
Contract Essentials
- Clear IP ownership (you own the custom code)
- Source code escrow or continuous access
- Defined acceptance criteria for each deliverable
- Change request process with impact assessment
- Warranty period with defined support terms
- Exit clause with knowledge transfer obligations
- Confidentiality and data protection terms
Ready to find the right development partner? Contact us to discuss your project.
For the complete picture, read our Complete Guide to Software Development.