# Proposal red flags: [Vendor]

_ChooseQAVendor framework v1.0. 2 patterns flagged out of 34 in the library. Nothing you enter in the toolkit is sent anywhere._

Text matching finds phrases, not intent. Treat each flag as a question to ask, not a verdict.

| Severity | Pattern | Ask next |
| --- | --- | --- |
| high | Proprietary framework or tool | If we end the contract, can our own engineers run and change every test without a licence from you? Please show us the dependencies and licence terms. |
| high | Complete coverage promised | Coverage of what, and how will you decide which risks are tested first and which are accepted? Please show the risk-based approach in writing. |

### Proprietary framework or tool (high)

The automation is built on the vendor's own framework, accelerator or platform that the buyer cannot run, maintain or licence without the vendor.

Matched phrases: "our proprietary framework"

Ask next: If we end the contract, can our own engineers run and change every test without a licence from you? Please show us the dependencies and licence terms.

_Source: The Technology Code of Practice (https://www.gov.uk/guidance/the-technology-code-of-practice); The Digital, Data and Technology Playbook (https://www.gov.uk/government/publications/the-digital-data-and-technology-playbook)_

### Complete coverage promised (high)

The proposal promises 100% test coverage or bug-free releases. Complete testing is not achievable; testing should be scoped by risk.

Matched phrases: "100% coverage"

Ask next: Coverage of what, and how will you decide which risks are tested first and which are accepted? Please show the risk-based approach in writing.

_Source: ISO/IEC/IEEE 29119 series overview (https://committee.iso.org/sites/jtc1sc7/home/projects/flagship-standards/isoiecieee-29119-series.html)_