A supplier sends an order form. The business calls it “the contract.” Legal asks for the master agreement. Security wants the data-processing terms. Procurement wants to know where the service levels and pricing commitments live.
Everyone is talking about the same deal, but they are looking at different documents.
That is normal. Many commercial relationships are governed by a contract stack rather than a single agreement.
TL;DR
The documents in a contract stack should be read together.
Procurement should understand scope, price, performance, data, risk and document precedence—not provide legal advice.
The six common documents below cover many digital and services purchases, but the right structure depends on the transaction and jurisdiction.
1. Master services agreement
The master services agreement, or MSA, sets the recurring legal and commercial rules for the relationship. It commonly addresses liability, warranties, intellectual property, confidentiality, termination, dispute handling and the mechanism for adding future work.
Procurement should understand which commercial positions are fixed in the MSA and which remain open in an order form or statement of work.
2. Statement of work
A statement of work, or SOW, describes a specific piece of work: deliverables, milestones, responsibilities, assumptions, dependencies, acceptance and fees.
The most common operational problem is vague scope. If nobody can tell when the work is complete, the contract will not create that clarity later.
3. Order form or purchase schedule
An order form records the specific product, quantity, subscription term, price, billing arrangement and commercial options being purchased under the wider agreement.
Check how the order form interacts with the MSA, online terms, product descriptions and renewal clauses. A short document can still contain the most important commercial commitments.
4. Service-level agreement
A service-level agreement, or SLA, defines the performance standard and what happens when it is missed. Availability, response times, resolution targets, reporting and service credits often sit here.
A useful SLA measures something the supplier can influence, the customer can verify and the business actually cares about.
5. Data-processing and security terms
A data-processing agreement or security addendum covers how information is handled, protected, transferred, retained and deleted. It may also address subprocessors, incidents, audit rights and regulatory responsibilities.
Procurement coordinates the process, but privacy and security specialists should own decisions in their domains. The contract should reflect the actual data flow, not a generic questionnaire answer.
6. Non-disclosure agreement
A non-disclosure agreement, or NDA, controls the use and disclosure of confidential information. It may be one-way or mutual and can be signed before commercial negotiations begin.
Check whether confidentiality is already covered in the MSA and how long obligations survive. Duplicated confidentiality terms can create unnecessary inconsistency.
The clause people forget: precedence
When documents conflict, the order-of-precedence clause says which one wins. Without it, the commercial team may assume the order form overrides the MSA while Legal assumes the opposite.
Map the whole contract stack and record the governing hierarchy. This matters particularly when supplier online terms are incorporated by reference and can change over time.
Procurement’s review checklist
What exactly is being purchased?
Which entities, users, locations and products are covered?
How are fees calculated and changed?
What is the initial term, renewal structure and notice period?
Which deliverables and service levels can be verified?
Who owns dependencies and acceptance?
How are data, intellectual property and supplier materials handled?
Which documents form the agreement, and which one prevails?
What needs to be transferred into the contract record after signature?
This checklist supports commercial coordination; it is not a substitute for legal advice.
Video companion
Frequently asked questions
Is a purchase order a contract?
It can form part of a binding agreement depending on the terms, acceptance and jurisdiction. Procurement should understand which terms the purchase order incorporates and obtain legal advice for the organisation’s position.
Do we always need an MSA?
No. The structure should match the purchase and relationship. A low-risk one-off transaction may not justify the same document stack as a long-term technology service.
What is the difference between an SOW and an order form?
An SOW usually describes work and deliverables. An order form usually records products, quantities, subscription terms and pricing. Providers may use the labels differently, so read the content rather than relying on the name.