A source-deposit arrangement can provide reassurance during a software negotiation. The business expects that important material will remain available if the supplier relationship changes. The supplier can demonstrate that files have been deposited, and procurement can record a contractual provision intended to protect continuity. Those are meaningful steps. They do not automatically establish that the company can maintain or operate the service through the route it imagines. The gap between possessing material and being able to use it can remain hidden until the moment when the company most needs the supposed fallback.
The archive and the capability are different assets
Our 2022 review considered five enterprise service components covered by a source-deposit arrangement. The archive existed. In a controlled examination, authorised technical colleagues could reproduce three components under the stated conditions. Two depended on external services, build material or rights that the deposited files alone did not establish. The result was neither that the archive had no value nor that the entire continuity proposition was supported. It showed a partial capability with unresolved dependencies. Management needed to understand that position before treating the deposit as equivalent to a usable maintenance route for the whole service.
The distinction matters because a document can describe delivery accurately while a decision-maker infers a larger outcome. Files may be present and readable. The intended use may still depend on knowledge, instructions, tools or services outside them. Commercial rights may also limit what a receiving organisation can do. Those questions belong to different responsible owners. A technical team should not infer permission from possession, and a contract review should not infer practical operability from a well-written provision alone. The useful account brings those perspectives together around the specific maintenance proposition the business wants to rely on.
I would begin by asking what event the arrangement is meant to support. Is the company seeking temporary continuity, a path to another supplier, a limited ability to correct a defect or long-term internal maintenance? Those are different requirements. A deposit that is suitable for one may be insufficient for another. Without that initial question, the discussion can become an inventory of files while the board continues imagining an independent capability. The requirement should describe the work the company expects to perform, the conditions under which it would do so and the responsibilities needed to make the route practical.
There is also a timing problem. Material that was adequate at one point may not represent the service currently used. A review therefore needs to establish what version and conditions it examined, rather than issue a general statement that the deposit works. That does not mean every change requires a large exercise. It means the arrangement should have a credible way to remain aligned with the intended use. The frequency and scope depend on the service and its significance. A reassuring certificate should not travel farther than the evidence behind it, particularly when the underlying software and dependencies continue to change.
Test the proposition without inventing rights
Procurement wanted to close our review because the supplier had delivered the agreed deposit and the negotiation had already been difficult. That position deserved a fair hearing. A reproduction gap does not by itself prove contractual breach, and the company cannot assume entitlement to every external component merely because it would prefer a more complete fallback. Legal and commercial owners examined the actual agreement while the technical team demonstrated the proposed use. The purpose was to establish what the company had and what further decision it needed, rather than turn an incomplete capability into an unsupported allegation about the supplier.
We retained a ₹1.1 crore review and transition programme and approved ₹24 lakh for six months of continuing support. The overlap kept the service relationship available while the two unresolved components were examined. It was additional expenditure, not evidence that the review had already removed dependence. The three reproducible components remained a positive result within the test conditions, but did not establish production-scale operation of the whole service. The remaining work stayed visible with technical, commercial and legal owners. We did not announce that the company could now leave the supplier simply because part of the exercise had succeeded.
This is where a bounded test is useful. It can demonstrate a specific capability, reveal missing conditions and improve the next decision without claiming universal assurance. The exercise should be designed around the intended maintenance task, with suitable material and authorised participants. Its report should explain what was attempted, what succeeded, what remained unresolved and which assumptions were necessary. A pass or fail label on its own may be too crude. The business needs to know whether a gap is a missing instruction, a practical dependency, a rights question or an operating requirement that the original proposition never included.
The cost of testing should also be considered before the need becomes urgent. A programme may prefer to rely on contractual language because practical examination takes time and resources. That choice can be rational in some circumstances, but the dependence it leaves should be stated. The alternative is not always to build a full internal capability. It might be a different support agreement, a more complete handover arrangement or a conscious decision to retain the supplier relationship. The CIO's contribution is to make those options comparable, not to insist that ownership of every technical component is inherently better.
Dependence can be chosen more honestly
A business can choose to rely on a supplier and still govern that reliance well. The important point is that the decision rests on a realistic account of the arrangement, including the limits of any fallback. An unsupported claim of independence can be more dangerous than an explicit dependence because it encourages the company to stop asking what continuity requires. In our case, the additional support period was inconvenient but honest. It preserved time for a decision that the archive alone had not settled, instead of allowing a completed procurement task to masquerade as an operating capability.
For the board, I would connect the service's importance to the practical route available if circumstances change. The paper should distinguish the contractual position, the demonstrated capability and the unfinished work, together with the cost and owner of each option. Directors can then ask whether the remaining exposure fits the enterprise's needs and whether management has a credible plan. They do not need a directory listing of every file. They need enough evidence to understand what people would actually be able to do, under which conditions, and which assumptions could prevent the intended response from working.
My lesson is to test the maintenance proposition while negotiating the original arrangement, before a deposited archive becomes a familiar answer to every continuity question. A source deposit can be a valuable part of that proposition. It should be described for the capability it supports, not for the independence its existence makes people imagine. The more precise account may carry additional cost or a less comfortable conclusion. It also gives the company a better basis for deciding where to invest, what to retain and what it is prepared to rely on when the supplier relationship is no longer routine.