Audit of a fixed-price development proposal: mobile ecosystem for a fitness chain

We recompute every line: hours per role × rate, against the line total. Four lines carry totals larger than the sum of their own role hours — 64 phantom hours in total.

At the proposal’s blended rate the four lines add €3,328 of cost with no corresponding labour. In our practice this is rarely fraud — usually a spreadsheet edited late at night.

The cover says fixed price. Section 4.2 of the draft contract says otherwise:

No ceiling, no formula, no walk-away right. You would be signing a number that becomes negotiable after you have already paid for discovery and committed the calendar — the moment your negotiating position is weakest.

Page 3 promises a “seamless transition for all existing members”. The mechanism for that promise — migration of member data, subscriptions and visit history — sits in the options table at €19,800, outside the base price.

Every proposal we audit gets this test: for each stated goal, where is the line that delivers it? A goal without a mechanism is the single most reliable predictor of a mid-project dispute.

Market practice for this scope is 3 months of defect-fixing included, with a named response time for critical incidents. Here, the day after acceptance every defect is billable. On comparable builds, first-quarter defect flow prices at €14–18k — a hidden 5–6% on top of the contract.

“Accordingly” has no ceiling and no renegotiation trigger. A two-week delay on your side can legitimise an open-ended shift on theirs, with the burden of proof on you. Symmetry is absent: the contract prices no consequence for vendor-side slippage at all.

Acceptance is defined as “signing of the acceptance act”. Nothing says what is being verified, how long you have to review, what a rejection must contain, or what happens when you disagree. In practice this clause converts every quality dispute into a payment dispute.

Against our benchmark of comparable estimates: QA at 9% of hours sits well under the observed 14–27%; project management at 3.9% under 8–18%. This is where the attractive price comes from. Under-priced coordination and testing return as your staff doing the vendor’s management, and as defects after go-live.

We score every exclusion by the probability the project cannot ship without it. Of 19 exclusions, 11 are functions NordFit will almost certainly need in year one — among them payment retries on failed direct debits, staff access roles, and GDPR data-deletion flows. Priced at vendor rates, the likely change-request tail is €47–71k (17–25% of the contract).

The proposal is silent on running costs. Reconstructed from its own architecture: cloud hosting ~€9,600/yr, third-party licences ~€4,400/yr, store accounts €125/yr, and post-warranty support at the vendor’s stated rate ~€17,000/yr — roughly €31,000 per year, or 33% of the build price over three years. It belongs in your budget before signature.

The blended rate is plausible for a strong mid-level team and low for the all-senior team the proposal describes. One of two things is true: the grades are optimistic (then F-07 is the mechanism), or the vendor is pricing to win. A direct question tends to produce an honest answer and a useful clause: named key people with substitution rights.