The acquisition of a Risk Management Information System (RMIS) is a project that presents serious long-term implications for your organization.  Here are some of the risks, along with proven ways to improve your satisfaction with your new RMIS, regardless of which vendor you select:

THE RISK
This industry has a history of vendors “getting out of the business”, being acquired or being divested.  Historically, vendors have notified clients that they will be dissolving and that the client has a period of time (3-6 months typically) to find another system. No matter the size of the RMIS vendor, the chance of dissolution is a risk that must be considered and mitigated.

MITIGATION

1. Be certain you understand the stability of your vendor. Do not take this for granted. Conduct due diligence on the financials of the vendor by requesting and reviewing audited financial statements.
2. Take steps that will allow you to continue to run the system in the event of a vendor stoppage. Implement a data back-up strategy that guarantees your access to the back-up data files without a dependence on the vendor.
3. Escrow the software with an independent escrow house and make yourself the beneficiary.
4. If your vendor runs on a commercial cloud environment, get pass through language in your contract guaranteeing  that if your vendor were to dissolve, your system would continue to operate and be available on the cloud platform under the existing terms of your contract.   This will allow you to negotiate directly with the cloud provider to have them continue to run your system beyond the period of the agreement if so desired. Warning: Most legacy vendors are built with custom code.  Without those custom code developers around to maintain the code, those systems will soon cease to operate even if you have agreements with the cloud provider to continue running the system.
5. Make sure you have written clarity around your data.  You own your data.  This should be expressly agreed upon in the contract.  And, should the vendor dissolve, you should have rights to get access to your data immediately, in a readable format, without charge and without obstacles.
6. Additionally, your vendor should provide even further assurances around your data by having near real-time failover replication between two geographically separated data centers.  This gives you additional protection against a system failure, allowing you to completely switch to another node and continue to operate without disruption.