The 90-Day Exit Test: Could You Actually Leave This Vendor?
Vendor risk is not just whether they get breached. It is whether you could leave. The 90-day exit test measures the dependency you have actually built.

The vendor risk conversation usually stops at the front door: are they secure, are they reliable, are they solvent. The question that separates a dependency from a trap lives at the back door: if this vendor failed, doubled its price, or simply stopped serving you well, could you leave?
It is an uncomfortable question because the honest answer is often no. The data is in their format. The integrations are custom. The knowledge of how anything works left with the employee who set it up. The relationship that felt like convenience has quietly become captivity.
The 90-day exit test makes the question concrete: for each critical vendor, could you be running on an alternative within ninety days? The answer is always knowable, and knowing it changes how you negotiate, document, and sleep.
TLDR
Vendor risk includes exit risk: can you leave, how fast, and at what cost.
Test with three questions: does the data come out, does an alternative exist, does anyone here know how.
Export formats and runbooks are exit insurance; ask for them before you need them.
The exit test belongs in onboarding, not in the breakup.
A failed exit test is not a reason to leave - it is a reason to build the door.
Dependency is a one-way valve
Lock-in rarely arrives as a decision. It accumulates: the custom field mapping, the workflow built around their quirks, the years of history that exist only in their format, the staff who have never known another way. Each step is small and sensible. The sum is a relationship you cannot leave on terms you control.
The vendor knows. Pricing behavior at renewal - the sudden confidence, the shrinking discount - is often the first measurable symptom of your own captivity.
The test is not about distrust. Good vendors answer the exit questions easily; the answers cost them nothing and the willingness builds trust. It is the vague answers that carry information.
The three questions of the test
First: does the data come out? Ask for a full export - actually request it once - and look at what arrives. Usable, documented formats mean the door works. A proprietary dump nobody can read means the data is technically yours and practically theirs.
Second: does an alternative exist? You do not need a selected replacement; you need to know the market has one. A vendor with no credible alternative is a different risk category entirely.
Third: does anyone here know how? If the only person who understands the integration left in 2023, the exit knowledge is gone even if the door is open. This fictional example shows the test applied to three vendors. It is an illustration, not a prescription.
| Vendor | Data out? | Alternative? | Knowledge? | Verdict |
|---|---|---|---|---|
| Payroll | Yes, tested export | Several | Bookkeeper knows both systems | Pass |
| Industry ERP | Partial, proprietary | One | Retired employee built it | Fail - build the door |
| Email platform | Yes | Several | Documented | Pass |
Building the door before you need it
A failed exit test is a work order, not a verdict. The fixes are specific and mostly cheap: schedule the export to run and be verified annually, keep a one-page runbook of how the integration works, train a second person on the system, and capture the renewal date with enough runway to act on it.
The cheapest time to do all of this is onboarding, when the data is small and the leverage is real. The second-cheapest time is today.
The endgame version - the actual departure - is its own discipline; the vendor-offboarding checklist covers the day you finally walk through the door you built.
The negotiation dividend
The exit test pays before it is ever used. A company that can credibly leave negotiates renewals differently: the alternative exists, the data moves, the timeline is survivable. Vendors price to the pain of leaving, and you set that pain.
For leadership, the test slots naturally into the annual vendor review: three questions per critical vendor, ten minutes, enormous information. The register discipline from board-ready third-party reporting gives it a home.
And the strategic version of the question - what happens if this vendor itself disappears - is covered in the thinking on vendor viability risk. The exit test is the operational half of that worry.
The related discussion of vendor-offboarding checklist is worth your time alongside this one. The related discussion of vendor viability risk is worth your time alongside this one.
Frequently asked questions
How often should we run the exit test?
Annually for critical vendors, plus whenever the relationship changes shape: a big price increase, an acquisition, a service decline. The test takes an hour once the exports are known to work.
What if the export test fails - the data does not really come out?
Raise it with the vendor immediately and in writing. Data portability is a reasonable expectation of any serious vendor, and their response tells you a great deal about the relationship's future.
Does passing the test mean we should feel free to switch casually?
No - switching costs are real even when survivable. The point is never to leave casually; it is to never stay trapped. Those are different postures, and vendors can tell the difference.
A Defensible Next Step
Pick your most critical vendor and ask the first question this week: request the full data export and see what arrives. The package that comes back is your honest answer. Book a Decision-Clarity Call if you want the test run across your vendor list.
Get Board-Ready on AI and Cyber Risk
A 30-minute call. No charge. You'll leave with a clear read on where your oversight stands and what to do about it.


