The Vendor That Passed UAT and Then Fell Over

Assessment: this is a leading-indicator failure, not a milestone failure. The go-live milestone is still nominally on track, which is exactly why it's dangerous - every signal here is a predictor of a late, poor-quality delivery, and none of them have yet hit a date you can point to.

Score the signals:

• PM resignation + junior replacement - loss of institutional knowledge at the worst time; the new coordinator likely cannot make decisions, which explains the silence.
• 12 days of unanswered change requests - a decision-making vacuum, not a scheduling problem. Unanswered CRs also mean scope is drifting without a change order, which is a commercial risk to you later.
• UAT data in production - a data integrity and validation failure. In a regulated system this is a finding: production must be segregated from test, and the validation evidence for go-live is now questionable. This is the most serious item.
• Two missed status calls without notice - communication breakdown; the vendor is either overloaded or de-prioritizing you.

Next 10 business days:

1. Day 1-2: Written notice to the vendor's account lead (not the junior coordinator) requesting a live call within 48 hours. Agenda is fixed: named replacement PM with relevant experience, written status of both CRs with dates, a remediation plan and dated evidence for the production-environment issue, and a revised go-live plan. Put it in writing; email is fine but copy your contracts/procurement contact.
2. Day 2-3: Ask your data manager for a written description of the production data issue and its validation impact, so you can characterize severity rather than relay a rumor.
3. Day 3-5: Hold the call. Do not accept "we're working on it." Require dated commitments and a named escalation contact. Confirm whether the CRs are in or out of the fixed fee - silence on CRs often becomes a disputed invoice later.
4. Day 5-10: Stand up a contingency in parallel, not instead. Identify whether the protocol can tolerate a paper/alternate ePRO fallback for the first weeks, and get a rough quote and lead time from a second vendor so you know your real options and their cost. Do not tell the vendor you are shopping yet; you want the information, not the confrontation.
5. Document every missed call and unanswered CR with dates. You are building the record you would need if you invoke the cure period.

On the contract: you have a 30-day cure period for material breach and no SLA credits. That means your leverage is the cure notice itself and the remaining payments, not a penalty clause. Don't fire the notice on day 3 - a cure notice starts a clock you can't easily stop, and 30 days from now is past your go-live. Hold it as the escalation of last resort if the day-5 call produces no dated plan.

No. The vendor owns the fix; you own the consequence. Those are different things and conflating them is how PMs get blindsided.

The production-environment contamination is the vendor's defect to remediate. But the downstream questions are yours:

• Is the system validated for use? If test data sat in production, the evidence supporting the validation is compromised. You cannot go live on a system whose validation you can't defend, regardless of who caused it. Ask the vendor for a written re-validation plan and the evidence that production is clean before go-live.
• Is any real subject data affected? If production has been used for anything live - even a pilot site - you need to know whether subject data is mixed with test data. That is a potential data integrity issue reportable under your quality system, and it is squarely the sponsor's responsibility to assess, not the vendor's.
• What does the site see? If sites can log in and see test records, they may act on them. That is a safety-adjacent issue.

So the correct response to the medical monitor is: "Agreed the vendor fixes it. I need you to tell me whether the contamination affects data integrity for any enrolled or screened subject, and I need the vendor's re-validation evidence before I'll sign off go-live." Route it through your quality/QA function so the assessment is documented rather than a hallway opinion.

The general principle: in a vendor relationship, the contract allocates responsibility; it does not allocate risk. The risk of a vendor failure lands on the study - on timelines, on data quality, on subjects. Your job as PM is to keep the risk on your radar even when the responsibility sits with someone else.