Subcontractor Prequalification Software Problems: The 6 That Cost Real Money, and How to Avoid Them

Why does prequalification get built as a report instead of a gate?

Because the request that reaches a developer is for a scoring system, and a score is a number. Nobody says out loud that the number has to prevent an action, so the build produces dashboards, watchlists and a nicely formatted subcontractor profile, and the estimating team continues inviting whoever they were going to invite.

The control has to sit at the moment of invitation, and that placement is the whole design. When an estimator adds a sub to a bid list for a $14M mechanical package, the system should check four things before the invitation leaves.

• The sub's single job limit against the value of this package.
• Their current aggregate exposure across every one of your live jobs, in every operating company and joint venture.
• Whether insurance, licensing and any client mandated qualification are current on today's date rather than at last renewal.
• Whether they sit on an exclusion or watch list, and why.

Then it allows, allows with a flag and a named approver, or blocks. The approval record, with the approver's name and stated reason, is what turns the system into evidence rather than opinion. Without that gate you have bought reporting. With it you have bought a control, and the difference is not a feature, it is where the software sits in your process. Deciding it late is expensive because the gate has to live inside the estimating workflow, which means integration and change management rather than a new screen.

What goes wrong when you migrate four hundred existing subcontractor files?

Every contractor arrives at this build with a shared mailbox, a folder of PDFs and a spreadsheet, and assumes the migration is a data load. It is closer to an audit.

Three problems recur. The financial statements on file are of mixed vintage and mixed assurance: an audited statement from a real accounting firm for one sub, a compilation with a disclaimer that nobody verified anything for the next, a bookkeeping export for a third. Loading those as equivalent produces a model that treats unverified figures as fact and ranks a tidy compilation above an honest audit. Assurance level has to be a field, and it has to affect the score.

The second is identity. The same company appears as three records entered under a trading name, a legal name and an abbreviation, each carrying part of the history, and merging them is a manual exercise for your risk manager rather than a matching algorithm.

The third is that a large share of the files are simply stale. A statement more than eighteen months old is answering a question from a different year, which is the failure that started this whole project. The honest approach is to migrate the current, valid files, mark everything else as unqualified pending refresh, and run a controlled recall by trade over the first quarter. That is uncomfortable politically and it is the only version that leaves you with data you can act on.

Why do the data feeds break after launch?

Three feeds carry a prequalification system and each fails quietly rather than loudly.

Enterprise system integration for live commitment and billing data is the first and most important, because it is what makes aggregate exposure real rather than self reported. Viewpoint Vista, CMiC and Sage 300 CRE are each their own integration project rather than a generic connector, and the failures are structural: job numbers reused after a restructure, commitments closing on a different calendar from the ledger, and change orders in progress that exist in project management and not yet in the commitment. If exposure depends instead on project managers updating a spreadsheet, they will stop by month three.

Document extraction on financial statements is the second. It genuinely earns its cost here, pulling current assets, current liabilities, revenue, net income, the bonding letter and the work in progress schedule from PDFs and flagging what it could not read. The failure is drift: a new accounting firm's layout, a scanned printout, or a statement with an unusual presentation, and the useful measure is not accuracy in a demo but how few fields a reviewer touches after the first month of corrections.

Third party feeds are the third. Licence status from state boards, lien and judgment monitoring, insurance expiry from certificate data and experience modification rate updates all come from sources with their own availability and coverage gaps. Design for a feed returning nothing at all, because the wrong behaviour is to treat absence of a finding as a clean result.

What happens when continuous monitoring and rescreening are not covered?

Time is the default failure in this entire category. Approval is an event and risk is continuous, so a system that only reprocesses at annual renewal is a slower version of the spreadsheet.

Inside a twelve month window a subcontractor can lose their largest customer, have a judgment entered, let a licence or a policy lapse, have their experience modification rate restated, or take three large jobs from other general contractors and triple their backlog against unchanged working capital. That last one is the specific pattern behind most defaults, and it is invisible to an annual questionnaire because it happens between questionnaires.

What monitoring means in practice is a set of triggers rather than a stream of alerts. Exposure crossing a threshold reopens the file and requests updated financials. A licence or insurance lapse suspends new invitations pending review. A lien filing or judgment routes to a named person. Self reported backlog updates become a condition of remaining on the bid list. Then, and this is what separates monitoring from noise, each trigger has a defined consequence and an owner. Notifications with no consequence train people to ignore them within weeks, which is worse than no monitoring because it creates the impression of a control that is not operating.

Should you build custom or configure what you already own?

If you are a single operating company under roughly $150M in annual volume with a conventional trade base and no self perform work, buy. TradeTapp is a reasonable answer, particularly if you already live inside Autodesk Construction Cloud, and COMPASS by Bespoke Metrics does a serious job on financial analysis. At that size the configuration effort is smaller, the cost is a fraction, and the underlying analysis is competent.

Keep ISNetworld, Avetta or Highwire if your clients require them, and do not attempt to rebuild them. It is worth being precise about what they are, because they get mistaken for prequalification constantly. They are compliance and safety qualification networks: they confirm a contractor has submitted the required paperwork and that their safety record clears a threshold. That is useful and frequently client mandated, and it is a different question from whether this company has the balance sheet to carry your $12M package through a six month cash gap.

Build when two or more of these hold. You run multiple operating companies or joint ventures and aggregate exposure is invisible. Your trade mix is unusual enough that a general scoring model misprices your real risk, since a curtain wall sub with heavy material buyout carries different working capital pressure from a labour heavy framing sub. You need the score to gate invitations inside your own estimating process rather than sit in a separate portal. You are an owner or a private equity backed rollup imposing one standard across acquired contractors. Or a package default has already cost you a fee, in which case you have already done the arithmetic.

How do hidden costs get into the quote?

The bands are $60,000 to $130,000 over 10 to 16 weeks for a first release covering financial intake and extraction, your scoring model, subcontractor profiles and single plus aggregate limits enforced at the bid invitation, and $150,000 to $350,000 over 6 to 12 months for a full platform. The overruns come from four places.

Multiple operating companies is the largest, because it means multiple scoring models reflecting different risk appetites plus consolidated exposure across them, and it is usually described in a kickoff as we have a couple of subsidiaries. Enterprise system integration is the second, priced per platform rather than once. A subcontractor facing portal is the third and is routinely underestimated, because you are then supporting hundreds of external users with password resets, document uploads and a helpdesk that did not exist before. Feeds from ISNetworld or Avetta, if you want to consume their safety data rather than duplicate it, is the fourth.

The cost nobody quotes is your risk committee's time. Someone has to decide the weights, the thresholds, the override authority and the consequence of each trigger, and those are commercial judgements rather than engineering decisions. Firms that treat this as a workshop item early move quickly. Firms that leave it to acceptance testing rebuild the model twice.

What separates a build that works from one that fails here?

The builds that work are the ones estimators actually hit. The pattern that gets adoption is to run the gate in advisory mode for two or three weeks so estimators see flags without being blocked, then switch enforcement on with a named override approver. Historic file migration can happen in the background after that. Turning enforcement on at launch, before anyone trusts the data, produces a workaround culture within a fortnight and the workaround never goes away.

The second trait is a scoring model your risk committee can change without a developer. If adjusting a weight needs a code release, the model freezes the day the project ends and everyone is back in spreadsheets within a year. Weights, thresholds and trade specific factors belong in an administration screen with a change history, so that when a package fails you can look at what the model said, adjust it, and see the effect on the current portfolio.

The builds that fail were chosen without testing the developer on the domain. Ask them to model the exposure calculation on a whiteboard. The right answer covers awarded against billed against remaining, retention, change orders in progress, exposure across entities, and self reported outside backlog. Someone who draws a subcontractor table with a status field has built a supplier directory. Ask about the audit trail on exclusion, because removing a sub from a bid list has commercial and sometimes legal consequences, so the system must record what data drove the decision, who approved any override and when. Ask to see that record printed.

Then settle ownership in writing before kickoff. You should hold the repository, the infrastructure accounts and the right to hire anyone else, which matters more than usual here because the system holds subcontractor financial data under confidentiality obligations you signed.