How to match review depth to a contract's actual risk

Every contract queue eventually gets sorted into some kind of bucket. NDA. MSA. Order form. Renewal. The trouble is that contract type tells a reviewer almost nothing about how much attention the document actually needs. Teams that tier review by type alone end up giving the same shallow pass to a routine NDA and to the one NDA that happens to gate a data-sharing partnership with their biggest customer.

Contract type is not a risk signal

Two NDAs can look identical on the surface and carry very different exposure. One covers a sales conversation that goes nowhere. The other hands a vendor read access to production data, or ties the company to a counterparty nobody has worked with before, on paper drafted entirely by their side. Sorting by document type treats both the same way, because the label on the folder is the same. The variables that actually matter, exposure, counterparty familiarity, and how far the paper deviates from a standard template, don't show up in a document type.

Borrow the logic procurement already uses

Procurement teams gave up on sorting purchases by category a long time ago. The Kraljic Matrix, a standard tool taught by the Chartered Institute of Procurement & Supply, splits spend by supply risk and profit impact instead of product type. CIPS defines risk impact as the difficulty of sourcing something and the vulnerability that creates, and notes routine items are low-risk precisely because they have many substitutes and alternative suppliers. A contract queue can use the same split. Two contracts from the same category can sit in very different risk positions depending on value and how replaceable the relationship is, even sharing a document type.

Depth and reviewer seniority are two different dials

It helps to separate two decisions that teams tend to bundle together. Who reviews a contract, junior staff, procurement, senior counsel, is one lever. How deep the review goes, a quick scan for must-fix terms versus a full clause-by-clause read against a playbook, is a separate one. A contract can go to a senior reviewer and still get a shallow pass if nobody flagged the exposure up front. A contract can also go to a junior reviewer with instructions to run the deepest setting available, because the value or the data involved calls for it. Setting depth by habit collapses both decisions into whatever the contract type usually gets, which is the failure mode worth avoiding.

Where this shows up in the review setup

In goHeather, review depth sits on the setup screen as its own field, next to the playbook attached to the review, the parties, and which side of the deal you're on. It's a dial, not a switch: point the AI at a fast first pass for routine paper, or a deeper read for anything with real exposure. That's useful, and it's only as good as the tiering decision behind it. The tool has no way of knowing that a particular NDA involves a data-sharing arrangement unless someone tells it to run deep. A shallow setting applied to a high-risk contract because "it's just an NDA" produces a fast, confident review at the wrong depth, which can be worse than no review standard at all, because it looks like the contract was checked.

Why teams default to shallow anyway

Capacity is the real constraint behind most of this. The 2025 ACC Chief Legal Officers Survey found understaffing to be the primary barrier legal departments report, and contract management was the most frequently cited technology priority among CLOs planning new legal tech. When a team is stretched, the path of least resistance is to let contract type stand in for a risk assessment, because building an actual tiering rule takes time nobody has spare. That shortcut is understandable. It's also why high-exposure contracts slip through on a fast pass more often than anyone would guess.

Setting it up without overbuilding it

None of this needs a scoring model with weighted factors. A short, written rule works: pick two or three thresholds, a dollar value, a data-sensitivity flag, a "first time with this counterparty" flag, that bump a contract to the deeper setting regardless of document type. Keep that rule in the same playbook that already carries the rest of your positions, so it isn't something a reviewer has to remember on their own. Better still, set the depth flag during a queue triage step, before the contract reaches anyone, rather than leaving the call to whoever opens the file first.

None of this replaces judgment. A reviewer still has to read the deep-pass findings and decide what matters, and the depth setting only changes how much ground the first pass covers before a person looks at it. To see how depth and a playbook interact on an actual contract, try goHeather's AI contract review free and run the same document at two settings to compare what comes back.

This is legal information, not legal advice; consult a lawyer for legal advice.