What are best practices for supporting and upgrading a list of contributed and custom Drupal module? My organization has made the decision to build the next version of our website on Drupal 7 with the assistance of a consultant. The consultant will be responsible for the initial build and supporting the modules required by their functionality.

We will be responsible for supporting and upgrading the contributed and custom modules we install.

We anticipate the module list will be fairly long and management of module responsibilities will become an issue. We’re trying to come up with an easy way to track the modules installed on the site and whether they are the responsibility of the consultant or us. In a perfect world we would also be able to add notes as to why a particular module is needed.

Anyone know of anything already out there that would allow us to do this? We've looked but came up empty.
Using an Install Profile can really help with these situations.  Have the consultant create a profile and manage the modules they are responsible for in profiles/[PROFILE NAME]/modules.  You will be responsible for everything that is in sites/all.

You can use https://www.drupal.org/project/profiler_builder to easily generate an install profile from an existing site.  https://www.drupal.org/project/profile_switcher can be used to convert a site started with a standard install to use a profile.

https://www.drupal.org/project/profile_status_check is also useful to visually see which modules are being loaded from profiles/[PROFILE NAME]/modules vs. sites all as well as break out custom modules (regardless of location) vs. contrib.

Install profiles are as easy as developing a custom module.  Most people are only familiar with the Install Profiles that are included in Popular Drupal Distributions like OpenAtrium and Acquia Commons. Distributions are more difficult to manage.  They require drush make and/or .make files to manage contrib modules as well as 3rd party libraries.  

While going to a full blown Distribution makes sense in some use cases, just using an Install Profile could be an elegant solution to defining who is responsible for different modules in your use case.