TL;DR;
You need to prioritize the bugs, tell them to work them in the order you gave them (3 at a time) and setup daily conference calls to go over the status of the 3 bugs they are currently working. This way there is daily oversight to the process and you can track what they have accomplished and they have a direct line of communication with you to ask any questions/concerns about the issues they are working on.
Oh boy, you have asked a lot of good questions and rightfully so!
First let’s start with the miss-steps. A company that is struggling to provide quality isn’t that uncommon. In fact, I’d argue, it is almost the norm (sadly). However, you hint on a few issues that need oversight, and need it now.
I worked with a third party vendor over the course of 8 months to get their product launched for us, it took a lot of my time and effort, along with our product team as well. We had the same issues you are experiencing and this is what we did, which helped immensely. We held daily standups.
We setup a conference number, and told them they had to call in each day at 10:00 AM to talk about the issues we’ve reported, what they are currently working on, blockers they have with resolving them (do they need clearer requirements from us, better reproduction steps?), and estimated timelines on completion. HOWEVER! This hurt us bad at first. We had 20+ bugs with them and the daily standups turned into reporting on all 20 bugs, it was a NIGHTMARE.
So take a lesson from me, do not just start with standups, instead prioritize the bugs. What is the most critical to fix to the least? Yes, they may all be equally important for a successful product launch, but they can be prioritized, do this first! Then send that list to the vendor. Tell them to work 3 at a time (start there, change the number accordingly to their progress). Have them estimate the top 3, how long will this take and how many of their team will be working on it? (ex: It will take 2 weeks and 2 developer) Have them justify it. What is unique about this bug that requires it to take 2 weeks and 2 developers, will throwing a 3rd developer into the mix help or hinder the progress? Be sure to make these sound like concerned questions and not like you are trying to tell them how to do their job!
Once you have prioritized the bugs and sent them over, then setup a meeting to go over meeting daily via a phone conference call, why it is important to you, what you plan to get out of the call (a status of the bugs they are currently working), expectations of how long the call should last (15 minutes? 30 minutes? an hour?), who you want there (developer, tester, managers?), who will be there on your end, etc. Then setup the daily meetings.
It isn’t going to solve itself overnight, in fact, you will still have struggles over the next month.
Now lets focus on your questions.
This is a very difficult one to answer, as it is entirely dependent on the company, their practices, and how much red tape they have built into their process.
Most companies should aim to be able to produce some sort of progress in a week or two. If they operate in an Agile workflow, it should at a minimum be the length of their iteration (this is a question you can ask them about). If they use Waterfall, well, that is more complicated, as usually you complete all work, then deploy. Which is painful and why a lot of companies are moving (or have moved) to Agile.
In short, they have to change internally and be willing to change. Keep in mind, as you discuss this, you are not suggesting they sacrifice quality, but rather deploy a smaller set of changes at a time (hence why I focused on 3 bugs at a time). It gives you and them a win in a shorter time frame and you get to see the benefit of it sooner, rather than later.
As much as I think that is a nice offer, I think that may be taking things a bit too far too soon. The last thing you want to do is tell a vendor that you are having X review their work. It adds stress and can lead to frustration on the vendors side of things. Although they are not producing the quality you expect, adding strife will not remedy the situation, and instead you need to take a process that forces oversight on the issues on a regular basis, so they, themselves, can see the progress you expect to be made and have a dedicated time every day they can ask for clarification, more information, or any concerns/questions with resolving the issues.
@oo7ml, last but not least, if they ever mention they cannot meet on X, be sure to remind them to send their status via email. Just because you can’t meet on a given day doesn’t get you out of the conversation. You need to set the expectations you want an update even if they can’t call in and it is expected to be received by the time they would call in.