Selecting the wrong IT partner can quietly drain budgets, expose client data, and erode staff confidence. Many UK firms only spot the warning signs once downtime, hidden charges, or poor advice have already cost them thousands.
For professional-services firms — law, accounting, finance, and architecture — reliable IT support protects billable hours, client confidentiality, and regulatory compliance. Yet the market is crowded with providers whose promises outstrip their capabilities.
This guide exposes 10 red flags when choosing an IT company. You’ll learn the due-diligence checks, questions to ask your IT provider, and verification steps every business owner or finance director should follow before signing a managed-service contract.
INNOSEC advises professional-services firms across the UK on MSP selection, cybersecurity, and compliance under GDPR and Cyber Essentials.
No Clear Service Level Agreement – or One Full of Loopholes
A missing or vague SLA is the first major red flag when choosing an IT company. Your contract should spell out response times, escalation paths, uptime guarantees, and penalties for missed targets.
What to Look For
An effective SLA defines measurable standards: for example, critical incidents ≤ 1 hour response, 95 % first-time-fix rate, 24 × 7 monitoring.
Why It Matters
Weak SLAs let providers excuse delays (“best effort” clauses). That unpredictability leads to unplanned downtime and lost billable hours. Ask to see quarterly performance reports as part of your MSP due diligence process.
Hidden Fees and Variable Billing
Transparent pricing is non-negotiable. Some MSPs lure clients with low base rates then charge extra for on-site visits, after-hours work, or simple admin changes.
Due-Diligence Tip
Request a full rate-card and confirm which services are included in the monthly retainer. A trustworthy provider explains when project or emergency rates apply — and gives cost ceilings in writing.
Financial Impact
Firms that miss this step often see 20–30 % budget overruns. During questions to ask your IT provider, insist on examples of “out-of-scope” work from past clients.
No Evidence of Proactive Monitoring
A quality MSP prevents issues before they affect users. If a provider can’t demonstrate 24 × 7 monitoring or regular patch management, walk away.
Check Their Toolset
Ask which Remote Monitoring and Management (RMM) platform they use and how alerts are handled. Tools like Microsoft Intune and Defender show maturity; free or ad-hoc scripts suggest corners cut.
UK Compliance Context
Under GDPR Article 32, you must implement “appropriate technical measures.” Without proactive monitoring, your firm could fail both GDPR and Cyber Essentials Plus audits.
Poor Communication and Unreachable Support
Frequent provider turnover and anonymous helpdesk numbers are classic red flags when choosing an IT company.
Signs to Watch
- Tickets closed without explanation
- Engineers who change weekly
- Long silence after escalation
Best Practice
Ask for direct access to named engineers or an account manager. During discovery calls, measure how clearly they explain technical issues — plain English is a strong reliability signal.
No Security or Compliance Credentials
If an MSP lacks Cyber Essentials Plus or ISO 27001 certification, they’re not taking your security seriously.
What Good Looks Like
Reputable UK MSPs undergo annual penetration tests and staff security training. They maintain DBS-checked engineers for firms handling sensitive data (legal, finance, healthcare).
Regulatory Relevance
For solicitors, SRA Principle 7 demands competent management of client confidentiality; for accountants, FCA SYSC rules apply. A non-compliant MSP exposes you to fines and insurance risk.
One-Size-Fits-All Packages
Beware providers offering generic Bronze/Silver/Gold tiers with little tailoring. Professional-services firms need solutions aligned to workflow, compliance, and risk appetite.
Questions to Ask Your IT Provider
- How does each package address our industry regulations?
- Can you scale from 10 to 100 users without renegotiating terms?
- What Microsoft 365 licences do you recommend and why?
Why It’s a Red Flag
“Cookie-cutter” plans indicate limited understanding of your sector. A bespoke discovery process is a hallmark of serious MSP due diligence.
Lack of Documented Processes and Reporting
An MSP should demonstrate process maturity through ITIL-aligned documentation — incident logs, change records, and monthly reports.
The Risk
Without evidence, you can’t verify patch status or backup success. In a regulatory audit (FCA or ICO), “we think it’s done” won’t suffice.
Verification Step
During selection, request anonymised monthly reports to gauge clarity and depth. This forms part of robust MSP due diligence — never skip it.
No Strategic Input or vCIO Capability
Reactive support alone won’t keep pace with digital transformation. Ask if the MSP offers virtual CIO (vCIO) services — quarterly strategy sessions, roadmaps, budget planning.
Business Outcome
Firms with strategic guidance reduce IT-related downtime by up to 40 %. Without it, you’ll stay in fire-fighting mode.
No Client References or Case Studies
Any trustworthy MSP should supply recent references from similar organisations. Absence of proof is a warning sign.
Due-Diligence Action
Call two of their current clients and ask specific questions to ask the IT provider:
- How quickly do they respond to issues?
- Have they delivered projects on budget?
- Do the same engineers support you each time?
Trust Indicator
Reputable MSPs also publish case studies with GDPR-safe data showing £ savings or uptime gains. If you hear “our clients don’t allow that,” ask why — they can anonymise data easily.
Unrealistic Promises and Lack of Transparency
Finally, be wary of any provider guaranteeing “zero downtime” or “unbreakable security.” No system is infallible.
Realistic Expectations
Reliable MSPs focus on reducing incident impact through layered defences and tested disaster-recovery plans. Ask for proof of backup restores and incident response testing.
Transparency Test
During discovery, note how freely they admit limitations or risks. Honesty early on is worth far more than empty promises later.
The following sections expand on practical examples and controls.
Weak Onboarding and Transition Planning
Even a capable MSP can fail you if they mishandle onboarding. A rushed transition is a major but often overlooked red flag when choosing an IT company.
Why Onboarding Matters
Smooth handover determines how quickly your users regain productivity. Missing passwords, misconfigured mailboxes, or half-migrated data can cripple a small legal or accounting firm for days. During MSP due diligence, ask to see their documented onboarding checklist. It should include:
- Discovery of all devices, servers, and licences.
- Security baseline review (antivirus, patching, backup).
- Communications plan for staff and management.
- Parallel monitoring of old and new systems for two weeks.
Compliance Implications
Under GDPR, any data migration requires records of processing and risk assessment. A poorly planned transition could expose unencrypted data or breach confidentiality clauses in client contracts.
What Good Looks Like
A mature MSP assigns a dedicated project manager, provides weekly updates, and delivers an onboarding report confirming coverage of every endpoint. This level of transparency builds confidence from day one.
No Financial Stability or Insurance Cover
An IT provider that folds mid-contract leaves you stranded. Before signing, perform a simple financial background check.
Steps to Take
- Request confirmation of Professional Indemnity and Cyber Insurance (minimum £1 million cover).
- Search Companies House for filed accounts.
- Ask how they handle business continuity if a key engineer is unavailable.
Why It Matters
Many small MSPs operate month-to-month. If cash flow collapses, so does your support. During questions to ask your IT provider, include: “Who supports us if you’re unavailable for 48 hours?”
Over-Reliance on a Single Technician
If the same person handles every ticket, you’re one resignation away from chaos. Ask how knowledge is shared internally.
Red Flag Indicators
- No ticket history or documentation.
- Direct engineer-to-user communication with no audit trail.
- “He knows your system” excuses.
Due-Diligence Remedy
Request sight of their internal knowledge base. A compliant MSP should use a Professional Services Automation (PSA) tool where all issues are logged and reviewed weekly.
Outcome
Structured documentation ensures continuity and is a vital part of MSP due diligence — especially for regulated firms audited under FCA or SRA standards.
Ignoring User Training and Change Management
Technology fails when people don’t understand it. If your prospective MSP treats user training as an optional add-on, that’s another red flag when choosing an IT company.
What to Expect
Effective partners include induction training, security-awareness sessions, and quick-reference guides for common tasks.
ROI Example
A Belfast law firm we advised reduced password-related tickets by 43 % after quarterly Microsoft 365 refresher sessions. The time recovered equated to £1 800 per partner per year in billable hours saved.
Compliance Tie-In
The NCSC stresses “people are your first line of defence.” User-training records also support Cyber Essentials Plus verification.
Poor Cultural Fit and Misaligned Priorities
Technical competence means little if values clash. Some MSPs chase speed metrics; others prioritise thoroughness. A mismatch can breed frustration.
Questions to Ask Your IT Provider
- “How do you measure customer satisfaction?”
- “What’s your average staff tenure?”
- “How do you communicate bad news?”
Cultural Alignment Checklist
- Transparent communication style.
- Familiarity with professional-services pressures (billable hours, confidentiality).
- Willingness to engage quarterly with finance and operations, not just IT managers.
Selecting a partner who understands that a solicitor’s time equals revenue ensures the relationship enhances, rather than hinders, productivity.
No Exit Strategy or Data-Handover Clause
The contract should specify how your data will be returned or deleted at termination. Lack of an exit plan locks you in.
Why It’s Critical
Without explicit terms, the MSP could delay releasing backups or licences until disputes are settled. Under GDPR Article 20 (data portability), clients retain rights to their data.
What to Include
- 30-day transition assistance clause.
- Full delivery of configurations, passwords, and documentation.
- Written confirmation of data deletion after handover.
Treat this as part of your MSP due diligence — it protects business continuity if you ever switch providers.
Failing to Align IT With Business Goals
IT must serve strategy, not the other way round. Many MSPs focus on tools, not outcomes.
Strategic Questions to Ask
- How will this IT roadmap support our three-year growth plan?
- How do you report on ROI and risk reduction?
- Can you quantify savings from proactive maintenance?
Example Outcome
One Northern Ireland accounting practice introduced proactive monitoring and quarterly strategy reviews, cutting unplanned outages by 37 % within six months and stabilising IT costs at £2 500 per month.
The right partner links every upgrade to measurable business benefits — not just “keeping the lights on.”
Conducting Effective MSP Due Diligence
Even after reviewing these red flags, many firms struggle to turn awareness into a repeatable process. Below is a structured due-diligence framework tailored for UK professional-services organisations.
Pre-Qualification (Shortlist Stage)
- Verify UK trading address and Companies House registration.
- Check Cyber Essentials and ISO 27001 status.
- Review website for industry-specific case studies.
Evaluation (Proposal Stage)
- Score each MSP on responsiveness, clarity, and documentation quality.
- Use a weighted matrix (e.g., SLA 20 %, security 25 %, communication 15 %, cost 20 %, cultural 20 %).
- Request sample monitoring reports and a mock monthly dashboard.
Contract Review (Legal & Financial Stage)
- Involve legal counsel to confirm SLA enforceability.
- Finance directors should assess pricing predictability and insurance coverage.
- Seek a 90-day pilot with break clause.
Ongoing Governance (Post-Onboarding)
- Schedule quarterly service-review meetings.
- Audit ticket response metrics and security patch compliance.
- Document all changes for internal audit readiness.
By formalising MSP due diligence, you shift from reactive firefighting to accountable partnership.
Real-World Scenario: The Hidden Cost of Weak Due Diligence
Case Study – A 40-User Legal Firm in Manchester
The firm selected an MSP based solely on price (£1 600/month). Within three months they suffered two days of downtime due to missed server patches. Billing losses exceeded £9 000 and client deadlines were jeopardised.
A later review showed:
- No documented SLA.
- Backups untested for four months.
- No Cyber Essentials certification.
After switching to a compliance-focused provider, uptime returned to 99.8 %, and insurance premiums dropped 15 %. The lesson: saving £300/month on fees cost nearly £10 000 in lost productivity — proof that cheapest rarely means best.
Regulatory Perspective: How Compliance Shapes MSP Choice
GDPR and Data Protection
Any MSP processing personal data on your behalf is a “data processor.” Article 28 mandates written agreements outlining security measures and breach-notification timescales. Ensure your contract references this explicitly.
Cyber Essentials Plus
The UK government-backed scheme verifies basic security controls. An MSP certified to this standard demonstrates technical competence and helps you achieve the same accreditation.
FCA / SRA Expectations
Financial and legal firms must evidence third-party oversight. The FCA’s SYSC 13.9 and the SRA’s Code of Conduct both require “effective supervision of outsourced functions.” MSP selection documents become compliance artefacts in audits.
Failing these standards can invalidate professional indemnity insurance — an expensive oversight.
Calculating the ROI of Choosing the Right MSP
A well-chosen partner does more than fix problems. Quantify the benefits to justify decision-making:
| Metric | Before | After | Gain |
| Average downtime per month | 6 hrs | 1 hr | +83 % uptime |
| IT cost variability | ± 25 % | ± 5 % | +Predictability |
| Compliance audit prep time | 3 days | 1 day | − 66 % admin |
| User satisfaction (survey) | 68 % | 92 % | +24 pts |
These numbers reflect common outcomes from UK firms that applied structured MSP due diligence before contracting.
Strengthening the Partnership After Signing
Selecting the MSP is only the beginning. Maintain standards through:
- Quarterly Business Reviews (QBRs) – Assess progress, costs, and security posture.
- Annual Penetration Tests – Verify defences independently.
- Staff Feedback Loops – Capture user experience trends.
- Continuous Improvement Plans – Align IT metrics with business KPIs.
Documenting these reviews satisfies both GDPR accountability and ISO 27001 continual-improvement requirements.
Learn how to evaluate managed service providers & how to separate true partners from sales-driven vendors.
Conclusion
Choosing an IT partner is a strategic decision — not just a cost line. Spotting these red flags when choosing an IT company protects your firm from hidden costs, downtime, and compliance breaches.
Key takeaways:
- Insist on clear, measurable SLAs with penalties.
- Scrutinise pricing for hidden fees.
- Verify monitoring and security certifications.
- Request client references and case studies.
- Confirm strategic guidance (vCIO) is included.
INNOSEC specialises in Managed IT Services for UK professional-services firms. We help partners and finance directors carry out thorough MSP due diligence before signing contracts, saving firms tens of thousands in avoidance costs each year.
Frequently Asked Questions
What are the biggest red flags when choosing an IT support company?
Look for missing SLAs, hidden fees, poor communication, and no security credentials. Each indicates weak governance and potential non-compliance with GDPR or Cyber Essentials.
Which questions should I ask an IT provider before signing?
Key questions to ask an IT provider include response times, scope of support, security certifications, and client references. Request sample reports and confirm data backup testing.
How can I perform MSP due diligence effectively?
Follow a structured process: review certifications, interview existing clients, inspect SLAs, and request security audits. Document findings before any contract signature.
What should a UK MSP provide for compliance?
They should support GDPR Article 32 technical measures and help achieve Cyber Essentials certification. Ask for evidence of previous client audits and remediation plans.
Can INNOSEC review our current IT contract?
Yes. INNOSEC offers independent MSP contract and security reviews for UK firms, highlighting risk areas and providing actionable recommendations within five working days.
