Outsourcing Your IT Doesn't Mean Outsourcing Responsibility

I've spent much of my career working in IT, both managing technology inside businesses and supporting organisations that have decided to outsource it. One thing that's become increasingly obvious over the years is how many business owners believe that hiring an external IT company means they no longer need to worry about technology.

They've found someone who knows what they're doing, agreed to a monthly fee and handed over responsibility for keeping everything running. As far as they're concerned, that's another item to cross off their list.

I can understand why that arrangement is attractive. Most business owners didn't start their companies because they wanted to understand networks, servers, Microsoft 365 or cyber security. They have customers to look after, employees to manage and a business to run.

But there's something that needs to be understood.

Paying somebody to manage your IT doesn't mean you've handed over responsibility for the decisions being made about your business.

And if you don't understand that distinction, you could be leaving some fairly important decisions entirely in the hands of somebody who doesn't have to live with the consequences in quite the same way you do.

There's a difference between managing technology and managing a business

When I worked as an internal IT Manager, I wasn't simply responsible for making computers work. My job involved understanding what the business needed, where it was going and how technology could support those plans.

That meant having conversations with people who weren't particularly interested in IT. They wanted to know whether a new system would improve operations, how much it would cost, and why they were being asked to spend money replacing equipment that seemed to work perfectly well.

Sometimes I had to explain why something needed investing in. Other times I had to challenge requests for technology that wouldn't solve the problem people thought it would.

That's part of what good technology leadership looks like.

When a business outsources its IT, those conversations should still be happening. The difficulty is that they sometimes disappear behind a support contract.

The provider looks after technical problems, employees contact the helpdesk when something stops working and management receives an invoice every month. If nobody's complaining, the assumption is that everything must be fine.

But a business can have perfectly functioning computers and still be making poor technology decisions.

It might pay for software nobody uses, rely on equipment nearing the end of its supported life, or operate without a sensible plan to recover important information if something goes wrong.

None of those issues necessarily creates a support ticket.

If your relationship with your IT provider only involves contacting them when something breaks, there's a good chance nobody is having the wider conversations your business needs.

Your IT provider doesn't know everything about your business

I occasionally encounter the expectation that an IT company should automatically know what a business needs simply because it supports its computers. But that isn't realistic.

A provider might know how many employees you have, what software they use and how your systems are configured. They might even have supported you for years.

But do they know you're planning to open another office next year? That you're considering acquiring a competitor? That a particular piece of software is frustrating the business, even though nobody has reported it as an IT problem?

They won't necessarily know any of that unless somebody tells them.

I've worked in organisations where technology decisions were closely connected to operational plans, budgets and future growth. I've also seen how easily those connections can be lost when IT is treated as a separate service rather than part of the business.

A company planning to expand might need better connectivity between sites, different ways to access information, or changes to the software its employees rely on.

If the IT provider only discovers those plans when the new office is about to open, the business has far fewer options.

The same applies when management decides to introduce new software without involving the people who support it.

I've seen businesses commit to systems before properly considering how they'll work with their existing technology, whether information can be transferred or what happens when employees need support.

Sometimes the solution is straightforward. Other times the business discovers that a relatively simple purchasing decision has created a much larger problem.

Your IT provider should be asking questions about where your business is going, but you also need to involve them in those conversations.

You can't expect someone to help you plan for a future they haven't been told about.

What are you actually paying for?

This is one of the first things I'd encourage any business owner to understand about their IT arrangements.

What does your contract actually cover?

Not what you assume it covers, or what you remember discussing when you first signed up. What services are you genuinely receiving, and where does the provider's responsibility end?

The phrase "managed IT support" can mean different things depending on who's providing it.

One company might include ongoing monitoring, security updates, backups and regular reviews in its monthly agreement. Another might concentrate primarily on responding when employees report problems.

Neither arrangement is automatically wrong, provided the business understands what it's buying and the service fits its needs.

The problem starts when assumptions replace understanding.

Take backups, for example.

I've encountered situations where businesses believed their information was properly backed up, only to discover the arrangements didn't provide the protection they thought they had.

There's an important difference between storing information in the cloud, keeping multiple copies of it and having a backup you can actually use to recover from a serious incident.

Microsoft 365, for example, offers useful features to recover certain deleted or changed information, but organisations shouldn't automatically treat them as a complete backup strategy.

A business needs to understand what information is protected, how long it retains recoverable copies and how quickly it can resume work if important data becomes unavailable.

And I'd want evidence that recovery actually works.

If your IT provider says your backups are fine, it's reasonable to ask when they last tested them.

The same applies to cyber security. Having antivirus software installed doesn't mean you've addressed every security risk. A firewall doesn't guarantee your business is protected against every attack, and paying for Microsoft 365 doesn't mean you've configured all its available security features properly.

These aren't reasons to distrust your provider. They're reasons to understand what you're paying them to manage.

The contract matters more when something goes wrong

Nobody particularly enjoys reading IT support agreements. I get it, especially when they're filled with technical language and lengthy descriptions of services that don't mean much to someone outside the industry.

But the contract becomes considerably more interesting when something goes wrong.

Suppose your business suffers a cyber security incident and you discover that a particular security service wasn't included in your agreement.

Your IT provider might reasonably point out that you never purchased the service. You might equally argue that you believed the monthly support fee included cyber security.

Both parties may genuinely believe they're right.

The difficulty is that your business is now dealing with an incident while everybody tries to establish what was agreed.

I've become increasingly convinced that IT contracts need to be much clearer about what is included, what's optional and what remains the customer's responsibility.

If backups are charged separately, that should be obvious. If a particular type of security monitoring isn't included, the customer should understand that. If the provider has recommended improvements that the business has chosen not to purchase, there should be a record of the recommendation and the decision.

None of this should require a business owner to become an expert in technical terminology.

If somebody is paying an IT company to look after their systems, they should be able to understand the agreement without needing another IT professional to translate it.

And providers have a responsibility here too.

I don't think it's good enough to hide behind complicated contract wording when a customer has misunderstood something important.

If a service is genuinely necessary to protect a business against a significant risk, explain that risk properly. Make sure the customer understands what happens if they decide not to proceed.

They might still choose not to spend the money, and sometimes that's a perfectly reasonable commercial decision.

But at least it will be an informed one.

You can't outsource your legal responsibilities

Business owners also need to take another part of this conversation seriously.

Outsourcing IT doesn't automatically transfer your organisation's legal and regulatory responsibilities to the service provider.

Data protection is a good example.

Under UK data protection law, an organisation that determines why and how personal information is processed is generally known as a data controller. A company that processes that information on its behalf may act as a data processor.

An external IT company can act as a processor for some activities, but the parties' legal roles depend on what they actually do with the information.

The distinction matters because the organisation responsible for deciding how personal information is used doesn't simply escape its obligations by appointing somebody else to handle the technology.

The Information Commissioner's Office explains that controllers must assess processors' suitability, put appropriate agreements in place, and continue overseeing compliance.

Processors have their own responsibilities, but appointing one doesn't remove the controller's obligations.

So if your business handles customer records, employee information, or other personal data, you need to understand how that information is protected and what arrangements you have with organisations that process it on your behalf.

That doesn't mean you need to inspect every technical configuration yourself. It means you should know what information is being handled, who is responsible for protecting it, and how you can be satisfied that appropriate measures are in place.

The National Cyber Security Centre makes a similar point about leadership and cyber security. Its guidance for boards emphasises that cyber security needs to be understood and managed as an organisational risk, rather than left entirely to the technical team.

I think that's an important distinction.

Technology can fail in ways that affect customers, employees, finances and a business's ability to keep operating. Those consequences aren't confined to the IT department.

And the decision about how much risk a business is prepared to accept shouldn't be made by its IT provider alone.

Your provider should be prepared to challenge you

I have no interest in an IT company simply agreeing with every request a customer makes.

Sometimes the right thing to do is tell someone that the decision they're considering isn't sensible.

Perhaps they want to continue using equipment that no longer receives security updates. Maybe they plan to move important information into a system without understanding how it will be protected, or they've decided to delay necessary investment because everything appears to be working.

It's not the provider's job to make every commercial decision for the business, but it should be prepared to explain the consequences.

And that explanation needs to be understandable.

Telling a business owner that something presents a critical vulnerability doesn't necessarily help them decide what to do about it.

Explain what could actually happen. Could somebody gain access to confidential information? Could a failed system prevent employees from working? Would recovery take hours, days or potentially longer?

Then explain the available options, the likely costs and any practical limitations.

Sometimes the best recommendation won't involve buying anything. It might mean changing a process, using the software the business already pays for better, or deciding an existing system is still appropriate.

I've never believed that spending more money automatically means making better technology decisions.

Equally, business owners need to be willing to hear advice they don't particularly like.

If you've hired someone for their expertise, whether internally or externally, there's little point in ignoring them every time their recommendation involves an uncomfortable decision.

The provider should explain the risks clearly, and management should decide how to respond.

That's a relationship built around professional judgement rather than simply processing support requests.

What happens if your IT company disappears tomorrow?

Here's a question I'd encourage business owners to think about, even if they're completely happy with their current provider.

What would happen if that company suddenly became unavailable?

Perhaps it closes, suffers a serious incident, or the relationship simply breaks down.

Would you still be able to access your business systems? Do you know who owns your domain names? Can somebody authorised within your organisation access the administrative accounts needed to manage Microsoft 365 or other essential services?

Do you have records of the software licences you pay for, where you store important information, and who manages your internet connectivity?

I've been involved in enough supplier transitions to know these questions matter even more when a business needs to change providers.

A properly managed transition shouldn't depend on the outgoing IT company being the only organisation with access to everything.

That doesn't mean every employee should have administrator permissions or that sensitive credentials should be passed around casually.

There are sensible ways to maintain secure, controlled emergency access and clear records of the systems a business relies on.

But business owners should understand who controls those arrangements.

If your IT company registered your domain name, for example, you should know whether it's held in your organisation's name and what it would take to move it elsewhere.

The same applies to cloud services, backups, network equipment and software subscriptions.

An IT provider should make it straightforward for a customer to understand what it owns, what it licences and what would need transferring if the relationship ended.

Customers shouldn't feel trapped with a provider because switching would mean losing control of their own systems.

If the relationship genuinely delivers value, customers should want to stay because of the service they're receiving, not because leaving seems too difficult.

Good IT support isn't just about fixing problems

One thing I've always found interesting is how businesses judge whether they're getting good IT support.

Often it comes down to whether employees complain.

If the computers work and nobody waits hours for help, the provider is doing a good job.

Responsive support matters, obviously. When somebody can't work because their computer has failed, they need help quickly.

But the absence of complaints doesn't tell you whether the business is making sensible long-term decisions.

You could have an excellent helpdesk supporting an ageing collection of systems nobody has planned to replace.

You might have people receiving prompt assistance with software that's fundamentally unsuitable for the work they're trying to do.

Or you could be paying for several overlapping services because nobody has reviewed the business's technology spending for years.

A good relationship should involve discussing those things before they become expensive problems.

I'd want regular conversations about what's changed in the business, what employees are struggling with, and whether existing systems still make sense. I'd also want somebody looking ahead.

What equipment is likely to need replacing? Are software costs increasing? Have any security requirements changed? Is the business planning something that will create new demands on its technology?

The answers won't always require action, but somebody should be asking the questions.

For a smaller business, that might be a relatively informal conversation a few times a year. A larger organisation might need structured reviews, budgets and a more detailed technology plan.

The level of formality matters far less than whether the discussions are actually happening.

Your IT company shouldn't only understand what you've got. It should be interested in what you're trying to achieve.

What I'd expect every business owner to know

I don't think business owners should become their own IT managers. That rather defeats the purpose of outsourcing it.

But there are some things I'd expect anybody running a business to understand.

You should know who is responsible for your critical systems, what would happen if those systems became unavailable, and whether you have a realistic way to recover.

You should understand which security measures are in place and which risks you've consciously accepted.

You should know what your IT agreement covers, what costs extra, and whether you've chosen not to act on any significant recommendations.

And you should have enough visibility of your technology spending to question whether you're still getting value from it.

None of that requires an understanding of server configurations or network protocols.

It requires asking sensible questions and expecting clear answers.

If your provider can't explain something without burying you in technical language, ask them to explain it differently.

If you're told that a system is secure, ask what that means in practical terms.

If you're reassured that your data is backed up, ask what would happen if you needed to recover it tomorrow.

And if somebody recommends spending a considerable amount of money on new technology, ask what problem it's solving and what alternatives have been considered.

A competent provider shouldn't be offended by those questions. I'd expect them to welcome an opportunity to explain the work they're doing.

That doesn't mean questioning every minor decision or interfering with the technical work you've hired them to do.

It means recognising the difference between trusting someone's expertise and giving them complete control without understanding the consequences.

The responsibility doesn't disappear when the invoice gets paid

Outsourcing IT can be a very sensible decision. For many businesses, employing a full internal technology team wouldn't make financial or practical sense.

A good external provider can bring knowledge, experience and resources that are difficult to maintain internally, particularly for smaller organisations.

But the arrangement only works properly when both parties understand their roles.

The IT company should deliver the services it has agreed to provide, explain risks, and make appropriate recommendations. It should communicate clearly, act professionally and be accountable for its own work.

The business needs to stay involved in decisions that affect its operations, finances and responsibilities.

And those decisions need to be based on more than whether the computers are currently working.

I think too many organisations have let technology become something they only discuss when there's a problem or an unexpected expense. They've delegated the day-to-day work and gradually stopped asking questions about the bigger picture.

Then something goes wrong, a significant investment becomes necessary, or the relationship with their provider changes, and they suddenly realise how little they actually understand about the systems their business depends on.

That shouldn't be the moment when those conversations start.

You don't need to understand every piece of technology your business uses, and you certainly shouldn't have to manage it all yourself.

But if you're responsible for running the business, you need to understand the decisions being made in your name.

Outsource the expertise. Outsource the day-to-day work. Just don't outsource your judgement.