IIIOrganization & Project ManagementGuide
Finding the Right IT Service Provider: Questions and Contract Points
For many small businesses, the IT service provider is the IT department. They know the passwords, the backup, and the weak spots better than the owner. That is convenient as long as things go well, and risky when they no longer do.
Key takeaways
- The relationship with the IT service provider is a principal-agent relationship: the provider acts for the business, has different goals, and knows more. Remedies are better information and payment by results.
- Before the contract, what counts is checking capabilities; after the contract, making the work visible: accounts held by the business, documentation, reports on backup and updates.
- Research on outsourced IT finds that communication, knowledge sharing, and trust support success and that hidden costs are a risk (Könning, Westner, and Strahringer 2019).
- In a study of 114 small businesses, good external support was more important to the success of IT projects than support from management (Thong, Yap, and Raman 1996).
Why choosing an IT service provider is more than a question of price
In a business with 15 employees, there is rarely anyone whose main job is IT. A local service provider takes care of it, often for many years. They set up computers, look after the server, install updates, and come when the printer stops working. Over time, almost everything ends up with them: credentials, knowledge of the systems, the backup. The owner usually only notices when the provider retires, sells the company, or simply can no longer be reached.
This leads to the guiding question of this guide: how does a small business choose an IT service provider and shape the collaboration so that it is well looked after without losing control of its own IT? To answer it, we clarify the terms, present a thinking model from organizational economics, review the findings, weigh two perspectives, and describe questions for the first meeting and contract points.
Whoever does not have the passwords does not have IT, but a service provider.
What types of IT service providers are there?
An IT service provider looks after a business's information technology in whole or in part for payment. The forms differ mainly in how payment works and who makes sure nothing fails. With billing by effort, every hour is charged individually. With a support flat fee, the business pays a fixed amount per workstation and month for agreed services. With managed services, the provider takes over ongoing monitoring and maintenance of the systems and commits to fixed services in return.
| Model | How payment works | Provider's incentive | Fits when |
|---|---|---|---|
| By effort | every hour individually | more hours bring more revenue | there is rarely a need and the business is very small |
| Support flat fee | fixed amount per workstation and month | fewer disruptions mean less work | services are clearly described |
| Managed services | flat fee with fixed commitments on monitoring, updates, and response time | preventing is cheaper than repairing | the business wants predictable costs without in-house IT knowledge |
Payment is not a side issue. It determines what pays off for the provider, and that is exactly what the thinking model of this guide deals with.
The thinking model: the IT service provider as agent
Principal-agent theory describes a relationship in which one person, the principal, delegates a task to another person, the agent. Michael Jensen and William Meckling developed it in 1976. The essay on principal-agent theory in the business applies it to owners and employees. It fits the business and its IT service provider just as well.
Two assumptions underpin the theory. First, principal and agent do not pursue the same goals. The business wants working, secure IT at predictable costs. The provider also wants revenue, utilization, and little effort on inconvenient tasks. Second, the agent knows more about their work than the principal. This information asymmetry, meaning unequally distributed knowledge, is particularly large in IT, because the owner can hardly check whether a backup is complete or a system up to date.
| Concept | Meaning | Example |
|---|---|---|
| Adverse selection | The principal cannot check before signing whether the agent has the claimed abilities | A provider advertises IT security but has nobody who understands it |
| Moral hazard | After signing, the agent acts differently than the principal wishes, because the principal cannot observe the behavior | Updates are postponed and backups not checked because nobody notices |
| Dependency | Replacing the agent becomes expensive because knowledge and access lie with them | Only the provider knows the administrator password |
According to Eisenhardt (1989), on whom the essay draws, there are two remedies: better information about behavior or payment by results. Both cost something. For selection, this means: check capabilities before the contract, describe the result in the contract, and make the work visible during the collaboration.
An analogy makes this tangible. Whoever has a house built checks references beforehand, writes into the contract what must be finished, and has an inspector carry out the acceptance. Nobody would leave the builder alone with the keys and the building file. In IT, that is often exactly what happens.
What research shows about outsourced IT
Research on outsourced IT is extensive. Lacity, Khan, Yan, and Willcocks (2010) analyzed 164 empirical journal articles from 1992 to 2010. According to them, whether outsourced IT was successful depended on characteristics of the client and the provider, on the relationship, on contractual governance, and on the characteristics of the outsourced task. Könning, Westner, and Strahringer (2019) extended this review with 63 studies from 2015 to 2017.
Three findings of this more recent review are revealing for small businesses. First, it confirmed the importance of communication, knowledge sharing, and trust, as well as the provider's domain and technical capabilities. Second, it named hidden costs, for example for additional control or for switching after the contract ends, as a risk to success, especially from the client's perspective. Third, a study cited there found a clearly positive relationship between adherence to the agreed transition plan, meaning the orderly handover of IT to the provider, and success.
For small businesses in the narrower sense, there is an older but frequently cited study. Thong, Yap, and Raman (1996) studied 114 small businesses introducing information systems. Good external support, meaning the quality of consultants and vendors, was more important to success than support from management. The guide on selecting software uses the same finding. It underlines how much depends on choosing the right partner.
Source: Lacity et al. (2010); Könning, Westner, Strahringer (2019); Thong, Yap, Raman (1996)
Small businesses also rely heavily on their provider for security. In the interviews by Wilson and McDonald (2025) with British small businesses and security providers, the businesses relied mainly on existing contacts and their IT suppliers for security. At the same time, the providers criticized that backups were often never restored.
Contract or trust? Two perspectives
The first perspective relies on the contract. What has not been agreed in writing will not be delivered in a dispute. Response times, services, accounts, and exit must therefore be precisely regulated. Principal-agent theory supports this: where behavior is hard to observe, result and information must be set out in advance.
The second relies on trust. A good provider knows the business, responds even beyond the commitments, and thinks ahead. A thick contract signals distrust and invites doing only what was agreed. This is supported by the findings on the importance of trust and communication and by stewardship theory, which the essay on principal-agent theory presents as the counterposition.
Contract first
- services and response times in writing
- accounts and documentation held by the business
- regulated exit with handover
- risk: work to rule only
Trust first
- a fixed contact who knows the business
- help even beyond what was agreed
- short paths, few formalities
- risk: dependency that only shows in a dispute
I consider both necessary, but for different things. The contract regulates what counts in a conflict: accounts, documentation, backup, exit. Trust carries everyday work. A contract that leaves the accounts with the business is not proof of distrust but the condition for being able to trust a provider without being at their mercy.
Eight questions for the first meeting and ten contract points
The selection follows the same logic as for an agency, described in the guide on choosing an agency: ask all providers the same questions in the same order, write down the answers, and call a reference.
- Who specifically will look after us, and who stands in for this person during vacation and illness?
- Which businesses of our size and industry do you look after, and may we call one of them?
- How quickly do you respond to an outage, and how is this set out in the contract?
- How do you back up our data, and when did you last test a restore at a customer?
- How do you keep systems up to date, and how do we learn that it has happened?
- To whom are accounts, licenses, and administrator accounts registered?
- What is included in the price, and what is charged extra?
- How does a handover work if we end the contract?
| Point | What should be regulated |
|---|---|
| Scope of services | which devices, programs, and services are supported, and which are not |
| Response times | depending on the severity of the disruption, with availability and deputy |
| Accounts | all administrator accounts and licenses are registered to the business, passwords in an emergency access held by the business |
| Documentation | an up-to-date overview of devices, programs, network, and accounts, handed over at any time |
| Data backup | frequency, target values for data loss and recovery, restore test with a record |
| Updates and security | frequency, report to the business, procedure for security incidents |
| Data protection | data processing agreement if personal data is processed |
| Prices | flat fee and hourly rates, travel costs, costs for projects outside the flat fee |
| Reports | once a quarter a short report on backup, updates, disruptions, and recommendations |
| Exit | notice period, handover of documentation and accounts, cooperation in the transition |
How precisely response times should be described so that they are kept is covered in the guide on setting service commitments. And which target values make sense for backup is set out in the guide on backup with the 3-2-1 rule.
How much hidden costs change the comparison is shown by a worked example for a business with 15 workstations. Provider A bills by effort, provider B offers a flat fee without backup checks, provider C a flat fee with monitoring, backup, and a quarterly report. The items missing from the quotes are added. All figures are freely chosen.
Worked example with freely chosen values. A: 90 hours at 95 euros and 2,950 euros for travel and emergencies. B: 40 euros per workstation and month plus 2,600 euros for an external backup. C: 50 euros per workstation and month, everything included.
What follows beyond the selection, and where the limits lie
The selection is only the beginning. On the business's side, the collaboration needs a person who is the contact, reads the quarterly reports, and checks once a year whether accounts and documentation really are held by the business. This is not a technical task but a management task. The guide on basic IT security for small businesses describes which rules on passwords, backups, and access rights the business itself should know.
One limit lies in the market. In many regions there are only a few IT service providers for small businesses, and they are fully booked. Whoever wants to enforce ten contract points may not find a provider who accepts them all. Then a sequence applies: accounts, documentation, and exit first, because they limit dependency. Everything else can be renegotiated once the collaboration is running.
Conclusion: how does a business find the right IT service provider?
We set out to ask a small business chooses an IT service provider and shapes the collaboration so that it is well looked after without losing control. The answer follows from the thinking model: the provider is an agent who knows more and has different goals. Before the contract, checking capabilities with fixed questions and a reference helps. In the contract, a described result and payment that rewards prevention help. During the collaboration, reports and accounts held by the business help.
The findings support both contract and trust. Communication and trust carry success; hidden costs and unregulated handovers endanger it. A good provider has no objection to their customer keeping the keys. Whoever resists answers the most important question of the selection in the first meeting.
What you can put into practice right away
- Check to whom administrator accounts, licenses, and the domain are registered today, and log in everywhere yourself once.
- Ask your provider for the current documentation of your IT.
- Read your existing contract against the ten contract points and mark what is missing.
- Arrange a restore test and a short quarterly report.
- If you want to switch: ask two providers the eight questions and call one reference each.
Frequently asked questions
What should you look for when choosing an IT service provider?
Experience with businesses of similar size, a named contact with a deputy, clear response times, and a tested approach to backups and updates. Just as important is that all accounts and licenses are registered to the business and that the exit is regulated.
What belongs in a contract with an IT service provider?
Scope of services, response times, rules on accounts and documentation, data backup with a restore test, updates and security, a data processing agreement, prices, regular reports, and the handover at the end of the contract. This is not legal advice; for larger contracts, an expert review is worthwhile.
Is an IT flat fee better than billing by effort?
For most small businesses yes, if the services are clearly described. With a flat fee, it pays for the provider to prevent disruptions; with billing by effort, every disruption brings revenue. Compare the total annual costs, including the items missing from the quote.
Who should own the administrator passwords?
The business. All administrator accounts and licenses should be registered to the business, and the passwords should be stored in an emergency access the owner can use themselves. The provider gets their own personal accounts.
How do I switch IT service providers without losing anything?
By having the contract regulate the handover of documentation and accounts and cooperation in the transition. Before switching, all accounts should be checked and a complete backup tested. The new provider ideally takes over after a joint handover meeting.
Sources
- Könning, M.; Westner, M.; Strahringer, S. (2019): A Systematic Review of Recent Developments in IT Outsourcing Research. Information Systems Management, 36(1), 78-96.
- Lacity, M. C.; Khan, S.; Yan, A.; Willcocks, L. P. (2010): A review of the IT outsourcing empirical literature and future research directions. Journal of Information Technology, 25(4), 395-433.
- Thong, J. Y. L.; Yap, C.-S.; Raman, K. S. (1996): Top Management Support, External Expertise and Information Systems Implementation in Small Businesses. Information Systems Research, 7(2), 248-267.
- Eisenhardt, K. M. (1989): Agency Theory: An Assessment and Review. Academy of Management Review, 14(1), pp. 57-74.
- Wilson, M.; McDonald, S. (2025): One size does not fit all: exploring the cybersecurity perspectives and engagement preferences of UK-Based small businesses. Information Security Journal: A Global Perspective, 34(1), 15-49.
