Every IT support company you shortlist will tell you the same three things: they respond fast, they are proactive, and they are different from the others. The websites are interchangeable, the salespeople are pleasant, and you are being asked to pick the firm that will hold the keys to every system your business runs on, based on a brochure.
The fix is to stop comparing claims and start comparing evidence. The twelve questions below are designed to produce answers a provider cannot fudge: contractual commitments, named credentials, verifiable references and written terms. Ask all twelve of every candidate, write the answers down, and the decision usually makes itself. We answer all of them about ourselves without being asked, and any provider worth hiring will too.
Before the questions: know what you’re buying
Comparison only works between like services. Before shortlisting, decide roughly what you need: fully managed cover or help alongside an internal person, business hours or extended, on-site expectations, and any compliance requirements (Cyber Essentials, sector rules). Our outsourced IT support guide walks through the models, and the cost guide tells you what each level should cost, so a quote £30 under market reads as the warning it is.
The 12 questions
1. What are your contracted response times, and what happens if you miss them?
The first half sorts marketing from commitment: “we usually respond quickly” is not a number. You want priority levels (P1 for business-down through P4 for minor requests) with response and, ideally, resolution targets per level, written into an SLA. The second half is the tell: providers confident in their SLA will attach consequences, such as service credits. Providers who wobble here wobble everywhere. Our guide to IT support contracts and SLAs covers what good looks like.
2. Exactly what is included in the monthly fee, itemised, and what costs extra?
The single biggest source of MSP disputes is scope. Get the inclusion list in writing, and, just as important, the exclusion list: projects, new-starter setups, on-site visits, out-of-hours work. A cheap monthly rate with a long exclusion list routinely invoices higher than an honest all-in price. If a provider resists itemising, that is your answer.
3. Who will own our licences, domains and admin accounts?
The correct answer is: you, with the provider holding delegated access. Some providers register client licences, domains and tenants under their own accounts, which is convenient right up until the relationship ends, at which point it becomes leverage. Businesses switching providers discover this the hard way, mid-handover.
4. What are your exit terms?
Ask for the offboarding clause before you sign: what gets handed over (credentials, documentation, data), within what period, at what cost. Good providers have a documented, priced offboarding process and will show it. Evasiveness here predicts exactly the hostage situation you would be trying to leave. Our switching guide explains what a clean handover involves.
5. What security certifications do you hold yourselves?
Not what they sell, what they hold. An MSP has administrative access to every client it serves, which makes MSPs prime targets; a provider that cannot evidence its own security is a risk you inherit. Minimum: Cyber Essentials, and preferably Cyber Essentials Plus, on their own operation. ISO 27001 is a stronger signal again. Microsoft partner status tells you about competence with the platform your business probably runs on.
6. Who actually answers when we call, and what stands behind them?
You are probing two things: whether first contact is a qualified engineer or a ticket-logger, and how deep the bench is. Ask how many engineers they employ, what the escalation path looks like, and what happens when the person who knows your systems is on holiday. A one-person outfit can be excellent, but it cannot be 24/7, cannot be in two emergencies at once, and cannot escalate beyond itself; if a tiny firm is promising round-the-clock everything, treat the promise as decorative.
7. How is out-of-hours cover actually delivered?
“24/7” spans everything from a staffed overnight desk to an answering machine checked at 8am. Ask specifically: who is on call, what priorities qualify for overnight response, and is it included or billable. Match the answer to your reality; a business that trades 9 to 5 may not need it, but our 24/7 IT support page explains what genuine round-the-clock cover involves for those that do.
8. What will you do proactively, and can you show us evidence from an existing client?
Every provider claims proactive monitoring. Ask what, concretely: patching schedules, backup verification, monitored alerts, security reviews, and ask to see the artefact, such as an anonymised monthly report showing patches applied and issues caught before users noticed. Providers doing the work have the reports lying around. Providers who “keep an eye on things” do not.
9. Can we speak to two current clients about our size, and has anyone left you recently?
References filtered to businesses like yours (size, sector if relevant) beat logos on a website. Ask referees the useful questions: what happens when something breaks at 4:55pm on a Friday, what the last invoice surprise was, what they would change. The second half of the question tests honesty; every provider loses clients occasionally, and “nobody has ever left” is not a good sign, it is a rehearsed one.
10. What does onboarding involve, what does it cost, and what will you find in the first month?
Good onboarding is a documented process: audit, credential transfer, agent rollout, baseline fixes, and it may carry a fee, which is fine when it is stated up front. Documented UK setup fees range from nothing to thousands, and undisclosed ones are a classic quote trick. A provider who can describe what they typically find in a first-month audit has done this often; one who says onboarding is instant has not.
11. How do you charge for projects and changes, as distinct from support?
New server, office move, migration to the cloud: project work sits outside most support contracts, and that is normal. What you want is the pricing mechanism agreed in advance (fixed quotes per project, or a stated day rate) so each project is a decision, not a surprise. Ask what a recent, typical project cost a client your size.
12. What happens at renewal?
Contract length, notice period, auto-renewal terms, and how price increases are handled. Auto-renewal into another full year off the back of a missed 90-day notice window is a genuinely common trap. None of this is negotiable-later; it is negotiable now.
Red flags that end the conversation
Some answers should simply remove a candidate from the list:
- Refusing to itemise inclusions, or to put response times in an SLA
- Wanting licences, domains or admin accounts registered to themselves
- No exit clause, or offboarding “priced at the time”
- No security certification on their own business
- A guarantee of no incidents ever (nobody serious promises this)
- Pressure to sign before an audit of your environment
- References that never materialise
One or two soft answers deserve a follow-up question. Any of the above deserves a polite goodbye.
Making the decision
Score the shortlist against the twelve answers rather than against rapport, then weight what matters for your business: a firm dependent on uptime weights questions 1, 6 and 8; a regulated firm weights 5 and the compliance conversation; a business that has been burned before weights 3 and 4. Where two providers tie on evidence, local reality is a fair tiebreak: remote support solves most things from anywhere, but there is a practical difference between a provider who can put an engineer in your office today and one who cannot. We publish our own answers to all twelve questions during every sales conversation, and our free IT health check doubles as a preview of what our reporting and communication actually look like before you commit to anything.
Frequently asked questions
How many providers should we compare?
Two or three, seriously. One gives you no reference point; five gives you a spreadsheet hobby. Shortlist on evident fit, then run the twelve questions.
Should we choose a local IT company or a national one?
Judge on evidence first. Where evidence ties, weigh on-site reality: response commitments for physical visits, travel charges, and whether the provider has engineers realistically near you. Remote-first delivery has made the middle ground (a regional provider with genuine local presence) the sweet spot for most SMEs.
What certifications should an IT support company have?
On their own operation: Cyber Essentials at minimum, ideally Plus, with ISO 27001 a stronger signal. Microsoft partner status matters for M365-centric businesses. Ask to verify; certificates have registers.
How long should we sign for?
Twelve months is standard and reasonable. Longer terms should buy meaningful discount and still carry fair exit terms. Whatever the length, the offboarding clause matters more than the duration.
Is the cheapest quote ever the right choice?
Occasionally, when scope genuinely matches. But quotes materially below the market band (£30 to £150 per user per month, with most SMEs at £50 to £85) are usually cheap because something is missing, and the twelve questions will find what.
What’s the biggest mistake businesses make choosing IT support?
Deciding on price and personality, then discovering scope, ownership and exit terms after signing. Every expensive MSP relationship failure we see traces back to questions that were never asked.
Put us through it
The fastest way to evaluate any provider, including us, is to make them show their working. Our free IT health check audits your current setup and shows you exactly how we report, communicate and price, with our answers to all twelve questions included without being chased. Get in touch and start the interrogation.
