How can we assess an outsourced IT provider before committing long term?

Assessing an outsourced IT provider before a long-term commitment means testing whether it is a suitable operational, technical and commercial fit for your organisation, rather than relying on a sales presentation. The assessment should combine documented evidence, conversations with the people who would manage the relationship, technical discovery, customer references and careful review of the agreement.

Start with your own requirements. Define the systems, users, locations, suppliers and business processes that depend on technology. Record the problems you need the provider to address, the responsibilities your organisation will retain and any constraints affecting the service, such as regulatory obligations, legacy systems or planned growth. Without this baseline, it is difficult to distinguish a genuinely suitable proposal from one that is simply broad in scope.

Ask the provider to explain how it would understand your environment before taking responsibility for it. A credible assessment should consider matters such as:

• the condition and ownership of hardware, software, networks and cloud services;
• identity, access permissions and the way leavers and joiners are managed;
• dependencies between critical applications and suppliers;
• known technical debt, unsupported systems and recurring faults;
• backup arrangements, recovery requirements and reliance on individual staff; and
• the changes needed to bring the environment into an agreed supportable condition.

The provider should be able to separate existing risks from issues it would take responsibility for addressing. This prevents unclear assumptions at the point of handover and helps establish whether recommended improvements are essential, optional or outside the proposed service.

Check who will actually deliver the service. Ask to meet the proposed account lead, technical contacts and escalation decision-makers, not only the person responsible for the sales process. Establish where those roles are located, how knowledge of your organisation will be maintained and how responsibility is transferred when staff change. If subcontractors or specialist partners may be involved, request a clear explanation of their role, access to your systems, contractual oversight and accountability for their work.

Request evidence rather than assurances. Useful evidence may include anonymised service reports, example review documents, documented procedures, staff training records, relevant insurance details and customer references from organisations with comparable technical needs. Evidence should be current and sufficiently specific to show how the provider operates in practice. A policy document alone does not demonstrate that the policy is consistently followed.

When speaking to references, ask questions that reveal the working relationship rather than simply whether the customer is satisfied. For example, ask how accurately the provider understood the environment, whether recommendations were prioritised clearly, how disagreements were handled, whether ownership was maintained during difficult changes and what the customer would check more carefully in hindsight. References should be considered alongside your own assessment, since another organisation may have different requirements and internal capabilities.

Evaluate the proposed transition in detail. Ask for a written sequence of activities covering information gathering, access transfer, documentation, remediation, staff communication and acceptance of responsibility. Identify what your team must provide and which activities depend on third parties. A transition plan that contains only broad milestones may conceal substantial work, duplicated effort or unallocated risk.

It is also worth testing the provider’s approach to technical disagreement. Ask how it would handle a recommendation that conflicts with an existing business requirement, a preferred supplier or a planned investment. The answer should show a willingness to document options, explain consequences and obtain an informed decision rather than treating every issue as a standard technical fix.

Review the commercial and legal detail line by line. Confirm how charges are calculated, which work is included, how additional projects are authorised and how changes to users, sites or services affect the arrangement. Check the definitions of material breach, liability, confidentiality, data handling, intellectual property, audit rights and dispute resolution. Make sure the agreement reflects the responsibilities discussed during due diligence; informal promises should not be left outside the written contract.

Consider business continuity from the provider’s perspective as well as your own. Ask how it protects operational knowledge, manages access to your information, handles internal disruption and keeps critical responsibilities assigned if key personnel are unavailable. The purpose is not to demand an unrealistic guarantee, but to understand dependencies and decide whether they are acceptable.

A useful final step is to score each provider against the same criteria. Separate essential requirements from preferences, record the evidence supporting each assessment and note unresolved assumptions. Include the likely effort required from your own staff, not only the supplier’s quoted price. A provider with a lower initial cost may require more internal coordination or remedial work, while a more structured proposal may offer clearer accountability and fewer unknowns.

Commit only when the proposed operating model, responsibilities, evidence, commercial terms and identified risks are understood well enough for an informed decision. If important information remains unavailable, make its provision a condition of proceeding or delay the commitment until the uncertainty has been resolved.