How to Vet a Managed IT Provider Before You Sign Anything – Ask ten IT companies what’s included in their service and you’ll get ten answers that sound identical and mean completely different things. That’s not an accident. Vague inclusion lists are a feature of how this industry sells, not a bug, and the business owner who doesn’t push past the sales deck usually finds out what “included” actually meant about four months in, right around the first surprise invoice. If you’re comparing managed IT services in Calgary right now, the questions below matter more than any logo on the proposal.
Start with response time, because it’s the easiest claim to fake and the easiest one to verify. “Fast” is not a number. Ask what happens when someone calls at 9am on a Monday: does a person answer, or does the call route to a ticket queue where “response” means an email acknowledging the ticket exists? There’s a real difference between a provider who picks up the phone in under a couple minutes and one who counts a bot-generated confirmation email as having responded. Ask for the actual metric, not the adjective.
What’s included versus what gets billed as an add-on
This is where most contracts hide their real cost. A provider will happily tell you cybersecurity is part of the package, and then you learn that phishing simulation training, or the security awareness piece, or after-hours incident response, sits in a separate line item you didn’t notice during the pitch. The fix here is boring but effective: ask for a written list of everything covered under the flat rate, and a separate written list of everything that isn’t. If a provider hesitates to put that in writing, that hesitation is the answer.
The tiered pricing model deserves particular skepticism. Bronze, Silver, Gold packages look like customer choice, but in practice they’re often a structure for making the cheap tier deliberately thin so you feel pressured to upgrade. A flat, all-inclusive package, one that doesn’t split cybersecurity, cloud support, and strategy into separate purchases, tends to produce fewer surprises than a tier chart designed to upsell you later.
Contract terms are where the power tilts, and it’s rarely in your favor
Read the term length and the exit clause before you read anything about services. A two or three year lock-in with penalty fees for leaving early tells you the provider expects you’ll want out, and is pricing that risk into the deal from day one. Compare that to a provider willing to work month to month, with no long-term contract required to get service. Confidence in your own work usually looks like not needing a contract to keep the client, not a signature that locks them in.
It’s also worth asking how the provider handles the boring middle of the relationship, not just the pitch and the exit. Quarterly reviews, a named point of contact instead of a rotating help desk, a clear escalation path when something breaks after hours: these are the unglamorous details that predict whether year two feels like a partnership or a hostage situation. Providers who are proud of this part of the operation will walk you through it unprompted. Providers who aren’t will change the subject back to features.
One more thing worth checking before you sign: what happens if the relationship ends. Do you own your data and configurations outright, or does leaving mean a scramble to extract your own information from a system the provider controls? A provider confident in their own value doesn’t need to make an exit painful to keep you around.
Red flags worth walking away from
A few patterns show up often enough to be worth naming plainly. A provider who can’t describe their incident response process in specific steps, who talks about security in marketing language instead of naming what they actually monitor and patch, who won’t give you a reference client of a similar size, or who gets cagey when you ask what percentage of tickets get resolved on first contact. None of these individually is disqualifying. Together, they’re a pattern.
None of this is about finding a perfect provider, because that doesn’t exist. It’s about finding one who’ll tell you the unflattering truth before you sign rather than after. Ask about the thing they’d rather you didn’t ask about. The answer, or the dodge, tells you what you’re actually buying.