Buying an IT business or MSP: what to check in the numbers
Short answer
When buying an IT services business or managed service provider (MSP), separate recurring managed-service revenue (monthly per-user or per-device contracts) from project work and hardware resale, then verify each contract's price, term and renewal. Check the cost of the tool stack per seat, technician retention, customer concentration, and the business's security practices and liability exposure, since an MSP has privileged access to every client's systems.
A good MSP is a subscription business with field service attached. A weak one is a collection of handshake deals, underpriced contracts and a tool bill that grows faster than revenue.
Split the revenue
| Revenue type | Quality | What to check |
|---|---|---|
| Managed services (per user/device, monthly) | Highest | Signed agreements, term, auto-renewal, price increase clauses |
| Licensing resale (software subscriptions) | Recurring, thin margin | Who owns the vendor relationship |
| Projects (migrations, installs) | Lumpy | Pipeline; one-off vs repeat |
| Hardware resale | Low margin | Strip out when judging growth |
| Break-fix hourly | Unpredictable | Trend: often declining |
Worked example: margin by contract
MSP contracts are priced per user or per device, and each seat carries a stack of tool costs (remote monitoring, endpoint security, backup, email security, documentation) plus technician time. Older contracts were often priced before tool costs rose. The company-level margin can look fine while a handful of large, old contracts lose money.
Illustrative example, not a real MSP or market price
Client X pays $110 per user per month for 80 users: $8,800 a month. Tools cost $32 per user, so $2,560. Ticket data shows about 55 technician hours a month on X; at a loaded cost of $60 an hour that's $3,300. Contribution: $8,800 − $2,560 − $3,300 = $2,940, or 33%. Client Y pays $75 per user for 120 users: $9,000. Tools are the same $32 per user, $3,840, and Y uses 90 hours, $5,400. Contribution: $9,000 − $3,840 − $5,400 = −$240. Y is the bigger client and loses money every month. Repricing it is the obvious fix, and also the moment it's most likely to leave.
Add-back traps
- Owner is the senior engineer who handles escalations and key clients. Budget a replacement.
- Tool costs called "one-time" during a platform switch that never quite finishes.
- Unbilled work: clients receiving services outside their contract for free, which you'll either have to keep giving or risk losing them.
Documents to request
- Every client agreement; monthly recurring revenue by client for 24+ months.
- PSA/ticketing data: tickets and time by client.
- Vendor invoices for the tool stack; per-seat costs.
- Technician list, certifications, tenure, pay, non-solicits.
- Security policies, incident history, cyber and E&O insurance.
- Admin credentials inventory and how it will be transferred securely.
Watch concentration closely; one large client leaving can take a third of an MSP's profit. See customer concentration.
Vendor agreements, compliance and the admin keys
An MSP resells software and services under partner agreements that often can't be assigned to a new owner without the vendor's consent, and some require the buyer to re-enroll. List every vendor agreement, the tier or discount level it carries, and what happens on a change of control. Then look at the clients' own obligations: healthcare clients bring HIPAA, which usually means the MSP has signed business associate agreements; clients covered by the FTC Safeguards Rule (tax preparers, lenders, some dealers) need their service providers to protect customer data. Those contracts carry liability that comes with the business in a stock purchase and may follow it in an asset deal. Finally, the credentials: an MSP holds privileged access to every client. Plan exactly how admin accounts, password vaults and MFA tokens move to you on closing day, and rotate them afterward.
What an SBA lender will check
Lenders like recurring revenue but will verify it against tax returns and IRS transcripts and look for concentration: one client at a large share of revenue is a common reason for tighter terms. They'll ask who handles escalations and the big client relationships after the seller leaves, and they'll want evidence of cyber and errors-and-omissions insurance. Under SBA change-of-ownership rules the seller can consult for a limited period but can't stay on as an employee.
What moves the value of an MSP
We don't value deals or publish multiples we can't verify. These are the factors appraisers and lenders weigh for IT service businesses:
| Factor | Supports a higher value | Pulls it lower |
|---|---|---|
| Recurring share | Most gross profit from managed contracts | Projects and hardware dominate |
| Contract quality | Signed, auto-renewing, with price escalators | Handshake deals, month to month |
| Margin per seat | Known by client, repriced regularly | Unknown; old contracts underwater |
| Concentration | No client a large share | One client dominates |
| Team | Engineers handle escalations | Owner is the senior engineer |
| Security posture | Documented controls, clean incident history, insurance | Shared admin passwords, past incidents |
Red flags specific to IT service businesses
- Tool seat counts that don't match billed seats. It means leakage or under-billing.
- Licensing resale counted as recurring margin without vendor invoices to show the actual spread.
- Clients with expired or missing agreements. Many small MSPs never re-signed early clients.
- Tickets concentrated on one engineer. If one person resolves most escalations, they're a key-person risk.
- Backups never test-restored. Ask for the last restore test per client; a failed backup after closing is your problem.
- No cyber insurance, or a policy with exclusions for the MSP's own tools.
The first 90 days after you buy
Security first: take control of every admin account, password vault, remote-management console and vendor portal on closing day, then rotate credentials. Meet the largest clients with the seller in the first weeks. Keep the help desk, engineers and service levels the same. Then do the contract-margin analysis for every client and plan repricing for the ones that lose money, starting with the conversations least likely to cost you a good client.
Documents to request, in one list
- Every client agreement with term, notice, pricing and assignment clauses.
- MRR by client by month for 24 months, from the billing system.
- Ticket and time data by client from the service management system.
- Vendor invoices for every tool and licence, with seat counts.
- Vendor and distributor partner agreements and their change-of-control terms.
- Technician roster with certifications, tenure, pay and agreements.
- Security policies, incident history, backup test records, cyber and E&O insurance.
- Tax returns, financial statements and bank statements.
Questions to ask the seller
- What is MRR by client for each of the last 24 months, and which clients left or downsized?
- When did you last raise prices, and which contracts haven't been repriced in three years?
- Which vendor agreements need consent to transfer?
- Have you or any client had a security incident, ransomware event or insurance claim?
- Which clients would call you personally rather than the help desk?
- Are any technicians contractors, and do any have non-solicits?
Security incidents: the liability that comes with the client list
A managed service provider usually holds administrative access to every client's systems. If a client was breached through that access before you bought, the claim can follow the business. Ask the seller, in writing, about every security incident in the last three years, how it was handled and whether any client or insurer made a claim. Get the cyber and errors and omissions policies, the claims history and the renewal application, which often contains answers about controls that the seller has already signed. In an asset purchase, have your attorney address pre-closing incidents in the indemnity and consider whether a tail policy is needed.
Frequently asked questions
What makes an MSP valuable?
Recurring managed-service contracts with good margins after tool costs, many clients, long tenure, documented processes, and technicians who'll stay.
How do I check MSP margins?
Compare each contract's monthly revenue with the per-seat cost of the tools it uses (monitoring, security, backup, licensing) plus technician time. Some old contracts are underpriced.
What's the security risk in buying an MSP?
MSPs hold administrative access to client systems. A past breach, weak access controls or missing insurance can become your liability. Review incidents, practices and cyber insurance.
Is hardware resale revenue worth much?
Usually low margin and lumpy. Separate it from recurring revenue when you look at earnings and growth.
How do I verify an MSP's monthly recurring revenue?
Rebuild it from signed agreements: seats or devices times price for each client, and compare with invoices from the billing system and payments in the bank for at least 12 months. Then compare seat counts with the tool vendors' invoices; if the MSP bills 1,000 seats but pays for 1,300 seats of security software, either clients are under-billed or the margin is worse than it looks.
How should an MSP acquisition handle client contracts that aren't assignable?
Read the assignment and change-of-control clauses first. In an asset purchase, contracts that need consent have to be assigned with each client's agreement, which is also a chance to re-sign them on current terms. In a stock purchase, contracts usually stay with the entity, but change-of-control clauses can still give clients an exit. Your attorney should map each major contract before you choose a structure.
Sources
- SBA SOP 50 10 8.1, Appendix 15 (QoE: customer concentration, contract continuity)
- FTC Safeguards Rule, 16 CFR Part 314 (may apply to clients, and flows down to service providers)
- HHS: HIPAA privacy, security and breach notification rules (45 CFR Part 164)
- IRS: Independent contractor or employee?
Related guides
General information, not legal, tax, financial or investment advice. Rules and lender practices change; check the linked sources and talk to your attorney, CPA and lender about your deal. Examples with named numbers are illustrations, not real businesses. OKtoBuy's Deal Check does not value businesses or give price opinions.