We Need Someone to Tell Us What to Do About Our IT, Not Sell Us a Monthly Contract. Who Does That?

The owner of a 19-person civil engineering and surveying firm in Hermitage had three problems land on her desk in the same month. The file server in the back room, the one holding twenty years of drawings, was seven years old and making a noise. A township client sent over a vendor security questionnaire that asked about multi-factor authentication, backups, and incident response. And the lease on the second floor was up in the spring, which meant the firm might be moving anyway.

She did not want a sales pitch. She wanted someone to sit down, look at what the firm actually had, and tell her what to do first. That is the situation IT consulting for small business exists for, and it is a different thing from hiring a company to run your IT every month. This post (a composite of the engagements we see most often in Mercer, Lawrence, and Butler counties) walks through what a small business IT consultant does, when consulting makes more sense than a managed contract, and how to tell whether the advice you are getting is actually independent.

What does an IT consultant for a small business actually do?

A good IT consultant answers the questions your business cannot answer on its own, and writes the answers down. The work is mostly diagnosis and planning, not fixing printers.

In practice, a small business IT consulting engagement usually covers some mix of these:

• An honest inventory. What you own, how old it is, what it runs on, who has the passwords, and which vendor contracts renew when. Most businesses with under 50 people have never seen this on one page.
• Risk ranking. Which problems could actually stop the business (a single server with no tested backup, email accounts without multi-factor authentication, a former employee who still has access) and which are just annoying.
• Decisions with trade-offs spelled out. Replace the server or move the files to the cloud? Keep the old phone system or switch? Rewire the new office or use what the landlord left? A consultant lays out the options, the rough effort, and what happens if you wait.
• A roadmap. A sequenced plan for the next 12 to 36 months, tied to the things you already know are coming: a lease renewal, a new hire wave, a cyber insurance renewal, an equipment replacement cycle.
• Vendor sorting. Most small offices carry a dozen or more technology vendors that the office manager has been quietly juggling. A consultant figures out which ones overlap, which ones are underperforming, and which contracts have exit dates coming up.

Larger companies get this from a chief information officer. Small businesses get it from an outside consultant, sometimes called a virtual CIO or vCIO, who does the same thinking on a part-time basis. Our IT consulting and vCIO service is built around exactly that kind of planning work. The security half of that job has its own name, a virtual CISO, and we explain when a small business needs one in our post on virtual CISO services.

Is IT consulting the same thing as managed IT services?

No, and the difference matters when you are deciding what to buy.

Managed IT is ongoing operations. A provider monitors your machines, patches them, watches security alerts, answers the help desk, and keeps the backups running, usually for a flat monthly fee. We explain that model in detail in our guide to managed IT services for small businesses. IT consulting is judgment applied to a decision or a plan. It can be a one-time project (tell us what to do about the server), a scoped engagement (plan and oversee our office move), or a recurring advisory relationship (meet with us every quarter and keep the roadmap current).

Plenty of businesses need both eventually. But they do not always need them at the same time, and they do not always need them in that order. A firm with a capable office manager and a fairly simple setup may only need a consultant to make two or three big calls a year. A firm that just lost its only IT person probably needs operational coverage first and strategy second. If you already have someone in-house who handles the day-to-day, the middle ground is co-managed IT, where an outside team supplements your person instead of replacing them.

The warning sign is a "consultation" that only ever ends one way. If every free consultation you sit through concludes that you need the provider's monthly plan, you are not getting consulting. You are getting a sales meeting with a nicer name.

When does a small business need IT consulting instead of more support?

Consulting earns its keep at decision points, the moments where a wrong call is expensive and hard to undo. The ones we see most often in Western Pennsylvania and eastern Ohio:

• Aging core equipment. A server or firewall past its supported life, or workstations still running Windows 10, which reached end of support in October 2025. The question is not just "replace it" but "replace it with what, and in what order."
• An office move or expansion. Cabling, internet carriers, Wi-Fi coverage, phones, and security cameras all have lead times. Planning them after the lease is signed is how firms end up working off a hotspot for the first two weeks.
• A security questionnaire you cannot answer. From a cyber insurance carrier, a bank, a large customer, or a public-sector client. Answering honestly requires knowing what you actually have in place.
• A new line-of-business system. New practice management software, a new ERP at a manufacturer, a new estimating platform. The software vendor will sell you the software. They will not tell you whether your network, devices, and backups are ready for it.
• An acquisition or a partner exit. Two sets of computers, email systems, and vendor contracts that now need to become one, or one set that needs to be separated cleanly.
• A frustrating provider relationship. You are not sure whether your current IT company is doing a good job, and you want an outside read before you decide anything. Our guide on how to choose an IT company covers the questions to ask once you decide to look.

Regulated businesses hit these decision points harder. A medical office has HIPAA obligations around any system that touches patient data. Accounting and tax practices fall under the FTC Safeguards Rule, which expects a written information security program. A retailer or restaurant taking cards has PCI requirements tied to its payment setup. In each case, a technology decision is also a compliance decision, and a consultant should be able to tell you where the two meet.

How is small business IT consulting usually priced and structured?

There are three common shapes, and the right one depends on how often you have decisions to make.

Project-based. A defined scope (assess the environment and recommend a server replacement plan, or plan and manage the office move) with a defined deliverable. This fits businesses with one big decision in front of them. Ask for the deliverable in writing before work starts, so you know you will walk away with a document and not just a conversation. Hourly or block-of-hours. Useful for occasional questions, a second opinion on a vendor quote, or help reading a contract. The risk is that nobody owns the big picture between calls. Recurring advisory (vCIO). A scheduled review, often quarterly, where someone walks your leadership through what changed, what is coming, and what the budget looks like for the next year. This is usually paired with managed IT, but it does not have to be.

What drives the cost up or down is mostly scope: the number of people and locations, how many systems are involved, whether compliance documentation is part of the job, and how much of the follow-through (actually doing the work) the consultant carries versus handing to someone else. We do not quote consulting on the first call, because the honest answer depends on what we find. If you want a sense of how flat-fee managed IT is priced for comparison, our post on managed IT services pricing breaks down the common models.

How do you tell if an IT consultant is really a salesperson?

A lot of small business IT consulting is quietly paid for by vendors. Resellers earn margin on licenses, hardware makers pay marketing funds, and some software and telecom companies pay referral fees. None of that is illegal, but it means the recommendation can lean toward whoever pays the consultant rather than whoever fits your business.

A few questions sort this out quickly:

1. Do you receive any commission, referral fee, or vendor funding on what you recommend? Ask for the answer in writing. An independent consultant will put it in writing without hesitation.

2. What would you recommend if we did nothing for a year? A good consultant can tell you which problems can safely wait. A salesperson finds urgency in everything.

3. Will you show us at least two options for each major decision? Recommendations should come with alternatives and the reasons one beats the other for your situation.

4. What do we own at the end? The roadmap, the inventory, the network diagram, and the passwords should belong to you, in a format you can hand to anyone.

5. Can we act on your recommendations with another provider? If the answer is no, or a long pause, the consultation was a funnel.

We built our consulting practice around not taking vendor commissions, and we will confirm that in writing for any engagement. But the bigger point is that you should ask every consultant, including us.

What should you walk away with after an IT consulting engagement?

Whatever the size of the engagement, you should end up with something on paper that is still useful after the consultant leaves. At a minimum:

• A current inventory of devices, systems, accounts, and vendor contracts
• A ranked list of risks, each with a plain-English explanation of what could happen
• Recommendations for the decisions in front of you, with options and trade-offs
• A sequenced roadmap with rough timing tied to your business calendar
• Clear notes on what you can handle internally and what needs outside help

Most engagements start the same way an assessment does, with a walkthrough of the office and a conversation with whoever handles IT today. If you want to know what that first meeting looks like, we wrote up what to expect from an IT assessment.

What happened at the Hermitage engineering firm?

The assessment took an afternoon on site and a follow-up call. The noisy server was real, but it was not the most urgent problem. The backup copied the server to an external drive that sat on top of the server, so a fire, a flood, or ransomware would have taken both. Two former employees still had working email accounts. Nobody used multi-factor authentication, which was the first question on the township's questionnaire.

The recommendations came in order. First, fix the backup with an off-site copy and run a test restore, before touching anything else. Second, turn on multi-factor authentication and close the stale accounts, which let the owner answer the questionnaire honestly within two weeks. Third, do not buy a new server in a building the firm might leave in six months. Move the active project files to cloud storage with the large drawing archive kept on a small local device, and plan the cabling and internet for the new office as part of the lease decision instead of after it.

The firm did the first two steps with its office manager and a few hours of outside help. The move happened the following spring, with the network ready the day the desks arrived.

That is what IT consulting for small business should feel like: fewer surprises, decisions made in the right order, and a plan you can actually follow.

MCR Business Tech Solutions provides independent IT consulting and vCIO planning for small and mid-sized businesses across Mercer, Lawrence, Butler, Crawford, Erie, and Allegheny counties in Western Pennsylvania, and Trumbull and Mahoning counties in eastern Ohio. Whether you need a one-time plan or a long-term partner, call 833-859-9021 or Request an IT assessment through our contact page. We will start by finding out what you have, what is coming, and what actually needs to happen first.