Is My MSP Overcharging? 5 Checks a CFO Can Run Before Renewal

Your MSP may be overcharging if your all-in cost per seat sits above market bands, projects and after-hours work are billed on top of the fixed fee, licences carry undisclosed margin, or escalators and auto-renewal clauses lift the price each year. A CFO can test most of it from invoices and contracts in an afternoon.

If you are asking whether your managed service provider is overcharging, you probably already have a reason. The invoice has crept up, a board member has asked what you get for it, or a renewal is coming and nobody can show you evidence either way. I have spent 20+ years running independent technology reviews, after executive careers as a CIO, CTO and COO. This article is written for finance, not for IT.

Most of the suspicion can be tested with invoices, the contract and a licence report. Some questions cannot. Below are five checks, where each one stops, and when an MSP audit settles what a spreadsheet cannot. My starting position is simple: when your advisor profits from your spend, they are not your advisor.

Key Takeaways

• Mid-market organisations are the most exposed to MSP overcharging because the provider is often their only strategic voice.
• Work out your true all-in cost per seat from every invoice, then compare it against market bands rather than last year's bill.
• Recurring projects, after-hours work and out-of-scope tickets mean the fixed fee is not fixed.
• Reconcile licences against active users and ask for the provider's cost price in writing.
• Waiting for renewal to review the contract means paying for escalators, misalignment and security drift in the meantime.
• Service quality, security posture and stack fit need an independent review. A review by the provider that profits from remediation is not independent.

Summary Table: The Five Checks at a Glance

Why are mid-market organisations most exposed to MSP overcharging?

Mid-market organisations with 50 to 250 seats are most exposed because they are too big to run IT on goodwill and too small to commission a big-firm assessment. The managed service provider ends up as the only strategic voice: it runs the systems, writes the service reports and quotes the remediation.

Consider how that plays out. The provider tells you the environment needs a security upgrade. The same provider scopes it, prices it and delivers it. When the quarterly report says service levels were met, the provider wrote that report. Nobody in the chain has anything to gain from telling you the arrangement is too expensive or no longer fits.

This is a structural conflict, not a character flaw. Most providers are not acting in bad faith. But an incentive that points one way will shape advice even when everyone means well. Who audits your IT provider? In most mid-market organisations, nobody does.

The result is a finance team that sees a growing line item with no way to test it. You cannot judge a technical argument, so you either accept it or argue on price alone. Neither position is strong. The five checks below give you a third option: evidence you can gather yourself.

Check one: what is your true all-in cost per seat?

Your true cost per seat is every dollar paid to the provider over twelve months, divided by the number of people who actually use your systems. Include the monthly fee, licences, projects, after-hours work, hardware rental and security add-ons. Then compare that single number against market bands, not against last year's invoice.

The contract rate is rarely the real rate. The managed services fee is the headline, and the extras sit elsewhere. Here is the method:

1. Collect twelve months of every invoice from the provider, including those paid by card or coded to other cost centres.
2. Group the lines: managed services fee, resold licences and subscriptions, projects and time-and-materials work, after-hours and call-outs, hardware rental or lease, security and backup add-ons, and bundled telephony or connectivity.
3. Add them up.
4. Divide by active headcount, meaning people who log in, not licences sold or the seat count written into the contract.

The result is your all-in cost per seat. Put it into the IT spend benchmark tool to see where it sits against market bands for organisations of your size.

A few cautions keep the comparison fair:

• Compare like with like. A fee that includes security monitoring, onsite support and extended helpdesk hours is not comparable to a remote-only service.
• Sector matters. Health and aged care, financial services and education carry compliance loads that legitimately raise the cost of service.
• Trend matters as much as level. If headcount is flat or falling and the all-in figure keeps rising, ask what changed.
• Cheap is not the goal. A low per-seat rate with thin service is a risk, not a saving.

A number above the band is a prompt for questions, not proof of overcharging. It tells you where to look in checks two to four.

Check two: is scope creep inflating the invoice?

Scope creep shows up as charges on top of the fixed fee: projects, after-hours work and tickets the provider calls out of scope. Sort every invoice line into fixed fee or extra, then compare the extras against the contract schedule. If the extras recur month after month, the fixed fee is not fixed.

The patterns are consistent. Look for these:

• Routine work billed as projects. New starter setup, standard patching or minor firewall changes appearing as separate quotes.
• After-hours charges the provider chose. Maintenance windows scheduled out of hours by the provider, then billed at after-hours rates.
• A vague definition of out of scope. If the contract says reasonable use or standard requests without defining them, the provider decides what counts.
• Uncapped time-and-materials work. Hours billed with no estimate, no approval and no cap.
• Minimum billing blocks. A ten-minute task billed as a half hour or more.

Ask the provider for a one-page statement of what the fixed fee includes and excludes. Ask for ticket-level data behind any extra charge. If they cannot produce either quickly, that is information in itself.

Genuine projects exist, and a good provider quotes them. The test is whether each one had a written scope, an approved price and a business reason. Charges that nobody in your organisation remembers approving belong on a list for discussion.

Check three: are licences billed with margin you cannot see?

Licences carry margin when the provider resells Microsoft 365 and other subscriptions above its own cost. Reselling is legitimate. The test is whether you pay for licences nobody uses and whether you have seen the cost price. Reconcile assigned licences against active users, then ask for the cost price in writing.

This is the check where finance teams most often find money. Licences are bought when someone starts and rarely removed when someone leaves. The reconciliation takes an hour:

1. Get the licence count from the provider's invoice.
2. Get the assigned licence list from your Microsoft 365 tenant. The Microsoft 365 admin centre reports include user activity, and your provider can export it.
3. Compare the invoiced count, the assigned count and the count of users active in the last quarter.
4. Check the plan tier. Staff on a higher tier than their role needs are a common source of waste.
5. Cross-check against your HR list of current employees.

Repeat for every other per-seat or per-device subscription: endpoint protection, backup, remote monitoring, email security and telephony.

Then ask three questions in writing. What is your cost price for each licence? What margin or management fee do you add? Can the tenancy be moved to be billed directly or through another partner? A provider that treats these as reasonable questions is usually a provider with nothing awkward to hide. Evidence, not reassurance.

Check four: what do escalators and auto-renewal clauses cost you before renewal?

Escalators and auto-renewal clauses raise your price without a decision. Look for annual uplifts tied to CPI or a fixed percentage, one-way seat true-ups, minimum terms and notice windows that close months before the end date. Mark each clause with its dollar effect over the term, and diarise the notice date.

Read the contract for these terms specifically:

• Annual uplift. Is it CPI, a fixed percentage or at the provider's discretion?
• Seat true-ups. Does the fee go up when headcount rises but never come down when it falls?
• Auto-renewal. What happens if nobody gives notice, and how long is the renewal term?
• Notice window. On what date must notice be given, and in what form?
• Early termination. What does leaving before the end date cost?
• Price changes mid-term. Can the provider vary rates, and with how much warning?

Some of these terms may be open to challenge. The ACCC publishes guidance on unfair contract terms in standard form contracts, and protections can extend to some small businesses. Whether your contract qualifies depends on your circumstances, so take legal advice before relying on it.

Why waiting for the renewal date is the expensive option

The common advice is to review the arrangement when renewal comes up. I disagree. By the time the renewal is on your desk, the notice window may have closed, switching takes months and your leverage is gone.

Meanwhile, you have paid for drift every year of the term. Headcount changed, a new site opened and a new cloud application arrived, but the contract did not move with them. Escalators compounded. Security controls that were right at signing were not maintained against current guidance such as the ASD Essential Eight. Waiting for the renewal trigger means paying for undetected misalignment, escalators and security drift in the meantime.

Run checks one to four once a year, mid-term, when you still have room to negotiate. Treat the renewal as the end of a process, not the start of one.

Check five: how hard would it be to leave your provider?

Exit risk is how hard and costly it would be to leave. Ask three questions: who holds the administrator credentials, who owns the licence tenancy and domain registration, and who owns the network and system documentation? If the answers are unclear, your negotiating position is weaker than the invoice suggests.

You do not need technical knowledge to ask. Put these in an email to the provider and see how quickly the answers come back:

• Can we have a list of all administrator accounts and who controls them?
• In whose name are the Microsoft 365 tenancy, domain names and key subscriptions registered?
• Do we hold a current copy of network diagrams, system documentation and backup configuration?
• What does the contract say about exit assistance and handover, and is it priced?

A provider that holds the only keys is not necessarily acting in bad faith. But dependency has a price, and you pay it at renewal when you cannot credibly walk away. Without a real exit option, every other negotiating point loses weight.

What can't a CFO settle without an independent review?

A CFO cannot settle service quality against SLA, security posture or whether the stack fits the business from invoices alone. Those need technical verification against evidence the provider does not volunteer. A review run by the provider that profits from remediation is not independent, however well meant.

The five checks tell you whether you are paying a fair price for what is written down. They do not tell you whether what is written down is what you need. Three questions remain:

• Is service meeting the SLA in practice? The provider's own report says yes or no. Verifying it means testing ticket data, response times and recurring faults against the contract, not accepting the summary.
• Is your security posture what it was reported to be? This needs technical review of configuration, backups, access and recovery, not a status colour on a dashboard.
• Does the stack still fit the business? An architecture that suited 60 staff may constrain 160. Only someone looking from the business outward can say.

The common answer is to ask the provider for a free assessment or a quarterly review. It is a reasonable-sounding idea with a structural problem. The party that runs your IT writes the report card on how it is running and quotes the fix. That is why independent evidence matters. We mark their homework.

In one review I ran for a fast-growing professional services firm, the question was simple: were they overpaying their MSP? We benchmarked cost and service against comparable organisations and reviewed the cyber risk profile the incumbent had been reporting on. The firm had outgrown the arrangement, and it carried a degraded cyber risk profile the incumbent had never surfaced. It moved to a new provider with a scalable architecture and a board-endorsed roadmap. The invoice was never the main problem.

When overcharging is not the answer: sometimes the right call is to keep your MSP

Independent audits do not always find a villain, and mine do not try to. Sometimes the answer is: keep your MSP. A fixed fee with no remediation revenue removes any reason to manufacture findings, so the report can say the provider is good value and mean it.

Here is a view you will not find on the vendor blogs that rank for this question. Suspected overcharging usually has one of three causes, and only one of them involves overcharging:

1. The provider is charging above market. This happens, and the first four checks usually expose it.
2. The price is fair but the arrangement has drifted. The business changed and the contract did not. The invoice looks wrong because the fit is wrong.
3. The provider is good value. The frustration comes from an unmet expectation or a poor internal process, not from the price.

A board asked us for independent assurance on single-vendor risk with its MSP. We benchmarked the incumbent's cost and service and reviewed dependency and exit risk. The incumbent was delivering below-benchmark cost. The real findings were sustainability and agility risks. The board planned around the truth rather than a villain.

That result is useful. It protected the relationship, gave the board an evidence base and pointed investment at the real exposure. Walking into a renewal with a conclusion that the price is fair is just as valuable as walking in with a list of reductions. Both are better than walking in with a hunch.

How do you book an independent MSP audit before your next renewal?

An MSP Audit gives you independent evidence before you sign or give notice. We benchmark cost and service, verify security and review dependency, then deliver a Risk Register, a Cost-Out Ledger, a Vendor Hit List and 15+ ranked recommendations. We sell no technology, so the findings have no agenda.

The MSP Audit is a scoped variant of our 4-Week Commercial IT Health Check. If you want cost, risk and governance covered together, the Health Check is the full engagement. It runs in four weeks: evidence collection (contracts, invoices, licence reports, tickets), benchmark and verification, validation of findings with your stakeholders, and board-ready delivery.

Every finding carries its evidence and its arithmetic, so you and your board can test it rather than trust it. For scale, an independent school ICT review we ran produced 17 board-ready recommendations across governance, architecture and technical areas, plus an objective baseline for later investment decisions.

The Health Check is priced and published at $8,000 to $15,000 ex GST by seat count on the pricing page. It carries a written guarantee: if the audit does not identify value improvement worth at least twice the fee, the fee is refunded in full. We also take no referral fees and sell no managed services or licensing, so nothing we recommend earns us anything.

Book an MSP Audit before your next renewal, while you still have the leverage that evidence provides.

References

• Microsoft, Microsoft 365 Reports in the admin centre
• Australian Signals Directorate, Essential Eight
• ACCC, Unfair contract terms
• Agility Next, Pricing