A managed IT services agreement for a CPA firm should clearly define at least seven areas: proactive IT management, reactive support, Microsoft 365 and cloud administration, cybersecurity responsibilities, backup and business continuity, strategic planning, and services that are excluded or billed separately.
For a CPA firm with 10 to 50 employees, the agreement should do more than list technical services. It should explain who is responsible for what, how employees receive support, what happens during tax season, which costs are predictable, and where additional charges may occur.
That last point is especially important.
Two managed IT proposals can have similar monthly prices while providing very different levels of service.
The goal isn't to find the agreement with the longest list of features.
It's to find an agreement whose scope, responsibilities, service model, and pricing structure match the way your CPA firm actually operates.
Why the Managed IT Agreement Matters More Than the Monthly Price
When CPA firms compare managed IT providers, price naturally gets attention.
If one provider proposes $4,500 per month and another proposes $5,500, leadership understandably wants to know what justifies the additional $1,000.
But the monthly number by itself doesn't answer that question.
You need to understand what's behind it.
For example, does the agreement include:
- Proactive monitoring and maintenance?
- Employee help desk support?
- Server management?
- Microsoft 365 administration?
- Network management?
- Onsite support?
- After-hours support?
- Vendor coordination?
- Technology planning?
- New employee setup?
- Projects?
- Cybersecurity?
- Backup and disaster recovery?
And just as importantly:
What isn't included?
A lower-priced agreement may still be an excellent fit if the firm doesn't need certain services.
A higher-priced agreement may provide greater value if it includes services the firm would otherwise purchase separately.
The problem occurs when firms compare proposals without understanding those differences.
Start With the Annual Cost, Not Just the Monthly Number
For planning purposes, managed IT services for a CPA firm in our target market may commonly fall around $150 to $300 per user per month, depending on the environment and service model.
Using that planning range:
| Firm Size | Estimated Monthly Managed IT | Estimated Annual Managed IT |
| 10 users | $1,500–$3,000 | $18,000–$36,000 |
| 25 users | $3,750–$7,500 | $45,000–$90,000 |
| 50 users | $7,500–$15,000 | $90,000–$180,000 |
These figures are useful for budgeting, but they are not quotations. Actual pricing depends on the firm's technology environment, support requirements, infrastructure, service model, and scope.
Cybersecurity, licensing, backup services, hardware, projects, and other technology costs may also be separate.
That is exactly why understanding the agreement matters.
A CPA firm shouldn't ask only:
"What is the monthly price?"
It should also ask:
"What responsibilities are we transferring to the technology provider for that price?"
A Practical Framework for Reviewing a Managed IT Agreement
When reviewing a proposal or contract, we recommend organizing the services into seven categories:
- Proactive IT Management
- Reactive Support
- Microsoft 365, Infrastructure & Cloud Administration
- Cybersecurity Responsibilities
- Backup & Business Continuity
- Strategic Planning & Technology Lifecycle
- Projects, Exclusions & Additional Charges
This makes proposals easier to compare because it shifts the discussion away from marketing terminology.
One provider may call something "Complete IT Management."
Another may call it "Unlimited Managed Services."
Another may use terms such as "Essential," "Premium," or "Platinum."
Those names don't tell you much.
The actual responsibilities do.
-
What Proactive IT Management Should Be Included?
One of the fundamental purposes of managed IT is to identify and address routine technology issues before they become larger business problems.
That is the proactive side of the agreement.
Depending on the environment, proactive management may include:
- Workstation monitoring
- Server monitoring
- Operating system patching
- Routine maintenance
- Network monitoring
- Firewall monitoring
- Infrastructure health reviews
- Storage monitoring
- Performance monitoring
- Backup monitoring
- Documentation
- Technology inventory
- Vendor coordination
The exact scope will vary.
What matters is that the agreement clearly explains which systems the provider is responsible for managing.
Which Devices Are Actually Covered?
This sounds obvious, but it's worth asking.
Imagine a 25-person CPA firm with:
- 25 employee workstations
- 2 conference-room computers
- 1 server
- 1 firewall
- 4 network switches
- 6 wireless access points
- Several multifunction printers
- Remote employees
- A backup appliance
Which of those systems are covered by the agreement?
Don't assume.
Some providers price primarily by user. Others price by device. Some combine users, servers, locations, and infrastructure.
A clear agreement should make it possible to determine what is being managed and what isn't.
Proactive Maintenance Should Have a Purpose
Monitoring isn't valuable simply because software is collecting alerts.
The provider should have a process for acting on useful information.
For example:
If a server's available storage is steadily declining, someone should identify that trend before the drive becomes full.
If a workstation repeatedly fails an operating system update, that should eventually be investigated.
If a backup job fails, someone should know.
If a network device is approaching the end of its useful life, that should make its way into future planning.
The goal isn't to eliminate every technology problem.
That's unrealistic.
The goal is to reduce avoidable surprises.
Proactive Management Is Particularly Important Before Tax Season
CPA firms have an additional reason to care about proactive maintenance:
their tolerance for disruption changes throughout the year.
An issue discovered in November may be manageable.
The same issue discovered during a major filing deadline may have a much greater business impact.
A technology partner should therefore understand the firm's calendar.
Before busy season, it may make sense to review areas such as:
- Server health and available capacity
- Workstation health
- Operating system updates
- Tax application requirements
- Network performance
- Internet connectivity
- Remote-access systems
- Backup status
- Microsoft 365
- Employee accounts
- Seasonal employee needs
- Critical vendor contacts
Not every item needs to appear individually in the managed services contract.
But the agreement should establish enough responsibility that the provider is proactively managing the environment rather than simply waiting for support requests.
Technology Partner Tip
Ask a prospective provider: "What work will you perform every month even if none of our employees submits a support ticket?"
The answer can reveal a great deal about how proactive the service actually is.
-
How Should Reactive Help Desk Support Work?
Proactive management is only half of the relationship.
Employees will still need help.
Someone will forget a password.
A printer will stop working.
An application won't launch.
An employee will have trouble accessing email.
A tax software update may create an unexpected issue.
A remote employee may be unable to connect.
That's where reactive support comes in.
A managed IT agreement should explain how employees request assistance and how that assistance is billed.
At minimum, understand:
- Help desk hours
- Methods for requesting support
- Response expectations
- Escalation procedures
- After-hours procedures
- Onsite support terms
- Remote support terms
- Which users are covered
- Which locations are covered
- How third-party software issues are handled
- Whether reactive labor is included, limited, or billed separately
"Unlimited Support" Deserves a Second Question
Many MSP agreements advertise unlimited support.
That can be a perfectly legitimate service model.
But the word unlimited shouldn't end the conversation.
Ask:
"What work is not considered support under this agreement?"
For example, an agreement might include troubleshooting an employee's existing computer but treat replacing that computer as a project.
It might include troubleshooting Microsoft 365 but not a tenant migration.
It might include normal remote support but charge separately for after-hours onsite work.
It might include maintaining an existing network but exclude cabling for an office expansion.
None of those exclusions is inherently unreasonable.
What matters is whether they're clear.
Predictable boundaries are better than ambiguous promises.
Understand the Difference Between Support and Projects
This is one of the most important distinctions in a managed IT agreement.
Routine support typically addresses the firm's existing environment.
Projects make a meaningful change to that environment.
Examples of projects may include:
- Replacing a server
- Migrating to a hosted environment
- Moving offices
- Installing a new network
- Deploying a new accounting application
- Migrating Microsoft 365
- Replacing large numbers of computers
- Implementing a new phone system
- Major security initiatives
- Mergers and acquisitions
A managed IT provider may include some project labor in its agreement, discount project rates, provide a block of labor hours, or bill projects completely separately.
There is no universally correct model.
But CPA firms should understand the distinction before signing.
Otherwise, an "all-inclusive" agreement can become much less inclusive than expected when the firm undertakes a major technology initiative.
How ANAX Structures Managed IT Support
At ANAX Business Technology, we don't assume every organization should purchase managed IT the same way.
We offer three service models that create different balances between proactive management, reactive support, and cost predictability.
Comprehensive Support Agreement (CSA)
The Comprehensive Support Agreement, or CSA, is closest to the traditional full-service managed IT model.
It combines proactive technology management with reactive help desk support under a recurring agreement.
This model may be appropriate for firms that want broad day-to-day support incorporated into their managed services relationship and prefer a high degree of predictability.
Block Labor & Services Agreement (BSA)
The Block Labor & Services Agreement, or BSA, combines fully covered proactive maintenance and management with a block of labor hours that can be used for reactive support.
This is ANAX's most popular service model.
The advantage isn't simply that a BSA may cost less than another model.
Its real value is visibility and control.
The firm can see how much reactive labor it is actually consuming while still receiving proactive management of the technology environment.
For some CPA firms, that provides an effective balance between predictability and flexibility.
Essential Services Agreement (ESA)
The Essential Services Agreement, or ESA, focuses on proactive technology management.
Reactive help desk and support labor are billed separately at a higher hourly rate when needed.
This model may be appropriate for organizations that require proactive management but generate relatively little day-to-day support activity, or that have internal resources capable of handling some employee needs.
The Best Service Model Depends on How Your Firm Uses Support
The question isn't:
"Which agreement sounds the most comprehensive?"
The better question is:
"Which agreement matches our actual support needs?"
Consider two 25-person CPA firms.
Firm A generates frequent employee support requests and wants the greatest possible monthly predictability.
Firm B has technically proficient employees, relatively few support tickets, and primarily wants its infrastructure proactively maintained.
The same service model may not make financial sense for both organizations.
This is why ANAX approaches managed IT consultatively rather than assuming every client belongs in the same package.
A good provider should be able to explain why its recommended agreement structure makes sense for your organization.
-
What Microsoft 365, Server, Network, and Cloud Administration Is Included?
For most CPA firms, the managed IT provider will be responsible for more than employee workstations.
The agreement should explain how the provider handles the broader technology environment.
That may include:
- Microsoft 365 administration
- User account management
- Email administration
- Microsoft licensing coordination
- Servers
- Active Directory or identity services
- Network switches
- Wireless networks
- Firewalls
- Remote access
- Hosted environments
- Cloud infrastructure
- Domain and DNS management
- Internet service provider coordination
This category deserves particular attention because the word "cloud" can obscure who is responsible for what.
Microsoft 365 Management Is More Than Buying Licenses
A CPA firm may use Microsoft 365 for:
- Calendars
- Teams
- OneDrive
- SharePoint
- Office applications
- Identity and authentication
- Device management
- Security features
Purchasing Microsoft 365 licenses doesn't automatically mean those services are properly configured or actively managed.
When reviewing an MSP agreement, ask:
- Who creates and removes user accounts?
- Who assigns licenses?
- Who manages permissions?
- Who configures security settings?
- Who manages multifactor authentication?
- Who reviews administrative access?
- Who helps with Microsoft support cases?
- Who manages SharePoint and OneDrive issues?
- Who handles employee onboarding and offboarding?
The contract doesn't necessarily need to describe every individual administrative task.
But ownership should be clear.
CPA Firms May Still Have Important Server Responsibilities
Many CPA firms in the 10- to 50-employee range still operate servers.
That isn't necessarily evidence of outdated technology.
Some accounting and tax applications continue to rely on traditional Windows infrastructure, and some vendor "cloud" offerings are actually applications delivered through hosted virtual desktops or virtual servers rather than true browser-based SaaS platforms.
A managed IT agreement should therefore clarify responsibility for existing server infrastructure.
Ask whether the provider will manage:
- Operating system updates
- Server health
- Storage capacity
- Hardware monitoring
- User access
- Application dependencies
- Backup coordination
- Vendor troubleshooting
- Lifecycle planning
The provider should also be able to help the firm evaluate the server's future without approaching the decision with a predetermined answer.
Sometimes replacing the server will make sense.
Sometimes moving applications to a hosted environment will make sense.
Sometimes a hybrid strategy will make sense.
Over a five- to seven-year lifecycle, recurring hosting expenses can sometimes exceed the cost of owning appropriately designed server infrastructure. In other situations, the operational flexibility of hosting may justify the additional recurring expense.
The decision should consider both economics and operations.
Cloud isn't a destination. It's a deployment model.
A technology partner's job is to help determine which deployment model best supports the firm's business.
Vendor Coordination Should Be Clearly Defined
CPA firms depend on numerous technology vendors.
Your managed IT provider probably won't be the expert on every tax or accounting application your firm uses.
It shouldn't pretend to be.
What matters is whether the provider will help coordinate technical issues.
Suppose an employee can't access a tax application.
The software vendor says it's a network problem.
The IT provider says it's an application problem.
The employee is stuck between them.
That's exactly the type of situation vendor coordination is intended to solve.
A strong technology partner should be willing to work with appropriate third-party vendors to identify where the problem exists and move the issue toward resolution.
When reviewing an agreement, ask:
"If one of our critical software vendors says the problem is IT-related, will you work directly with that vendor on our behalf?"
For a CPA firm with multiple specialized applications, the answer can materially affect the employee support experience.
-
Is Cybersecurity Included in the Managed IT Agreement?
This is where proposal comparisons can become particularly confusing.
Some providers bundle cybersecurity tools into their managed IT package.
Others offer separate cybersecurity services.
Some advertise "complete cybersecurity" without clearly defining what the phrase means.
Don't evaluate cybersecurity based on the label.
Evaluate the actual controls and responsibilities.
A security program for a CPA firm may involve technologies and services such as:
- Endpoint protection
- Email security
- Multifactor authentication
- Identity protection
- Security awareness training
- Vulnerability management
- DNS or web filtering
- Security monitoring
- Incident response planning
- Access reviews
- Security policies
- Backup and recovery
- Ongoing risk reviews
Not every firm will use exactly the same combination.
The important thing is understanding which protections are in place, who manages them, and what falls outside the managed IT agreement.
Cybersecurity at ANAX Is a Separate Service Bundle
At ANAX, cybersecurity is not automatically bundled into every managed IT agreement.
We treat cybersecurity as a separate service bundle.
There is an important reason for that distinction.
Managed IT and cybersecurity overlap, but they aren't identical disciplines.
Separating the services helps make it clear:
- Which services are part of day-to-day IT operations
- Which controls are specifically part of the cybersecurity program
- What the firm is paying for
- Which risks are being addressed
- Which additional investments may need to be considered
It also helps prevent a dangerous assumption:
"We have an MSP, so cybersecurity must be handled."
Having managed IT services does not automatically mean the organization has an appropriate cybersecurity program.
CPA Firms Should Expect Regulatory Awareness
A technology provider serving CPA firms should also understand that cybersecurity decisions exist within a broader regulatory and professional environment.
The FTC Safeguards Rule under the Gramm-Leach-Bliley Act and IRS guidance for tax professionals provide important context for protecting customer and taxpayer information.
For example, IRS Publication 4557, Safeguarding Taxpayer Data, addresses security considerations for tax professionals.
Depending on the firm's activities and the issue being evaluated, other IRS guidance may also be relevant.
That doesn't mean your MSP should act as your attorney, auditor, or compliance officer.
And installing a collection of security products doesn't automatically make an organization compliant.
But a technology partner serving CPA firms should understand how technical safeguards support the firm's broader information security responsibilities.
The agreement should make the MSP's role clear rather than allowing either party to assume responsibility belongs to someone else.
-
What Backup and Business Continuity Responsibilities Are Included?
Backup is another area where a few words on a proposal can create a false sense of certainty.
A proposal may simply say:
"Backup included."
That leaves a lot of unanswered questions.
What is being backed up?
How frequently?
Where are the backups stored?
Who monitors them?
How long is data retained?
What happens when a backup fails?
Has anyone tested whether the data can actually be restored?
And perhaps most importantly:
How quickly could the firm resume operations after a serious technology failure?
Those questions move the conversation beyond backup and into business continuity and disaster recovery.
Backup, Disaster Recovery, and Business Continuity Are Different
These terms are sometimes used interchangeably, but they address different needs.
Backup creates additional copies of data so information can potentially be recovered after deletion, corruption, equipment failure, or another event.
Disaster recovery focuses on restoring technology systems and data following a significant disruption.
Business continuity takes a broader view:
How will the firm continue performing its critical business functions while technology is being recovered?
For a CPA firm, that distinction matters.
Having yesterday's data stored somewhere doesn't necessarily mean 25 employees can work tomorrow morning after a server failure.
A managed services agreement should therefore establish responsibility for the firm's backup environment while clearly identifying any separate business continuity or disaster recovery services.
Ask Exactly What Is Being Backed Up
CPA firms may have information spread across several systems, including:
- Local servers
- Workstations
- Microsoft 365
- Accounting applications
- Tax applications
- Document management systems
- Hosted environments
- Cloud platforms
- File shares
Don't assume that purchasing one backup service protects everything.
For example, protecting a local server doesn't necessarily address data stored elsewhere.
Likewise, moving information into a cloud application doesn't eliminate the need to understand the vendor's retention and recovery capabilities.
When reviewing an agreement, ask:
- Which systems are covered by our backup solution?
- Which systems are not?
- How often are backups performed?
- How long is data retained?
- Where are backup copies stored?
- How are failed backups handled?
- Who receives alerts?
- Are restore tests performed?
- How would we recover from a complete server failure?
- What recovery capabilities are provided by our third-party applications?
These answers should eventually connect to two business questions:
How much data could we afford to lose?
and
How long could we afford to be unable to work?
Those business requirements should help shape the technical solution.
A Backup That Has Never Been Tested Is an Assumption
Successful backup notifications are useful.
They are not the same as proving that recovery works.
A mature backup process should include some form of validation or recovery testing appropriate to the system and service being protected.
That could involve:
- File-level restore tests
- Application recovery testing
- Server recovery testing
- Backup integrity checks
- Disaster recovery exercises
- Documented recovery procedures
The exact testing process depends on the environment.
But the principle is simple:
The first time you test recovery shouldn't be during an actual disaster.
For a CPA firm, this becomes particularly important before periods when extended downtime would have an outsized impact on the business.
Understand Who Is Responsible for Recovery
A managed IT agreement should also help answer:
What happens after something goes seriously wrong?
Imagine a server fails on a Monday morning.
Who:
- Diagnoses the failure?
- Contacts the hardware vendor?
- Initiates recovery?
- Restores the server?
- Coordinates with accounting software vendors?
- Communicates with firm leadership?
- Helps employees regain access?
- Determines whether onsite work is necessary?
Now imagine the problem isn't hardware failure but a cybersecurity incident.
The responsibilities may be very different.
Routine backup restoration, disaster recovery, and cybersecurity incident response should not automatically be assumed to be the same service.
The agreement should make those boundaries clear.
Business Continuity Tip
Ask your prospective provider to walk you through a scenario: "Our primary server fails at 8:00 a.m. on a Monday during tax season. What happens next?"
A practical explanation can tell you far more than a proposal that simply says "backup and disaster recovery."
-
What Strategic Planning and Technology Lifecycle Services Are Included?
Managed IT shouldn't be limited to maintaining whatever technology the firm happens to own today.
A strong technology partner should also help leadership decide what comes next.
That includes planning for:
- Hardware replacement
- Software changes
- Cybersecurity investments
- Microsoft 365
- Business continuity
- Office changes
- Firm growth
- Cloud services
- AI adoption
- Major projects
When reviewing an agreement, determine whether strategic planning is actually part of the service.
Ask:
- How often will we have technology planning meetings?
- Who from your organization participates?
- Who should attend from our firm?
- Will you maintain a technology roadmap?
- Will you help develop an annual technology budget?
- How far ahead will you identify major equipment replacements?
- How are recommendations prioritized?
- Will you help us compare alternative solutions?
- How will our business goals influence the technology plan?
The phrase "strategic IT consulting" on a proposal isn't enough.
Ask what the process produces.
Your Technology Roadmap Should Look Beyond the Next 12 Months
Some technology investments can be planned years in advance.
Typical planning ranges may include:
| Technology | Typical Planning Range |
| Business laptops | 3–5 years |
| Business desktops | 4–5 years |
| Servers | 5–7 years |
| Firewalls | 4–6 years |
| Network switches | 5–7 years |
| Wi-Fi access points | 4–6 years |
| UPS batteries | 3–5 years, depending on conditions |
| Monitors | 5–7+ years |
These aren't mandatory replacement dates.
A five-year-old computer doesn't automatically become unusable on its fifth birthday.
Instead, lifecycle ranges give the firm a framework for planning.
Consider a 25-user CPA firm using a five-year workstation replacement cycle.
Rather than waiting until most of the firm's computers are old and replacing 25 systems at once, the firm could plan for approximately:
25 computers ÷ 5 years = 5 computer replacements per year
That creates a much more predictable budgeting process.
The same principle applies to servers, firewalls, switches, wireless infrastructure, and other major systems.
Technology Planning Should Be Connected to Financial Planning
A technology roadmap becomes much more useful when it connects anticipated technology decisions with an annual budget.
We recommend thinking about the technology budget using four broad categories:
Recurring Services + Technology Lifecycle + Projects + Contingency = Annual Technology Budget
Recurring Services
These may include:
- Managed IT
- Cybersecurity
- Microsoft 365
- Backup services
- Cloud services
- Internet connectivity
- Software subscriptions
Technology Lifecycle
These are planned replacement expenses such as:
- Workstations
- Servers
- Firewalls
- Network switches
- Wireless access points
- UPS systems
Projects
These may include:
- Office moves
- Server migrations
- Network redesigns
- Cloud migrations
- Major software changes
- Security initiatives
- AI projects
Contingency
Technology doesn't always follow the plan.
Equipment can fail early. Vendors can change requirements. Business priorities can shift.
Maintaining some budget flexibility gives leadership room to respond without treating every unexpected technology expense as an emergency.
A managed IT provider doesn't control the firm's budget.
It should help leadership see what's coming.
Strategic Planning Should Include What Not to Spend Money On
One of the easiest ways for an IT company to appear strategic is to recommend more technology.
That's not necessarily strategy.
Sometimes the right recommendation is:
Wait.
Perhaps a server is approaching the end of its expected lifecycle, but a critical accounting software vendor is expected to release a true SaaS platform within the next 12 to 18 months.
Immediately replacing the server might still be appropriate.
Or it might make sense to extend the existing environment while evaluating the vendor's roadmap.
Likewise, a firm may be interested in a new AI tool but lack the information governance, permissions, or security foundation needed to deploy it responsibly.
The first investment may need to be improving the underlying environment rather than buying the AI license.
A useful technology partner should be willing to say:
- Do this now.
- Budget for this next year.
- Monitor this.
- Don't spend money on this yet.
Prioritization is part of the value.
-
Which Projects, Services, and Costs Are Excluded?
This may be the most important section of the entire agreement.
Every managed IT agreement has boundaries.
That's normal.
The objective isn't to find a provider that claims everything is included.
The objective is to understand where the boundaries are before you sign.
Ask specifically whether the agreement includes or excludes:
- New computer installations
- Server replacements
- Office moves
- Cabling
- Network installations
- Major software upgrades
- Microsoft 365 migrations
- Cloud migrations
- New office locations
- Acquisitions
- After-hours work
- Onsite support
- Cybersecurity
- Incident response
- Backup and disaster recovery
- Hardware
- Microsoft licensing
- Third-party software
- Major projects
A well-written agreement should give the firm enough information to understand when additional charges are likely.
Projects Should Not Automatically Be Viewed as Hidden Fees
There is an important distinction here.
Charging separately for a project doesn't necessarily mean the provider is nickel-and-diming the client.
Consider replacing a server.
That project might require:
- Solution design
- Hardware procurement
- Server configuration
- Application coordination
- Data migration
- After-hours implementation
- Testing
- Documentation
- Vendor coordination
Those activities are materially different from routine maintenance.
A provider that charges separately for that work may be entirely reasonable.
The issue is transparency.
If projects are separate, the firm should know that.
If some project labor is included, the agreement should explain how.
If the firm receives preferred project rates, that should be clear too.
Predictability doesn't require every service to be included in one monthly fee.
It requires understanding how costs will be handled.
Look Carefully at After-Hours and Emergency Work
CPA firms should pay particular attention to this section because business hours can change dramatically during tax season.
Ask:
- What are the provider's normal support hours?
- Is after-hours support available?
- How is after-hours support requested?
- Is it included or billed separately?
- Are there different rates for nights, weekends, or holidays?
- What qualifies as an emergency?
- What happens during a major outage?
The objective isn't necessarily to purchase unlimited 24/7 support.
A 20-person CPA firm may not need the same support model as a hospital or a national enterprise.
But the firm should understand what happens when assistance is needed outside normal hours.
New Employee Setup Is Worth Clarifying
Employee onboarding is another seemingly small area that can create confusion.
A new employee may need:
- A computer
- Microsoft 365 account
- Multifactor authentication
- Access to file shares
- Application permissions
- Printers
- Remote access
- Security tools
- Accounting applications
Which portions are covered by the managed IT agreement?
Which require the firm's software vendors?
Is computer preparation included?
Is hardware procurement included?
How much advance notice does the provider need?
This is especially relevant when CPA firms add seasonal staff before busy periods.
A documented onboarding process helps both organizations know what needs to happen and when.
The same is true when someone leaves the firm.
A well-defined offboarding process should address disabling access, preserving appropriate business information, recovering equipment, and coordinating other required changes.
Don't Overlook Third-Party Costs
The MSP's monthly fee is only one component of the firm's technology spending.
Depending on the environment, separate expenses may include:
- Microsoft 365 licensing
- Accounting and tax software
- Cloud hosting
- Internet service
- Cybersecurity services
- Backup services
- Hardware
- Domain registration
- Phone systems
- Specialty applications
- Software vendor support
Ask the provider which services it resells, which are billed directly by third parties, and which expenses are expected to appear separately.
This is particularly useful when comparing two proposals.
One provider's $5,000 monthly proposal and another's $6,000 proposal aren't meaningfully comparable if the first requires another $1,500 of separately billed services that are included in the second.
Compare total scope and expected cost, not just the number at the bottom of the first page.
Service Levels Should Define Expectations, Not Promise Perfection
Managed IT proposals frequently reference service levels or response times.
These are useful, but firms should understand what the numbers mean.
For example:
Response time is not necessarily resolution time.
A provider might commit to acknowledging or beginning work on a critical request within a defined period.
That doesn't mean every problem can be completely resolved within that same period.
Some issues depend on:
- Hardware replacement
- Internet providers
- Software vendors
- Microsoft
- Cloud providers
- Equipment manufacturers
- Other third parties
When reviewing service levels, ask:
- How are requests prioritized?
- What qualifies as critical?
- When does the response-time clock begin?
- What does "response" actually mean?
- How are escalations handled?
- How are major incidents communicated?
The goal should be establishing clear expectations rather than creating an unrealistic promise that technology problems will always be solved within an arbitrary number of minutes.
The Agreement Should Define Responsibilities on Both Sides
A successful managed IT relationship isn't entirely one-sided.
The provider has responsibilities.
So does the client.
For example, the CPA firm may need to:
- Identify authorized contacts
- Notify the provider about new employees
- Provide adequate onboarding notice
- Inform the provider when employees leave
- Approve recommended changes
- Maintain appropriate software licensing
- Follow agreed security procedures
- Provide access to vendors
- Participate in planning meetings
- Make decisions about aging technology
This matters because an MSP can't effectively protect or manage systems it doesn't know exist.
Imagine the firm purchases a new cloud application without involving its technology provider.
Employees begin uploading sensitive client information.
Months later, leadership assumes the MSP has been monitoring or backing up that platform.
But the provider didn't know the system had been purchased.
Clear responsibilities reduce those gaps.
Pay Attention to Contract Terms Beyond Technology
Finally, don't review only the technical service list.
The agreement is still a business contract.
Leadership should understand areas such as:
- Initial contract term
- Renewal terms
- Cancellation provisions
- Pricing adjustments
- Payment terms
- Hardware ownership
- Software licensing
- Data ownership
- Documentation
- Transition assistance
- Confidentiality
- Insurance requirements
- Limitations of liability
- Responsibilities after termination
Legal counsel should review contractual language where appropriate.
Your technology provider can explain the operational intent behind its agreement, but it shouldn't replace your attorney when interpreting legal obligations.
One operational question is particularly important:
"If we decide to change providers someday, what happens to our documentation, credentials, licenses, and data?"
A technology relationship may last many years.
But the agreement should still provide a reasonable path for the relationship to end.
A provider confident in the value it delivers shouldn't need technological confusion to make leaving difficult.
How Do You Compare Two Managed IT Agreements That Look Completely Different?
This is where many CPA firms struggle.
One proposal might be priced per user.
Another might combine users and devices.
One might include reactive support.
Another might provide proactive services with block hours.
One might bundle cybersecurity.
Another might separate cybersecurity from managed IT.
Trying to compare the monthly prices without normalizing the services can lead to the wrong conclusion.
Consider a hypothetical 25-employee Las Vegas CPA firm evaluating two providers.
Provider A: $4,500 Per Month
The proposal includes:
- Proactive monitoring and maintenance
- Workstation management
- Server management
- Network management
- Microsoft 365 administration
- Reactive help desk support
- Vendor coordination
- Quarterly technology planning
- Onsite support under defined circumstances
Cybersecurity and backup services are separately defined and priced.
Provider B: $5,250 Per Month
The proposal includes:
- "Unlimited IT support"
- Monitoring
- Microsoft 365 management
- "Complete cybersecurity"
- Backup
- 24/7 monitoring
At first glance, Provider B costs $750 more per month, or $9,000 more per year.
Does that make Provider A the better value?
Not necessarily.
Provider B may include security and backup services that would bring Provider A's total annual cost above Provider B's.
But Provider B's proposal also leaves important questions unanswered.
What does "complete cybersecurity" mean?
Does "24/7 monitoring" mean employees can receive help 24 hours a day?
Are projects included?
Is onsite support included?
Which backup systems are protected?
Is disaster recovery included?
Who operates the help desk?
Are major Microsoft 365 changes included?
The CPA firm can't make a meaningful comparison until those questions are answered.
Normalize the Scope Before Comparing the Price
Instead of comparing proposal totals first, create a table like this:
| Service Area | Provider A | Provider B |
| Proactive monitoring | Included | Included |
| Workstation management | Included | Confirm |
| Server management | Included | Confirm |
| Network management | Included | Confirm |
| Reactive help desk | Included | Included, confirm limits |
| Onsite support | Defined terms | Confirm |
| After-hours support | Defined terms | Confirm |
| Microsoft 365 administration | Included | Included |
| Cybersecurity | Separate | Included, define controls |
| Backup | Separate | Included, define scope |
| Disaster recovery | Confirm | Confirm |
| Vendor coordination | Included | Confirm |
| Strategic planning | Quarterly | Confirm |
| Projects | Separate | Confirm |
| Hardware | Separate | Confirm |
| Licensing | Separate | Confirm |
| Contract term | Review | Review |
| Transition assistance | Review | Review |
Now leadership can compare the agreements intelligently.
The objective isn't to make every proposal identical.
It's to understand the differences.
The CPA Firm Managed IT Agreement Checklist
Before signing a managed IT agreement, use this checklist to review the proposal with your leadership team.
Proactive IT Management
- Which computers are managed?
- Are servers included?
- Is network equipment included?
- Is operating system patching included?
- Is proactive monitoring included?
- Is routine maintenance included?
- Is infrastructure health monitored?
- Is technology documentation maintained?
- Are backups monitored?
- Is vendor coordination included?
Reactive Support
- Which employees are covered?
- How do employees request support?
- What are normal support hours?
- How are urgent requests prioritized?
- Is remote support included?
- Is onsite support included?
- Is after-hours support available?
- How is after-hours work billed?
- How are unresolved issues escalated?
- What work is considered a project instead of support?
Microsoft 365 and Infrastructure
- Is Microsoft 365 administration included?
- Who creates and removes accounts?
- Who manages licensing?
- Who manages permissions?
- Who manages multifactor authentication?
- Who coordinates Microsoft support cases?
- Are servers managed?
- Are firewalls and network devices managed?
- Are hosted environments managed?
- Is third-party application coordination included?
Cybersecurity
- Is cybersecurity included or separate?
- Which specific security controls are provided?
- Who monitors those controls?
- Is employee security awareness training included?
- Is vulnerability management included?
- Is email security included?
- Is endpoint protection included?
- Is identity security included?
- Is incident response included or separate?
- How frequently is the security program reviewed?
Backup and Business Continuity
- Which systems are backed up?
- Which systems are not backed up?
- How frequently are backups performed?
- How long is data retained?
- Are failed backups actively investigated?
- Are restore tests performed?
- Who is responsible for disaster recovery?
- Are recovery procedures documented?
- Is Microsoft 365 data addressed?
- Are business continuity services included or separate?
Strategic Planning
- How often are technology planning meetings held?
- Will the provider maintain a technology roadmap?
- Will hardware lifecycle be tracked?
- Will upcoming replacements be identified in advance?
- Will the provider help develop an annual technology budget?
- Are cybersecurity investments incorporated into planning?
- Are major projects forecast in advance?
- Will the provider help evaluate server, hosted, and cloud options?
- Will recommendations be prioritized by urgency?
- Will the plan consider the firm's three- to five-year business goals?
Projects and Additional Costs
- Are projects included or separate?
- Are new computer installations included?
- Are office moves included?
- Are server replacements separate projects?
- Are cloud migrations separate projects?
- Is cabling included?
- Is hardware included?
- Is Microsoft licensing included?
- Are third-party applications included?
- Are there different after-hours rates?
Contract Terms
- What is the initial contract term?
- Does the agreement automatically renew?
- What are the cancellation requirements?
- How can pricing change?
- Who owns purchased hardware?
- Who owns the firm's data?
- What happens to documentation when the agreement ends?
- How are credentials transferred?
- What transition assistance is provided?
- Has appropriate legal counsel reviewed the agreement?
If a proposal leaves several of these questions unanswered, that doesn't automatically mean it's a bad proposal.
It means you need more information before signing it.
Six Red Flags to Watch for in a Managed IT Agreement
A contract should reduce ambiguity, not create more of it.
Watch for these warning signs.
Red Flag #1: "Everything Is Included"
Ask for the exclusions.
Every service relationship has boundaries.
A transparent provider should be comfortable explaining them.
Red Flag #2: Cybersecurity Is Described Without Specific Controls
Terms such as:
- Advanced security
- Complete protection
- Enterprise-grade cybersecurity
- Total security
sound impressive but tell you very little.
Ask what technologies and services are actually being provided and what risks they're intended to address.
Red Flag #3: Backup and Disaster Recovery Are Treated as the Same Thing
A backup copy is important.
It doesn't automatically tell you how the firm will operate after a major outage.
Ask what recovery actually looks like.
Red Flag #4: There Is No Strategic Planning Process
If the provider can't explain how it will help your firm plan technology investments over the next three to five years, you may be purchasing technical maintenance rather than a strategic technology relationship.
That distinction may be perfectly acceptable if maintenance is all you want.
Just understand what you're buying.
Red Flag #5: Major Exclusions Are Difficult to Identify
Projects, after-hours work, cybersecurity, hardware, licensing, and onsite support shouldn't require detective work to understand.
Red Flag #6: Leaving the Provider Would Be Unnecessarily Difficult
Your provider will naturally accumulate significant knowledge about your technology environment.
That shouldn't become a mechanism for preventing you from changing providers.
Understand how credentials, documentation, licensing, and other client-owned information will be transferred at the end of the relationship.
A Managed IT Agreement Should Reduce Surprises
Ultimately, that's one of the best ways to evaluate the agreement.
Ask:
"Will this agreement make our technology costs and responsibilities more predictable?"
Predictability doesn't mean the firm will never have an unexpected expense.
Technology doesn't work that way.
Hardware fails.
Vendors change products.
Businesses grow.
Security threats evolve.
New projects emerge.
But a well-structured managed IT relationship should reduce avoidable surprises by creating clarity around:
- Responsibilities
- Support
- Costs
- Technology lifecycle
- Security
- Projects
- Future investments
That clarity becomes particularly valuable for CPA firms because technology decisions often need to be made around predictable periods of intense business activity.
Frequently Asked Questions About Managed IT Agreements for CPA Firms
How much should managed IT services cost for a CPA firm?
For planning purposes, CPA firms in the 10- to 50-user range may use approximately $150 to $300 per user per month as an initial managed IT budgeting range.
That translates approximately to:
- 10 users: $1,500–$3,000 per month
- 25 users: $3,750–$7,500 per month
- 50 users: $7,500–$15,000 per month
Actual pricing depends on the provider, service model, infrastructure, support requirements, locations, and scope.
Cybersecurity, Microsoft licensing, backup services, hardware, projects, and other technology expenses may be separate.
Should cybersecurity be included in a managed IT agreement?
It can be, but it doesn't have to be.
What matters is that the firm understands which security controls are being provided, who manages them, and what isn't included.
At ANAX Business Technology, cybersecurity is offered as a separate service bundle rather than automatically being included in every managed IT agreement.
That makes the distinction between operational IT services and cybersecurity services clearer.
Should a CPA firm choose an unlimited managed IT agreement?
Not automatically.
An unlimited model can provide valuable cost predictability for firms that generate significant support activity.
Other firms may benefit from a service model that combines proactive management with block hours or separately billed reactive support.
The best structure depends on how the organization actually consumes IT services.
Are IT projects normally included in managed services?
It depends on the agreement.
Routine support and maintenance are often treated differently from major projects such as server replacements, office moves, Microsoft 365 migrations, network installations, and large software changes.
Ask the provider to define support versus project work before signing.
Should Microsoft 365 administration be included?
If the provider is responsible for managing the firm's Microsoft environment, the agreement should clarify the scope of Microsoft 365 administration.
That may include account management, licensing coordination, permissions, authentication, troubleshooting, and other administrative responsibilities.
Microsoft licensing itself may be billed separately.
Does Microsoft 365 eliminate the need for backup?
Don't assume that purchasing a Microsoft 365 subscription automatically provides the recovery capabilities your firm requires.
Determine what information needs to be recoverable, what Microsoft's applicable services provide, what retention or recovery capabilities are configured, and whether a separate backup service is appropriate for your firm's requirements.
Should our MSP manage our accounting and tax software?
Usually, the software vendor remains responsible for application-specific support.
However, the MSP should clearly define whether it will coordinate with those vendors when a problem involves the network, server, workstation, Microsoft environment, hosted platform, or another component it manages.
For CPA firms, vendor coordination can be an important part of the relationship.
Should a managed IT provider help with technology budgeting?
A strategic technology partner should help leadership identify anticipated technology investments.
That can include workstation replacements, servers, networking equipment, cybersecurity, cloud services, Microsoft 365, business continuity, and upcoming projects.
The provider shouldn't control the firm's budget, but it should help leadership avoid preventable surprises.
How long should a managed IT contract be?
There is no universally correct contract length.
Rather than focusing exclusively on the number of months, review the complete termination and renewal provisions.
Understand:
- Initial term
- Automatic renewal
- Required notice
- Early termination provisions
- Transition obligations
- Data and documentation transfer
Legal counsel can help the firm evaluate contractual language where appropriate.
What should happen if we decide to switch MSPs?
The outgoing provider should have a defined process for transferring appropriate client information, documentation, credentials, licensing information, and other resources required for transition.
The incoming provider should also have an onboarding process for discovering and documenting the environment.
A provider transition requires coordination, but it should not depend on the outgoing MSP withholding information needed to operate the firm's technology.
Key Takeaways
A managed IT agreement for a CPA firm should provide much more than a monthly price.
Before signing, make sure you understand these seven areas:
- Proactive IT Management
Know which systems are monitored, maintained, patched, and documented. - Reactive Support
Understand help desk coverage, onsite support, after-hours assistance, escalation, and the distinction between support and projects. - Microsoft 365, Infrastructure & Cloud Administration
Clearly establish responsibility for accounts, servers, networks, cloud services, and vendor coordination. - Cybersecurity Responsibilities
Identify the actual controls being provided rather than relying on broad claims such as "complete cybersecurity." - Backup & Business Continuity
Know what's protected, how recovery works, and who is responsible when something goes seriously wrong. - Strategic Planning & Technology Lifecycle
Expect your technology partner to help identify upcoming investments and support three- to five-year planning. - Projects, Exclusions & Additional Charges
Understand what's not included before those services are needed.
The strongest managed IT agreement isn't necessarily the one that includes the most services.
It's the one that gives both organizations a clear understanding of responsibilities, expectations, costs, and how the relationship will work.
Ready to Review Your CPA Firm's Technology Strategy?
If you're evaluating managed IT providers, reviewing your current agreement, or wondering whether your existing service model still fits your firm, the conversation shouldn't begin and end with monthly pricing.
Start with your business.
How do your employees work?
Which systems are critical?
What happens during tax season?
Where are your biggest technology risks?
Which investments are coming over the next three to five years?
And what kind of support relationship does your firm actually need?
At ANAX Business Technology, we take a consultative approach to managed IT. Rather than forcing every organization into the same service model, we work with CPA firms to understand their technology environment, support requirements, security priorities, budget, and long-term business objectives.
Our U.S.-based team members live and work in the Las Vegas valley, allowing us to combine responsive local support with long-term technology planning. We believe the best technology partnerships are built on accessibility, accountability, transparency, and a clear understanding of who is responsible for what.
Whether you're comparing managed IT proposals, reviewing an existing contract, or preparing for your next technology planning cycle, we're here to help you make informed decisions.
Schedule your Initial Consultation with ANAX Business Technology to discuss your firm's technology environment and determine what the right managed IT relationship should look like for your organization.
