Should a charity outsource its IT?

Most charities we meet don't have an IT department. They have a finance manager who also does the laptops, a trustee who set up the email years ago, and a supplier somewhere who charges a monthly fee and answers the phone less each year. IT isn't the mission, so it gets what's left, until the day the shared drive disappears, or a funder asks about data protection, or a phishing email empties a restricted fund.

The question "should we outsource?" usually arrives at that point, and it's worth answering properly rather than in a panic. This is our honest take, and we'll say up front that we are an IT provider that works with charities, so read it with that in mind.

What does a charity actually need from IT?

Less than the brochures suggest, but more than a helpful volunteer can carry. The core, for an organisation of 5 to 250 people, is:

• Email, files and collaboration that work, almost always Microsoft 365 (which is heavily discounted or free for registered charities through the Microsoft nonprofit programme, a saving many charities don't claim).
• Devices that are set up consistently, kept updated, and can be wiped if lost.
• Security proportionate to the data you hold: beneficiary records, donor details and safeguarding files are exactly what regulators and funders care about.
• Backup that has actually been tested by restoring something.
• Someone to ring when it breaks, who answers, and who knows your setup.
• Honest advice on what to buy, when, and what not to.

That last one is the part in-house arrangements struggle with. Nobody on staff has the time to know whether the new grant-management system needs a security review, or whether the printer contract is a rip-off.

When does outsourcing make sense?

Outsourcing is the right call when three things are true. You have more than a handful of staff, so the volume of "small" problems is no longer small. Nobody on the team has IT as their actual job, so every hour spent on it is an hour taken from the mission. And you can find a provider who treats a charity as a client rather than a charity case: proper service, sensible pricing, no upselling.

It's the wrong call when you're tiny and stable (five people, all on Microsoft 365, nothing custom: a good setup and an occasional day of help may be all you need), or when what you actually need is a one-off project (a migration, a Cyber Essentials push, a new website) rather than a monthly relationship. A good provider will tell you which of these you are, even when it costs them the retainer.

What should it cost?

For a small charity, expect managed IT support to start around £300 per month for a retainer covering unlimited remote help and a monthly site visit, rising with headcount and complexity. Per-user pricing typically runs £25 to £60 per person per month depending on what's included. Projects are quoted separately. If a quote is dramatically below that, ask what's excluded; if it's dramatically above, ask what a 30-person charity is paying for.

Set that against the alternative honestly: the finance manager's ten hours a month, the trustee's goodwill, the restore that fails, the licences you're paying full price for. Outsourcing done well is usually cheaper than the invisible cost of doing it badly in-house, and it is always cheaper than the incident.

Ten questions to ask any provider

1. How many charities do you support, and can we speak to one?
2. Will you claim Microsoft's nonprofit licensing for us, and what will we save?
3. What are your actual response times, in hours, for a critical problem versus a routine one?
4. Is multi-factor authentication enforced for every account, and is external email forwarding blocked?
5. When did you last test a restore from our backup, and can we see the evidence?
6. Who owns the documentation and admin passwords if we leave?
7. What's the notice period, and does the contract auto-renew for a year?
8. Do you resell hardware and software with a margin, and will you tell us when a cheaper option exists?
9. Can you help us with UK GDPR and Cyber Essentials, and what would that cost?
10. What happens on a bank holiday, and what does out-of-hours cost?

The red flags

A provider who won't give response times in numbers. A contract with a three-month notice window before an automatic annual renewal, which exists to trap you. Documentation you can't see. A quote that's mostly licences and hardware with the service as an afterthought. Anyone who talks about "solutions" for ten minutes before asking what your organisation does. And any provider who cannot explain, plainly, what they would do in the first hour after one of your staff clicks a phishing link; we wrote down what that hour should look like, and it's a fair test.

What good looks like

The charities we've seen work best with outsourced IT treat the provider as a department: a named contact, a monthly conversation about what's coming (a new office, a funder audit, a fundraising campaign that needs a website that won't fall over), a written record of everything, and a relationship where "we'd rather you didn't buy that" is a sentence they hear. Trustees see a one-page annual summary: what we run, what it costs, where the risks are. The finance manager gets her ten hours back.

If you're weighing this decision, we're happy to talk it through, including telling you if you don't need us. Start with our questions page for costs and coverage, or get in touch.