Buying a Managed IT Service Provider in Canada

Buying a managed IT service provider in Canada means taking responsibility for continuing client systems, support commitments and sensitive administrative access. Recurring invoices can be attractive, but their value depends on contract durability, delivery costs, technical staff and the security of the provider's own systems.

Separate managed support from project work, hardware resale, software subscriptions, backup services and security monitoring. Each stream has different margins and obligations. A reseller invoice may include substantial amounts owed to a distributor, while a fixed support fee can conceal an expensive client environment.

Start with the Ontario business purchase checklist, then add a client-by-client contract and technical review. This guide provides general information; obtain legal, accounting, cybersecurity and transaction-specific advice before committing.

For the broader purchase process and other sectors, visit the business acquisition hub and industry guide directory.

Request a customer schedule showing contracted services, monthly charges, users or devices covered, renewal dates, cancellation rights and payment history. Reconcile it to signed agreements, billing exports, supplier invoices, bank receipts and the general ledger. Separate recurring service fees from hardware, setup projects and reimbursed spending.

Review ticket volumes, support hours, escalation patterns and out-of-scope work by client. An apparently profitable contract may depend on unpaid founder time or a technician repeatedly fixing obsolete equipment. Check whether the agreement permits price adjustments when user numbers, locations or support requirements change.

Investigate client concentration, disputed invoices, promised discounts and upcoming renewals. Ask whether growth comes from new managed-service clients or unusually large hardware replacements. Review device and licence counts against what suppliers actually bill.

Have the accountant assess margins using realistic staffing, monitoring, security, insurance and distributor costs. Revenue that disappears when the owner leaves should not be valued as if it were an unconditional long-term commitment.

Review master service agreements, statements of work, service levels, data-processing terms and amendments. Identify assignment restrictions, change-of-control clauses, termination rights and promises about personnel, hosting location, subcontractors and security controls. Compare these commitments with the service actually delivered.

An asset purchase may require transferring customer contracts. A share purchase keeps the company as contracting party, but can still trigger ownership-change provisions. Prepare a consent schedule rather than assuming one structure solves every continuity issue. The asset versus share comparison tool can help frame the initial choice.

The Cyber Centre's guidance on contracting with managed service providers highlights why customers should review security arrangements and consider contractual protections if a provider is acquired. For a buyer, that makes security evidence relevant to retention as well as risk.

Identify material clients whose consent, onboarding review or transition plan should become a closing condition. Any retention-based earnout needs clear treatment of migrated contracts, service changes, refunds and pass-through licence revenue.

For a purchase involving several technology services, also read buying a software business and buying a digital marketing agency. Their discussions of product rights, client contracts and administrator accounts provide additional review areas.

Obtain the actual agreements for Microsoft, Cisco and other vendor programmes relevant to the business, together with distributor contracts, partner identifiers and current status. The relevant rights may depend on the legal entity, programme tier, staff certifications, territory or customer arrangement.

Do not assume that a partner badge, reseller discount or subscription account transfers with an equipment list. Check assignment and control-change terms and ask the vendor or distributor to confirm the process for the proposed structure. Determine whether replacement accounts, customer permissions, updated credit arrangements or other steps are needed.

Review minimum purchases, annual commitments, renewal dates, rebate clawbacks and unpaid balances. A client may be able to cancel its service agreement while the provider remains committed to a supplier subscription. Match both sides before agreeing the closing adjustment.

Document customer ownership and access in relevant tenants and portals. Provider administration, billing rights and ownership are different questions. Migration should follow the applicable agreements and authorized procedures, not a last-minute transfer of the seller's personal credentials.

Create an inventory of remote monitoring and management tools, administrator accounts, password vaults, backup consoles, documentation systems, remote-access services and emergency recovery methods. Record which clients and systems each account can reach and whether access is personal, shared or delegated.

The Cyber Centre's managed-services security guidance identifies the particular exposure created by providers' access to many client systems. Use access-control, incident-response and recovery questions to scope an independent technical assessment. The guidance is a starting point, not a certificate that an acquisition is secure.

Ask the reviewer to test the approved inventory against actual permissions, multifactor authentication, logging and offboarding records. Investigate old administrator accounts and access retained by former staff. Avoid placing usable client passwords or recovery codes in an ordinary acquisition data room.

Plan access changes with client authorization, continuity and auditability in mind. Rotating everything at once can disrupt services; leaving the seller in control indefinitely creates a different problem. Assign responsibility for each approved cutover and retain evidence of completion.

Request the incident register, insurer notifications, security assessments, remediation records, serious customer complaints and any known credential compromises. Read the scope and date of each assessment. A report on one customer environment does not establish the security of the MSP's internal management platform.

Ask whether incidents were investigated, what systems were affected and how corrective actions were verified. Compare customer security questionnaires and contractual promises with actual practices. Have counsel review any notification, confidentiality or continuing cooperation obligations arising from known events.

Require evidence of backup restoration tests, documentation availability and emergency cover. Determine who controls encryption keys and whether a departure or account suspension could prevent recovery. A dashboard showing successful backup jobs does not prove the buyer can restore a client's operations.

Separate known remediation costs from ordinary future investment. Material unresolved issues may require work before closing, a revised price, targeted indemnities or another negotiated response. An indemnity should not replace a necessary operational fix.

An MSP may process information for clients while maintaining its own business, employee and billing records. Identify applicable privacy laws and contractual roles before sharing detailed logs, personnel files or customer information. Use anonymized summaries where they answer the acquisition question, and establish controlled access for information genuinely needed.

Where PIPEDA applies, the business-transaction provision permits certain necessary disclosures without consent only under specified conditions. These include an agreement limiting use to transaction purposes, appropriate safeguards, and return or destruction within a reasonable time if the transaction fails. After closing, the information must remain necessary to carry on the acquired business. The parties' agreement must preserve previously permitted purposes, require safeguards and respect consent withdrawals; one party must notify affected individuals within a reasonable time. The exception does not cover a transaction whose primary purpose or result is dealing in personal information.

That provision does not erase client contract restrictions or decide every provincial or sector-specific obligation. Health, financial and public-sector customers may impose additional requirements that need separate review.

Agree what information transfers, where it remains hosted, which personnel can access it and how historic records are handled. Do not describe customer data or credentials as unrestricted inventory owned by the seller.

Identify who understands the management platform, client networks, backup configurations and unusual legacy systems. Review on-call coverage and escalation responsibilities. If one departing engineer is the only person who can recover a critical environment, the transition needs more than a generic training session.

Examine employment and contractor agreements, compensation, accrued obligations and promised incentives. Worker status depends on the relationship and applicable law, not just whether invoices were issued. Obtain advice for the provinces and work arrangements involved.

Check ownership of custom scripts, documentation, integrations and automation. Section 13 of the Copyright Act makes signed rights documentation important where independent developers contributed work. Confirm adequate ownership or licences and any client-specific rights before treating those tools as purchased assets.

Define seller and key-person transition deliverables: network walkthroughs, documented recovery procedures, client introductions, training and a realistic period of escalation support. Budget for knowledge transfer and service delivery to run together.

List prepaid support periods, unused service hours, uncompleted projects, customer credits and warranties. Decide who keeps the associated cash and who funds delivery after closing. Deferred revenue, working capital and assumed obligations must use consistent definitions so the same amount is not adjusted twice.

Map leased or financed equipment separately from company-owned stock and client property. Include loaner devices, spare servers, network appliances and hardware installed at customer sites. Confirm title, security interests, lease assumptions and any required payout or consent.

Review annual software and backup commitments against customer cancellation rights. Identify supplier invoices, rebates and service credits that may settle later. Agree a reconciliation process for post-closing billing and customer refunds.

Use the interactive due diligence checklist to track these issues, with technical and financial reviewers assigned to the items within their expertise.

Suppose a buyer values a client account based on its monthly service invoice. Diligence shows the client can terminate on short notice, but the MSP has committed to an annual supplier subscription. The same account also relies on a founder-controlled recovery method that has not been documented.

Before closing, the buyer should confirm the supplier's terms, customer intentions, remaining subscription cost and an authorized recovery-access transition. Possible deal responses include a closing condition, funded delivery obligation, price adjustment or carefully defined retention payment.

This is a hypothetical illustration, not a reported client transaction. It shows why recurring revenue, supplier commitments and technical access belong in one acquisition review.

Does recurring billing mean the client is committed?

No. Check the agreement, notice rights, service economics and collection history. A monthly invoice may include pass-through subscriptions and does not establish either durable revenue or a healthy margin.

Can vendor partner status be included in the sale?

Only to the extent the actual programme and agreements permit. Ask the vendor or distributor to confirm requirements for the transaction structure, legal entity, accounts and relevant customer arrangements.

Should the seller give the buyer all client passwords during diligence?

An ordinary data room should not become a live credential store. Establish a necessary, authorized and secure review process, then plan the actual administrative handover with appropriate client permissions and continuity controls.

The closing schedule should identify client consents, supplier arrangements, retained staff, access transitions, incident remediation and the funding of promised services. Test the most important handover steps before the buyer is expected to operate independently.

Put essential conditions into the purchase letter of intent early. Lamba Law provides legal help with buying a business, coordinating transaction documents with the findings of financial and technical advisers. Contact Lamba Law to discuss the proposed managed-IT acquisition.