How to vet an IT consultant before you hire one (UK)

Three checks catch most bad engagements: who actually owns your domain, DNS and admin accounts once they're onboarded; what happens to your passwords and access if you ever want to leave; and whether the company has a real trading history you can check on a public register. Everything else in this list matters, but those three are where owner-managed businesses get burned most often — usually because nobody asked before signing.

This is the checklist we'd want a prospective client to run on us. Ten checks, each with a free, independent way to verify it. Run it on whoever you're considering hiring, including us, before any money changes hands.

What are the three checks that catch the most bad engagements?#

1. Who owns your domain, DNS and admin accounts? Ask who will hold the registrar login, DNS management and any admin accounts created during the engagement, and insist they're registered in your company's name from day one, not the consultant's. This is the single most common way a small business ends up locked out of its own website or email. Verify it yourself with a WHOIS lookup on ICANN Lookup (most domains) or Nominet's WHOIS search (.uk domains specifically) before you sign, and again periodically afterwards.

2. What happens to your access when the engagement ends? Get this in writing before you start, not when you're trying to leave: how quickly are shared passwords rotated, admin rights transferred, and accounts handed back, and is there a documented offboarding step at all? There's no public register for this — the check is asking the question directly and reading the answer carefully. A consultant who can't describe their own offboarding process probably doesn't have one.

3. How long has the company actually traded? Anyone can put up a website and claim years of experience. Companies House shows the real incorporation date, current status and filing history for free, in under a minute, at find-and-update.company-information.service.gov.uk. A company incorporated eight months ago claiming "over a decade of experience" (a sole trader history that predates the limited company, say) isn't automatically dishonest, but it's worth asking about directly.

The full checklist#

4. ICO registration. Anyone processing personal data on your behalf as a business — which covers almost every IT consultant, since client lists, email accounts and support tickets all count — should be registered with the Information Commissioner's Office and paying the data protection fee. Search the ICO register of fee payers by name or registration reference. No entry, despite them clearly handling personal data, is a real flag, not a technicality.

5. Professional indemnity insurance. There's no free public register of PI insurance in force. Ask directly for a certificate of insurance (a COI), which any reputable operator can produce on request without hesitation. It shows the insurer, the sum insured and the expiry date, so you can see it's current rather than a screenshot from three years ago.

6. Relevant certifications. Ask to see the certificates themselves, not just a list of letters after a name. Most professional and vendor certifications (PRINCE2, ITIL, cloud vendor accreditations, a degree) don't have a free public per-holder register you can search, so the check is the same as insurance: ask, and see whether the answer is specific and immediate or vague and deflected.

7. Named, contactable references. Ask for two or three clients you can actually ring, ideally from engagements old enough that any problems would have surfaced by now. A written testimonial with no way to verify who wrote it, or a case study with no named client, isn't a substitute for a phone number.

8. Documentation and handover standard. Ask to see an anonymised sample of what they document as they go: network diagrams, account inventories, decision records, whatever fits the work. This tells you what it will be like to inherit their work later, whether that's you taking things back in-house or a different consultant taking over.

9. Subcontracting: who actually does the work. Ask directly whether the person you're talking to does the work, or whether it gets passed to a subcontractor you've never met. Neither answer is automatically wrong, but you're entitled to know before you sign, and the answer should match what you can see about the size of the business — Companies House officer records will tell you if a "team" is in fact one person, or confirm a team where one is claimed.

10. Exit terms. Read the termination clause before you sign, not when you want out. It should cover notice period, what happens to deliverables and data, and whether there's any commitment to help a successor pick up the work. A contract that's silent on all three is a contract written for the consultant's convenience, not yours.

What are the red flags?#

Any one of these is reason enough to walk away, regardless of how good the pitch sounds:

• They refuse to put documentation, an exit plan or an offboarding process in writing.
• Your domain, DNS or hosting accounts end up registered in the consultant's name, or in the name of "the agency" rather than your company.
• They handle personal data as a normal part of the work but have no ICO registration, and can't explain why.
• There are no written exit terms, or the contract simply doesn't mention what happens when the engagement ends.
• Nobody can tell you who actually does the work day to day.

What happens if you run this checklist on us?#

We built this list to be checkable, so here's what checking it against Solutions Delivered actually turns up.

Two of those ten pass against a free public register on the spot. The rest pass because we'll answer the question directly when you ask, which is exactly the standard this checklist sets for everyone else. If you'd rather see that in the context of what an ongoing engagement actually looks like, our outsourced IT director page sets out the shape of the work; about has the fuller version of who's doing it.

Frequently asked questions#

Do I need to check all ten before every small job? No. Scale the checking to the stakes. A half-day fix doesn't need the full pass; anything that touches your domain, hosting, backups or an ongoing retainer does.

What if a consultant has no ICO registration at all? Ask why. A genuinely tiny operation with no client personal data of any kind is a narrow exception; anyone running email, tickets or a CRM on your behalf almost certainly needs to be registered, and a confident, correct explanation either way tells you more than the registration status alone.

Is a company that's only a year or two old automatically a bad sign? No, but it changes what you should ask for. A newer company can still show real experience through named references and a documented track record; it just can't lean on Companies House filing history the way an older one can, so ask harder on the other checks instead.

Run the checklist on us#

Every check above has a free way to verify it, or a direct question you're entitled to ask and get a straight answer to. Run the checklist on us before you decide anything — that's what it's for.