"Fixed price" is one of the most reassuring phrases in IT procurement, and one of the most misleading. Everyone signs expecting predictable costs. Most people find out eighteen months later that "fixed" had an exchange rate attached to it the whole time.
After three decades in this industry, including plenty of time cleaning up after contracts that promised the world and delivered a helpdesk ticket queue, I've learned that comparing IT service agreements properly is less about reading the pricing table and more about knowing what questions the pricing table is quietly avoiding. If predictable cost is what you're actually buying, let's make sure the contract delivers it.
Start With Outcomes, Not Vendors
Here's the single biggest mistake I see business leaders make when comparing IT providers: they ask three MSPs to quote against their own methodology, then try to compare three completely different answers.
Every provider has a preferred way of describing what they do, usually the way that makes their particular strengths look unmissable and their gaps look irrelevant. That's not dishonesty, it's just human nature (and frankly, good salesmanship, I've done it myself more times than I'd like to admit). It's the same pattern I've written about before when it comes to why so many outsourcing relationships quietly underdeliver: the brief was vague, so every respondent filled the gap with their own strengths.
The fix is simple and it changes the entire dynamic of the conversation. Before you talk to a single provider (yes, even us!), write down the outcomes your business actually needs. Not features. Not technology. Outcomes.
Something like:
- Staff can work without disruption from any of our three sites
- A ransomware event doesn't take us offline for more than four hours
- Our building access, cameras and kiosk systems are as secure as our email
- We can prove our compliance position to an insurer or auditor within a day, not a week
- New starters are fully set up and secure on day one, every time
Once you've got that list, every provider is assessed against the same yardstick. It strips out the positioning bias, stops the "well our platform does X" sales tangents, and forces a genuine apples to apples comparison. If a provider can't map their offering to your outcomes, that tells you something important on its own.
The Line Between Base and Comprehensive Is Wider Than It Looks
Most fixed price contracts in Australia sit somewhere between AUD 100 and 250 per user (or device) per month, and that range exists for a reason: it's not really one market, it's three tiers wearing the same label. If you want the full breakdown of what drives that spread, I've gone deeper on it in how much outsourced IT support actually costs, but the short version matters here too.
A base tier typically covers the obvious stuff: helpdesk, patching, antivirus, maybe some basic monitoring. It's the IT equivalent of third party car insurance. It technically meets the requirement, but you'll find out what it doesn't cover at the worst possible moment.
A comprehensive tier extends into proactive security operations, documented compliance evidence (Essential Eight alignment being the current Australian benchmark), lifecycle planning for hardware and software, vendor management, and genuine reporting rather than a monthly PDF nobody reads. Different providers structure these tiers differently too, which is why it pays to understand the different MSP models and which one actually fits your business before you start comparing dollar figures.
The trap is that both tiers can be described using almost identical marketing language. "24/7 monitoring" might mean a genuine security operations centre watching for anomalies, or it might mean an automated alert that emails someone at 2am who looks at it the next business day. Same words, wildly different outcomes.
When you're comparing quotes, ask each provider to show you, not tell you: a sample monthly report, their actual average response time (not the SLA ceiling), and what percentage of tickets get resolved inside the promised window over the last quarter. If they can't produce it, assume the number doesn't flatter them.
What "Fixed" Actually Means in the Fine Print
Here's an uncomfortable truth:
very few fixed price IT contracts are actually fixed for the life of the agreement.
Most have an escalation mechanism built in, and that mechanism is where a lot of the "predictability" leaks out.
Annual Price Increases
The most common version is a CPI-linked annual increase - on its own that's entirely reasonable. Costs rise, wages rise, a provider adjusting once a year in line with CPI is just running a sustainable business. The problem is what often sits with it. Clauses written as "CPI plus 2%" or "CPI plus underlying supplier increases" (a phrase that's rarely defined anywhere in the document) let a provider pad every annual review at your expense, and the vagueness is usually the point, not an oversight.
Ask for the exact formula in writing, the specific index it references, and whether there's a cap. If a provider can't produce a clean answer to "what will this cost me in year three," that's not fixed pricing, that's fixed pricing with a coin flip attached (as an aside, Microsolve uses the greater of annual CPI or the Wage Price Index as the basis for annual increases).
Agreement Term
Term length is the second lever. Twelve months is the sensible default in the Australian market right now. Twenty four months is borderline and should come with a genuine discount to justify the lock-in. Thirty six month terms are common, but here's the part that catches people out: they're frequently offered at exactly the same monthly rate as the twelve month option. That's not a discount for commitment, that's a provider removing your leverage for nothing in return. If you're offered a longer term, the question to ask isn't "can I get a longer term," it's "what do I get for giving up my exit option."
Transition Out
Then there's the part nobody budgets for: leaving. Exit and transition costs in Australian MSP contracts can run anywhere from a few thousand dollars for basic data handover and tool decommissioning, up to five figure sums when early termination fees are calculated as a percentage of the remaining contract value.
A fair contract specifies, in plain language, a notice period (60 days is a reasonable benchmark), no termination penalty once you're past the initial term, and a firm commitment to hand over documentation, admin credentials and configuration data within a defined window (two weeks is common) at no extra charge. If that clause doesn't exist, assume you'll be negotiating your own freedom from a position of weakness later, and providers know it.
None of this means fixed price contracts are a trap. It means "fixed" is a starting position, not a guarantee, and the only way to know whether a quote will still feel fixed in year two is to read the three clauses that actually control it: the escalation formula, the term length, and the exit terms. Get a straight answer on all three before you compare a single dollar figure between providers. It's also worth understanding where technology debt hides inside an operating budget, because a contract that looks cheap on paper can still be quietly accumulating cost you'll pay for later.
The IT Responsibilities Nobody Puts In The Contract
This is where most comparisons fall apart, because most business leaders (and quite a few IT providers, if I'm honest) still think of "IT" as laptops, email and the internet connection. That definition retired years ago.
Modern businesses run a web of connected systems that sit outside the traditional IT boundary but absolutely rely on the same network, the same security posture and the same support relationship. If your fixed price contract is silent on these, you don't have a comprehensive agreement, you have a helpdesk subscription with a good marketing department.
-
Operational technology. Manufacturing equipment, environmental controls, point of sale systems, ticketing platforms, anything with a network connection and a firmware version is now a cyber risk and a support obligation. If your MSP's contract explicitly excludes OT (and many do, quietly, in the fine print), you need a separate plan for who patches it, monitors it, and responds when it fails. I've written specifically about why [OT can't be treated as set and forget], and it's one of the clearest examples of scope quietly narrowing between quotes that look identical on the surface.
- Access control and building management. Door access systems, alarm panels, HVAC controllers and building management platforms are all IP connected now. I've seen businesses with beautifully secured servers and a door access system running on a ten year old unpatched appliance with the default admin password still active. That's not a hypothetical, that's a Tuesday.
- Public access kiosks. Anything a customer touches directly (check-in kiosks, self-service terminals, booking screens) needs its own security consideration, because it's the one device in your environment that untrusted members of the public interact with unsupervised. Ask specifically whether kiosk hardening, lockdown software and physical tamper monitoring are in scope.
- Conferencing and AV facilities. Boardroom systems, video conferencing units and digital signage are computers with a friendlier face. They need patching, credential management and network segmentation exactly like everything else, yet they're routinely left out of support contracts because "that's more of an AV thing."
A genuinely comprehensive fixed price contract either includes these categories explicitly, or names them as exclusions with a clear price and process for covering them. What you're checking for is not whether the provider covers everything (sometimes they legitimately shouldn't) but whether the gaps are visible before you sign, not after something fails.
Compliance and Lifecycle Are Where Base Plans Quietly Fail You
Compliance in a base level contract is usually reactive: something goes wrong, and the provider scrambles to produce evidence after the fact. Compliance in a comprehensive contract is a standing capability, meaning the evidence, patch records, security posture and access logs already exist because the provider has been generating and reviewing them all along.
This matters enormously if you're dealing with cyber insurance renewals, regulatory obligations, or a due diligence process ahead of an acquisition or funding round. Ask directly: if my insurer wants proof of our security controls next Tuesday, can you produce it, or do we need three weeks to build it? For Australian SMEs specifically, that standing capability increasingly gets measured against a recognised framework like SMB1001 certification, which gives you something concrete to ask each provider to map their coverage against.
Lifecycle management follows the same pattern. A base plan reacts when hardware fails. A comprehensive plan tracks the age, warranty status and performance of every device and system, and gives you a forward plan for replacement spend well before anything breaks. I've covered this in more detail as the hidden lever in your IT budget, because that forward visibility is the difference between a planned capital expenditure line and an unplanned Tuesday afternoon crisis.
Transparency Is the Tiebreaker
When two providers look similar on paper, the deciding factor should be how honestly they report on themselves. Ask every provider for the same three things: a real reporting sample, a straight answer on what's excluded from the fixed price, and references from businesses of a similar size and complexity to yours.
A provider who happily shows you their actual performance numbers, warts and all, is telling you something valuable about how they'll behave once you're a signed client rather than a prospect. If you want a structured way to pressure test a shortlist before you sign anything, it's worth running through an IT health check before committing to managed support, it's the same discipline applied earlier in the process, before the contract rather than after.
Bringing It Together
Comparing fixed price IT contracts properly means starting with your outcomes, testing every quote against those outcomes rather than the provider's pitch, and reading past the marketing language into the three places cost predictability actually lives: what's excluded from scope, how the price escalates over time, and what it costs you to leave. A contract that nails the first two but goes quiet on the third isn't fixed price, it's deferred price.
The cheapest quote and the most expensive quote can both be wrong. The right one is whichever maps most completely and most transparently to the outcomes you defined before any salesperson walked in the door, and keeps its promise of predictability all the way through the term, not just in year one. If you're at the point of shortlisting providers, our guide on how to choose an outsourced IT partner is a natural next step.
