Month one with a new client usually starts the same way: nobody can tell me what they are actually paying for IT.
The idea of a fractional IT director is easy enough to grasp in principle: board level oversight without the cost of a full time hire. What is harder for most SME leaders to picture is what the engagement actually involves once it starts, week to week and month to month.
That gap matters. If you cannot picture what you would be paying for, it is hard to judge whether it is worth it. So here is a plain description of how the work runs, from the first week through to the ongoing rhythm.
Why the role exists
Most SMEs reach a point where IT is too important to leave to chance, but not big enough to justify a full time IT director.
The cost of a permanent hire is significant. Robert Walters puts IT director salaries in the South of England at between £80,000 and £150,000, and in London at £110,000 to £170,000. Add employer’s National Insurance, which for 2026 to 2027 is 15% on earnings above £5,000 a year, plus pension, benefits and recruitment fees, and the true cost of the seat is considerably higher.
For a business of 30, 50 or even 100 people, that is often hard to justify, particularly when much of the day to day work is already handled by an MSP. The result is a gap. Technology decisions get made by whoever is nearest, usually the MD or FD, on top of everything else they are doing. Nobody owns the bigger picture.
That gap shows up in the national data. According to the government’s latest Cyber Security Breaches Survey, only 31% of UK businesses have someone at board or senior management level with explicit responsibility for cyber security. A fractional IT director fills that seat for a fraction of the cost, for as many days a month as the business genuinely needs.
Month one: discovery
Month one is discovery. The aim is to build an honest, independent picture of where the business actually stands, usually for the first time anyone has done it.
In practice, that means:
Mapping the supplier landscape. Every IT supplier, from the MSP to the phone system provider to the dozens of software subscriptions. Who they are, what they provide, who in the business manages the relationship, and when each contract renews.
Pulling together the spend. Invoices, card payments, direct debits and expense claims, brought together in one place. This is often the most revealing exercise of the whole engagement.
Reviewing contracts. Notice periods, auto renewal clauses, service levels, exit terms and who actually owns the data.
Assessing risk exposure. The basics of cyber security, backup and recovery, access control, supplier dependency, insurance requirements and any compliance obligations.
Talking to people. The leadership team, the people who use the systems every day, and the MSP. The best insights usually come from asking the people closest to the work what frustrates them.
It is common at this stage to find licences being paid for twice, contracts nobody remembers signing, and a genuine surprise at what the total IT spend actually is once it is all in one place. Licence waste in particular is widespread: Zylo’s research found that 53% of software licences go unused within 30 days.
Discovery usually ends with a short report for the board: what we found, what it costs, where the risks are, and what we recommend doing first.
Months two and three: priorities and quick wins
Once the picture is clear, the next step is agreeing priorities with the leadership team. Not everything needs fixing at once, and not everything needs fixing at all.
Typically this produces two things. The first is a set of quick wins: cancelling duplicate or unused licences, closing obvious security gaps such as missing multi factor authentication, testing that backups actually restore, and putting renewal dates in a calendar so nothing auto renews by surprise. Quick wins often go a long way towards covering the cost of the engagement in the first few months.
The second is a short roadmap for the year ahead, covering the bigger pieces of work: renegotiating a key contract, preparing for Cyber Essentials, replacing an ageing system, or resetting the MSP relationship around clear outcomes. The roadmap is written in business terms, with costs, benefits and risks, so the board can make informed decisions rather than approving technical projects on trust.
The ongoing rhythm
From there, the work settles into a regular rhythm. The exact pattern depends on the business, but it usually looks like this.
Every month
Supplier review meetings. The MSP and other key vendors are held to account against agreed service levels rather than simply trusted to be doing a good job. That means looking at ticket volumes and response times, but more importantly asking the harder questions. Are recurring problems being fixed or just patched over? Is the MSP bringing ideas, or waiting to be asked? Are security updates being applied on time?
A check on the risk register. A short, living list of the main IT and cyber risks, who owns each one and what is being done about it.
Availability for decisions. When a question comes up, whether it is a new software purchase, a supplier proposal or a security concern, there is someone independent to ask.
Every month or quarter
A board report. This frames IT and cyber risk in commercial terms the leadership team can actually act on, rather than a technical status update nobody outside IT can interpret. A good board report answers a handful of simple questions. What are we spending, and is it good value? What are our biggest risks, and are they going up or down? What decisions do we need to make? What is coming up in the next quarter?
Every quarter
Renewals and contracts. A look at what is coming up for renewal in the next six months, so there is time to review, benchmark and negotiate rather than accepting whatever lands.
Security and resilience checks. Reviewing access, checking backup tests, and from time to time running a short incident response exercise with the leadership team.
Every year
Strategy and budget. An updated roadmap and IT budget aligned with the business plan.
Insurance and compliance. Preparing for the cyber insurance renewal questionnaire, Cyber Essentials recertification and any customer or regulatory requirements, with evidence gathered in advance rather than under a deadline.
Whenever it matters
The independent voice in significant decisions. Supplier negotiations, contract renewals, system selections, office moves, acquisitions and anything else where technology is a material factor. The point is that the business is never relying solely on the judgement of the people selling it something.
What it is not
It helps to be clear about what a fractional IT director does not do.
It is not a helpdesk. Password resets and broken laptops stay with the MSP or internal support team. The fractional IT director makes sure that support is good, rather than providing it.
It is not a replacement for the MSP. A good MSP remains essential. The role is to oversee and get the best from that relationship, not compete with it.
It is not a reseller. An independent fractional IT director should not be earning commission on the products or services they recommend. If they are, their advice is not independent.
It is not a one off consultant. It is not someone who visits once, writes a report and leaves. It is a standing function that builds knowledge of the business over time, which is what makes the advice better each month.
Who it suits
Fractional IT direction tends to work best for businesses that:
- Have grown past 25 or 30 people and now depend heavily on technology
- Rely on an MSP but have nobody independently overseeing it
- Have a founder, MD or FD still making most IT decisions
- Face growing pressure from customers, insurers or investors about cyber security
- Are planning a significant change, such as a new system, an office move, rapid growth or preparing for sale
A standing function, not a one off
The simplest way to describe the role is this. It is a standing, independent function that sits above the day to day IT support relationship and makes sure someone is asking the harder questions on an ongoing basis.
Most businesses do not need that every day. But they do need it every month.
If you are not sure what your business spends on IT in total, or who is holding your suppliers to account, it is worth a conversation.