There is a structural gap in many outsourced IT arrangements, and it forms quietly. An organisation outsources to an MSP. Over time, the internal IT capability that once oversaw that relationship thins out — people leave and aren't replaced, because "the MSP handles it". Eventually the provider is not just delivering the service but defining the roadmap, setting the priorities, writing the reports and presenting its own scorecard. The player has become the referee.
No individual decision along the way was wrong. The end state is. And it is the client's problem, not the provider's — because guidance and regulation alike place the assurance burden firmly on the customer side of the table. The NCSC's supply chain framework is built on the premise that organisations must actively assess and gain confidence in their suppliers' security and delivery on a continuing basis — not delegate that confidence to the supplier being assessed. The stakes behind that premise are well evidenced: in one survey of 500 senior information security professionals, 57% of organisations reported a breach arising from a supply chain compromise, and managing third-party risk ranked among their top challenges.
Regulation is moving to close part of the gap. The UK's Cyber Security and Resilience Bill brings managed service providers into statutory scope for the first time, reflecting the regulator's view that MSPs' privileged access to client systems makes them a systemic risk. This is welcome. It is also worth being precise about what it does and doesn't do. Regulation sets a security floor for providers. It says nothing about whether your specific provider is delivering value, whether the commercial terms still make sense, or whether the roadmap serves your business or theirs. Compliance is not performance. A regulated MSP can still be an expensive, mediocre one.
Closing the rest of the gap requires capability on the client side, and there are two forms of it — one periodic, one standing.
The periodic form is independent inspection: a structured, evidence-led review of what the provider is actually delivering across commercial, operational, risk and strategic dimensions, conducted by someone with no stake in the answer. The corporate world settled this principle long ago for financial reporting — the accounts are prepared by one party and audited by another, and nobody considers that an insult to the finance team. Applying the same separation to a six- or seven-figure technology relationship is not distrust. It is governance.
The standing form is senior technology leadership that sits on your side of the table — someone who owns the relationship between inspections, challenges the roadmap, reads the service data with an informed eye, and represents your interests at renewal. For organisations too small to justify a full-time CTO or IT director, that has historically meant going without. Fractional leadership exists to close exactly that gap: senior direction, sized to the organisation, accountable to you and not to the provider.
The two are complements, not alternatives. An inspection tells you where the relationship actually stands; embedded leadership makes sure it stays there. What matters is that at least one of them exists — because an MSP relationship in which the provider writes its own report card, unread by anyone qualified to challenge it, will drift in exactly one direction. Not through malice. Through the absence of anyone marking the homework.