When someone says, "I really need to audit our shared drives," and you ask when they decided to do it, the answer is often "six months ago."
During those six months, there were three new hires, two departures, and one department merger. While the things that must be done keep multiplying, only the list of untouched tasks grows longer. When juggling account provisioning, printer troubleshooting inquiries, and month-end billing tasks, this outcome is inevitable.
According to a survey by Nork Research, 24.5% of mid-sized and small businesses have a "one-person IT team" with only a single IT administrator, an increase of 3.2 percentage points over the past two years. Another survey indicates that roughly 60% of IT personnel hold concurrent responsibilities in other business functions. This is not a question of capability, but purely of headcount.
Stalling between "having them handle everything" or "doing it all yourself"
Discussions about bringing in external help typically stall because only two options are placed on the table.
Thinking of outsourcing everything results in a high quote that cannot pass internal approval. Deciding to do it all yourself simply rolls the currently stalled task list over into the next month. In reality, a clear dividing line can be drawn between these two extremes.
Drawing this line based on "frequency" leads to failure. Dividing tasks into "doing daily tasks in-house and outsourcing rare occurrences" may seem reasonable at first glance, but it outsources the most dangerous work. Tasks that happen infrequently have less standardized procedures, and the impact of a mistake is far greater.
The axis to use is: who will be in the position to explain things when systems halt or mistakes occur.
Dividing into three categories
What to keep in-house
This covers areas where outside parties cannot answer on your behalf.
- Deciding who gets what permissions (the decision, not the execution)
- Channels for receiving departure and transfer notifications
- The role of answering inquiries from auditors or business partners
- Ultimate retention of super administrator accounts
If you outsource the decision-making itself, no one inside the company will be able to explain later why a specific person has certain permissions. You can delegate operational tasks, but you cannot delegate decisions.
What can be outsourced
Tasks for which procedures can be documented, and one-off tasks that require specialized expertise.
- Auditing shared drives and link sharing (identifying links left open to the outside becomes more valuable to outsource as volume grows)
- Designing handling procedures for departed employee accounts (creating runbooks based on what is lost if accounts are abruptly deleted)
- Reviewing current security settings and identifying gaps against the desired state
- Impact assessments when new features arrive
These are not "monthly routines" but rather things to "execute thoroughly once, then run according to procedure thereafter." For a one-person IT team, finding time for this "execute thoroughly once" step is the hardest part.
The middle ground
Handling user inquiries. This is where judgment divides.
Outsourcing the internal help desk causes inquiries to double while users get accustomed to the external contact point. Employees ultimately end up asking the IT person sitting right next to them. If you outsource this, workload will not decrease unless management is involved in communicating the transition of the contact window.
The order of tasks to outsource
Rather than outsourcing the heaviest tasks first, start with tasks that produce documented runbooks.
- Visualize current status. Have an external partner document who holds what permissions, what is open externally, and what settings remain at defaults. Without this baseline, you cannot determine what to delegate next.
- Clear one stalled audit task. Choose either shared drives, user accounts, or third-party app connections. Complete one, and have them produce a runbook alongside it.
- Hand over routine tasks that follow runbooks. Because runbooks were created in step 2, you can define the handover scope in writing. Requests without clearly written scopes inevitably lead to friction later.
- Handle user inquiries if necessary. Only after reaching this stage does splitting the contact desk become practical.
The advantage of this sequence is that you can stop after steps 1 and 2 are complete. Before entering an ongoing contract, you retain the status assessment findings and documented runbooks.
Three points to verify before contracting
Ownership of super administrator accounts. Even when outsourcing operations, your company must retain the top-level accounts. Assign contractors only the necessary administrative roles. Surrendering full control leaves you unable to access your own tenant upon contract termination.
Where audit logs are preserved. Ensure that who changed what, and when, can be verified directly in your own Admin Console. Relying solely on contractor activity reports prevents you from providing primary evidence during audits.
Offboarding procedures. Establish upfront how permissions will be revoked and how documentation will be handed over when ending the contract. As with maintenance contracts for line-of-business systems, disputes arise far more often over termination terms than inception terms.
Common pitfalls
The notion that "dumping everything on an expert makes life easy" does not hold up. The more capable a contractor is, the more up to date your internal settings remain, yet this entrenches a state where no one internally can explain those settings. Even if only once a month, reserve time to receive change reports and understand them yourself.
Do not tighten security settings all at once. Reviewing the current state often reveals around 20 items to fix. Applying them all at once will disrupt business operations the following day. Establish priorities for setting items and apply them starting with those having minimal impact.
What to do next
Write down every item you currently feel you "need to do but haven't touched." If you list five or more, it is no longer a matter of time; it is a structural capacity issue.
Once written down, append a one-line note to each: "Is this something I must decide, or something anyone can do if given a procedure?" Items classified as the latter define your outsourcing scope.
GleamHub offers free IT and Google Workspace consultations covering permission and sharing audits, designing offboarding and transfer procedures, and planning what responsibilities to retain in-house. Because the appropriate approach varies by organization size and current operations, scopes are estimated individually. Please reach out via our contact form.
Sources
- 24.5% of mid-sized and small businesses have a "one-person IT team", up 3.2 points in the past two years — Nork Research — IT Leaders
- Mid-sized enterprises see growth in zero- and one-person IT teams, with 60% of IT personnel juggling dual roles — Dell EMC IT investment survey — EnterpriseZine
- How to resolve security challenges facing understaffed IT teams — NEC Nexus Solutions
- Top security recommendations for administrators — Google Workspace Admin Help
