Study: MSPs Are Taking Legal Risks

But according to a recent study by the MSP Alliance, some of the companies providing managed services to users don't take legal protection seriously enough. In some cases, companies forgo legal counsel in drafting contracts, thereby exposing themselves to potential legal trouble, while in other cases no contracts are in place at all.

By failing to protect themselves legally, companies decrease the value of their business, said Rob Scott, managing partner at law firm Scott & Scott in Dallas, specializing in IT industry legal matters.

The valuation of MSP businesses' proper documentation is considerably higher than that of a traditional VAR focused on product sales and break/fix services, he said. But the value drops if the MSPs don't have the proper legal protection and business documentation, Scott said.

"The documents themselves have a direct correlation to the value of the business on the one hand, and how the business is perceived, on the other hand," Scott said. "The more professional your document looks, the better perceived you're going to be."

And that helps when a business is looking for lines of credit or searching for real estate, he said. A high valuation also is important when the time comes to sell the business.

Click here to read more about how some MSPs are gambling with the law.

Proper legal protection and documentation typically take the form of master service agreements, which spell out the MSP's responsibilities to the client, and SLAs (service-level agreements), which commonly guarantee certain levels of service and minimized disruptions to a client's business.

Fifteen percent of companies delivering managed services to clients through contractual arrangements don't have anything on paper to formalize their customer relationships, according to the research by the MSP Alliance, in Chico, Calif.

Of the MSPs that have formal master services agreements, about 25 percent did not use an attorney to prepare the contracts, relying instead on consultants, a company executive or an internal team of managers, the alliance found in a recent survey.

That, said MSP Alliance President Charles Weaver, puts those companies at risk, because whoever drafts the documents may not have had the necessary legal knowledge to make the contracts rock-solid.

The same holds true for those companies that lack SLAs, he said. The alliance study found that 40 percent of MSPs do not have these agreements, and of those who do, 45 percent said they used an attorney to prepare them. In addition, 40 percent don't even ask their customers to sign the agreements.

That compares to 10 percent of MSPs with master service agreements in place that haven't gotten around to having their customers sign them, according to the study.

"You want to talk about high-risk behavior, that is just reckless, in my view," Scott said.

As with master services agreements, companies that didn't use a lawyer to prepare their SLAs said they relied on consultants, a company executive or an internal team of managers.

Ten percent of the companies that participated in the MSP Alliance study did not provide managed services but partnered with MSPs to resell them. About 63 percent of them said they had nothing in writing with their MSPs, and 36 percent said they did not inform their clients they were actually reselling the services as opposed to providing them themselves.

"I think that's extremely dangerous," Weaver said. The lack of a contract, he said, puts everyone involved at risk, from the MSP to the company reselling the services to the customer.

Seventy-five percent of participants said they had business liability insurance, while 10 percent said they did not know if they had it. Thirty-seven percent of study participants said they were covered for security breaches and 50 percent said they did not know.

Weaver said MSPs have to revise their attitude toward contracts. Considerable improvement is called for if the MSP industry has any hope of being viewed as a legitimate body of professionals, he said.