We look at a lot of invoices from other providers. Usually it happens during an assessment, and the pattern is consistent enough to be worth writing down: the owner can tell us roughly what they pay each month, and cannot tell us what any individual line is for.
That is not a failure of attention. Most IT invoices are written for the accounting system that produced them rather than for the person paying. But an invoice you cannot read is an invoice you cannot check, and unchecked bills are where the quiet money goes.
Here is how to read yours.
Start with the count, not the price
Almost every recurring IT charge is a unit price times a number of units. The number is usually users, devices, mailboxes, or servers. Before you look at any dollar figure, find the counts and check them against reality.
This is the single most productive thing an owner can do with an IT bill, because counts drift in one direction. People leave and the seat stays billed. A laptop is retired and the management fee for it keeps running. A server gets decommissioned and the backup line for it survives for another year. Nobody is being dishonest; the count was simply never reconciled against what you have.
If your invoice does not show counts at all, that is your first question. A bill that says only "managed services" and a total is not telling you what you bought.
Separate the three kinds of line
Once you can see the units, sort the lines into three groups.
Recurring service is what you pay every month for the arrangement itself: monitoring, patching, maintenance, and access to support. This should be stable and predictable, and it should be obvious which units it applies to.
Pass through subscriptions are things your provider buys on your behalf and rebills to you. Microsoft 365 licenses, backup capacity, email security, cybersecurity tooling, domain and certificate renewals. These are legitimate, and they should be identifiable as what they are.
Project and time based work is everything else: the migration, the new firewall, the after hours cutover, the hours spent on something outside the agreement. This should be occasional and it should reference something you agreed to in advance.
A healthy invoice makes the three groups visually distinct. If project work is folded into the recurring line, you cannot tell whether your monthly cost went up because you bought something or because your provider raised prices.
What belongs on a clear invoice
- The billing period, stated plainly, including whether the recurring portion is billed ahead or behind.
- Each recurring line with its unit, its count, and its unit price, so the arithmetic is visible.
- Licenses named as licenses, with quantity and the product they belong to.
- Project and hourly work with a date, a short description, and a reference to the quote or approval it came from.
- Any pass through cost identified as a pass through.
- The contract or agreement reference, so the invoice can be checked against what you actually signed.
None of that is exotic. It is what any competent professional services bill looks like, and the reason IT bills so often fall short of it is habit rather than intent.
The four lines worth questioning
Seats you no longer have. Covered above, and it remains the most common finding. Ask for a list of the named users and devices being billed and read it. You will recognize the names on it, which is exactly what makes this check easy for a non technical owner to run.
Licenses billed at a markup you were never told about. Reselling licenses is normal and marking them up is defensible, particularly when the provider is managing them. What is not defensible is not being able to find out. Ask what a license costs you per user per month and what the provider pays. A provider who will not answer that has told you something.
Vague bundles. A single line that reads "managed IT services" for a large round number, with no unit and no count, is the invoice equivalent of a shrug. It might be a perfectly fair price. You just have no way to know, and neither will the next provider you ask to quote against it.
Work you thought was included. This is the one that causes actual arguments. Find out where your agreement draws the line between covered support and billable project work, and check a few recent time entries against it. If the line moves depending on who you ask, that is worth resolving before the next large piece of work rather than after.
The question that clears up most confusion
Ask your provider for a one page summary of your agreement in plain language: what is included, what is billed separately, what the counts are, and what happens when the counts change.
This is not an aggressive request. It is the document a well run provider already has, and producing it takes very little time. The response is informative either way. Some providers send it the same week. Some cannot produce one, which usually means it does not exist internally either.
Why any of this matters
Two reasons, and only one of them is money.
The obvious one is that unreconciled counts and unexplained bundles cost a small business a real amount over a few years, and the amount is invisible precisely because it arrives in monthly instalments.
The less obvious one is that an invoice is a decent proxy for how a provider operates. A bill with accurate counts on it comes from a provider whose records match your environment. A bill that has been billing you for two departed employees since spring is telling you something about the documentation behind it, and about whether anyone is looking at your account when there is no ticket open.
That second reason is why we go through the invoice during an assessment. It is one page, the client already has it, and it is often the fastest way to understand what has actually been happening.
If you want a second read on your current bill, that is part of the assessment we do before anything changes. You keep the write up regardless of what you decide afterwards. It also pairs well with the real cost of running several separate vendors, which is the version of this problem where there is no single invoice to read at all.