The real cost of a one-man IT department
By Steven Quayle
The visible cost of running a company's IT on one person is a single salary line. The real cost is that salary plus everything the business quietly absorbs around it: the fortnight nobody covers, the purchase nobody questions, the security work nobody audits, and the projects that never start because the same person is always fixing something.
None of that sits in the budget. Most of it arrives in the year the arrangement finally breaks.
What the salary line actually buys
Start with the number you already know, then correct it. Public salary aggregates put a mid-level system administrator in Western Europe inside a wide band, and what sits on top of it matters more than the band itself. Once employer contributions, tool licences, training and some form of holiday cover are counted, a fully loaded cost of roughly 1.4 to 1.6 times gross salary is a sensible planning assumption. Apply that multiplier to your local range for the real budget figure.
What it buys is one person's attention, one person's judgement and one person's availability. It is not an IT function. A function has cover, a second opinion, and someone whose job is to check the first person's work.
The fortnight in August when nobody is watching
Infrastructure does not take annual leave. Mail queues fill, backups fail quietly, a laptop dies in accounts, and the person who understands all of it is somewhere with poor signal. Sick leave is worse than holiday, because it cannot be planned around the reporting cycle.
Most owners solve this informally: they ring the sysadmin anyway, and it works, because the person is decent and nobody has costed the alternative. That is not cover, it is goodwill.
Cover is why many mid-size companies keep an internal person and still put a retainer in place with an outside team. In that model the account is served by a group of engineers rather than an individual, so one person's leave stops being an event for the customer; an international IT integrator such as senseti.com, working across Ukraine and Europe, is structured that way. The point is not the supplier but the shape: cover has to exist somewhere, and right now it exists in one person's diary.
Everything holds until the day the person leaves
This is the cost that stays at zero for years and then arrives in full. The network layout, the router password, the provider contact who actually answers: all of it lives in one head, and the documentation, if it exists, describes a system from two rebuilds ago.
A resignation with notice is the good version. The bad ones are illness, a dispute, or a Friday offer from a competitor. What follows is always the same work: change every administrative password, chase down subscriptions registered to a personal email address, pay a newcomer to reconstruct decisions nobody wrote down. In handovers the slow part is rarely technical. It is the archaeology.
There is a quieter version of the same risk: the person does not leave, they become impossible to challenge. You cannot push back on a quote or a working practice, because nobody else can tell you whether the answer is right.
No second opinion on anything you buy
Every quote in a one-man setup is evaluated by the person who will implement it. That is not a suspicion of dishonesty, it is the plain absence of a check. Specifications drift towards what the individual already knows: the vendor they trained on, the renewal nobody questioned, the server sized for a load that never arrived.
A facilities manager would not accept a single-source quote for a chiller replacement without a second view on the specification. IT gets a pass because nobody else in the room can read the document, and the sums are small enough to approve without a fuss, large enough to matter across five years.
Security debt is the bill nobody sends you
Ask a one-person IT department what got done last month and you will hear about tickets: laptops, printers, access requests. Ask what got verified and the answer thins out. Patching runs behind, multi-factor authentication is on for some services and not others, leavers keep mailbox access, and backups are configured but restores have never been tested.
The National Cyber Security Centre's guide for small organisations sets out basics most companies could work through in a few weeks. The obstacle is never the list. It is that nobody owns the job of confirming those things are still true, and an administrator with a queue of user problems will always do the visible work first. That is rational behaviour, and it produces debt.
The project list that never moves
Anyone who runs maintenance knows the pattern: when everything is reactive, nothing planned gets done. IT behaves identically. The site rollout, the network refresh, the move off the spreadsheet four departments depend on: all of it slips a quarter at a time, because interruptions beat improvements. The cost is invisible: it is the improvement that did not happen. Companies feel it as a vague sense that IT is slow, when the roadmap simply has one person on it and that person is fully committed to keeping today working.
The point where one person stops being enough
Load does not grow smoothly, it arrives in steps, and the step is usually a business event rather than a headcount threshold. Common triggers:
a second site, warehouse or production line comes online;
a customer or insurer sends a security questionnaire that has to be answered truthfully;
hybrid working turns a local network into an access management problem;
a nice-to-have system becomes the system orders flow through;
onboarding moves from occasional to weekly, and accounts are still built by hand.
One trigger is survivable. Two or three inside a year mean the company has outgrown the arrangement, whatever the org chart still says.
Three ways out, and what each one buys
Hiring a second person doubles the visible cost and roughly halves the risk. It is right when there is genuinely a second full workload, not a second pair of hands for busy weeks, and someone is prepared to manage a team. The market matters too: ICT specialists are a growing share of employment across the EU according to Eurostat's statistics on ICT specialists in employment, which is a polite way of saying the vacancy can stay open for months.
Outsourcing the whole function converts a fixed salary into a contracted service and buys breadth: nobody expects one employee to be equally good at firewalls, mail security, virtualisation and backups. What you lose is informal availability, the person who walks over and looks at the machine. The contract now carries the risk, so read it for the unglamorous clauses: documentation belongs to you, accounts and licences are registered to the company, response commitments are written down, and exit terms exist before you need them.
The hybrid is the most common answer in the 20 to 60 seat range, less a compromise than a division of labour. The internal person keeps the floor: users, devices, onboarding, the daily rhythm of the business. An external team owns servers, security, backups and projects. Both sides know things the other does not, which is the point: the failure mode being removed is one person holding everything.
When one sysadmin is genuinely the right answer
Most articles on this subject never concede this, which is why owners distrust them. There are situations where a single internal specialist beats every alternative:
production or laboratory sites where specialised equipment needs someone on site who knows the machinery;
companies whose product is their own software, where the knowledge has to sit inside the business;
contractual or regulatory constraints that keep data access with employees only;
a strong administrator whose workload genuinely fits one job, where a supplier would add coordination and nothing else.
In those cases the task is not to replace the person but to remove the single point of failure around them, starting with a named arrangement for who steps in during absence: an emergency-only retainer, a peer at a partner company, or an agreement with a supplier you already use.
How to price the decision in an afternoon
Three numbers settle most of this without a consultant.
The first is the loaded cost: gross salary multiplied by 1.4 to 1.6, plus the tool licences, often paid on someone's card and never reviewed. The second is cover: go through last year's calendar, count the working days the person was absent, and write next to each block who actually did the work. If the honest answer is “nobody, it waited”, you have found unpaid downtime that has been running for years.
The third is the value of an hour when things stop. Take the payroll of the departments that cannot work during an outage, divide by monthly working hours, and multiply by a realistic length for your worst recent incident. One bad day usually costs more than a month of external support.
Then ask the question no arithmetic replaces. Not a resignation, just a week off sick: who has the passwords, who knows where the backups live, whose name is on the domain? If the answer is the same person three times, what is on your desk is not a cost question but an operational risk with a salary attached.
What to fix this month, whichever route you take
Four things cost nothing and hold their value under any model. Write down what you have: servers, subscriptions, domains, licences, and who each is registered to. Move anything sitting on a personal email address into a company account. Restore one real file rather than confirming that backups are configured. Then put in writing who covers IT during absence, and check that person exists.
The choice between hiring, outsourcing and a hybrid is a second-order decision that will look different in twelve months anyway. The first-order question is less comfortable: can this company operate normally for two weeks without one specific individual? Everything in the budget follows from that answer.
