M&A · Blog

Bolted On, Then Built In: An Operations Diagnostic

Four honest questions any operator can run on their own IT over a coffee. The point isn't to score yourself. It's to know what you're carrying.

For: Operators + Operators (M&A-active)

Bolted On, Then Built In: An Operations Diagnostic
OPERATIONS June 11, 2026 ~6 min read

Bolted On, Then Built In: An Operations Diagnostic

Four honest questions any operator can run on their own IT over a coffee. The point isn't to score yourself. It's to know what you're carrying.

FOR: Operators · 25–200 people · running on stitched-together IT

By Will McCabe · Managing Partner · Vencer Group

Quick answer

Bolted on is where every smart operator starts. It's not the villain. The villain is IT that never made the second move, that's still sitting beside the business three years later instead of inside it. Below are four questions you can run on your own setup over a coffee, no salesperson required. If two of them feel rough, that's not a problem to fix today. That's data on whether your IT has outgrown bolted-on or not.

Every business I've watched grow from twenty people to two hundred started with IT that was bolted on. Somebody bought a laptop. Somebody else bought a server. A third person picked the accounting system because their last firm used it. That's how it should start. You don't custom-build an IT operating system for a company that hasn't proven it'll exist in eighteen months. You buy what you need, you wire it up, and you run.

The problem isn't that IT got bolted on. The problem is that, three years later, in plenty of businesses, it's still bolted on. The company grew, the contracts got bigger, the headcount doubled, the field teams went from two trucks to twelve, and the IT kept the same shape it had on day one. Bolted on the side. Working, mostly. Until it doesn't.

You don't need a consultant to tell you whether you're carrying that. You need twenty minutes, a coffee, and four honest questions. Here they are.

1. If your senior IT person resigned on a Tuesday, who else knows where the keys are?

Not who's nice. Not who's willing to help. Who actually has the passwords, the vendor contacts, the backup configuration details, the firewall rules, and the answer to "where do we keep the spare laptop"?

If the honest answer is "just Mike, and Mike's been here eight years," your IT is bolted on. It works, but it's running on one person's brain. That's not an IT problem, that's a key-person risk problem. The good news: it's fixable in a quarter. The bad news: you won't fix it until you say it out loud.

2. When something breaks at 7am on a Tuesday, what do you actually do for the next 90 minutes?

Walk it through, step by step. The field crew can't log in. Production reporting is down. Whatever it is.

If the answer involves the words "I'd call Mike," "I'd email the MSP and wait," or "we'd be calling around," that's bolted on. The IT exists, but it doesn't have a circuit. There's no playbook, no monitoring that already saw it before you did, no team that picks up the phone before you call.

If the answer is "the monitoring would have flagged it at 6:40, a tech is already on it, and somebody texted us with an ETA before we noticed" - that's built in. That's the second move.

3. Walk me through the last time IT changed how a job actually got done in the field.

This one's the cheater question. Bolted-on IT keeps the lights on. Built-in IT changes how the work happens.

The last time something on the IT side actually made a job faster, safer, cheaper, or easier to bill - when was that? If you can't name it in the last ninety days, the IT is running parallel to the business, not inside it. It's the plumbing. Plumbing is fine. Plumbing is necessary. But plumbing isn't an operating system.

If you can name it - mobile workflow that cut JIB reconciliation by a week, a permit-tracking change that saved a $40K standby day, an AI tool a CFO actually uses every Tuesday - you've got integration. That's built in. Now the question is whether you're doing one of those things a year, or one a quarter.

The honest take
Bolted on isn't the enemy. It's the starting line. Every operator I respect started there, because building custom on day one is how startups die before they're real. The villain is the IT that never made the second move - the setup that worked at twenty people and is still the same setup at a hundred and twenty, only now it's held together by Mike, prayer, and one annual review nobody reads. If three of these questions felt rough, you haven't failed at anything. You've just found the line between where you were and where you are.

4. If you sold the business in 12 months, what would diligence find that surprised you?

I know - nobody's selling. Run it anyway, because diligence is just an honest stranger looking at your IT with a flashlight.

Three things show up in almost every transaction we've sat inside, and the seller's team almost always knows about exactly none of them in advance:

A vendor contract with a tail. Twenty-four months left, change-of-control penalty, and nobody on the seller's side remembers signing it. The buyer prices it in. The seller loses a multiple turn they didn't see coming.

The MSP that markets "24/7 monitoring" and delivers voicemail. Diligence catches it. The buyer's cyber team wants the relationship terminated as a condition of close. Now you're rewriting a vendor strategy in week six of diligence, which is a terrible time to rewrite a vendor strategy.

A backup configuration nobody has verified is actually working. Two of the three monthly verifications failed last quarter. Nobody escalated. The buyer's team finds the failed tickets in twenty minutes.

The reason this question is on the diagnostic isn't because you're selling. It's because diligence finds what daily life papers over. Running the question on yourself is just an honest look at what you'd want to know before someone else made you look.

What to do with the answers

Don't score yourself. The point isn't a number. The point is: now you know what you're carrying.

If one or two questions felt off, you're probably fine. Every operator has a soft spot. Address the soft spot when you can. The IT is doing its job.

If three or four felt rough, you've outgrown bolted-on. That's not a crisis - it's just where the business is now. The next conversation is whether to make the second move, what that looks like, and what it would cost relative to what bolted-on is already costing you in slow days, key-person risk, and surprises.

If you want a structured version of this same diagnostic, we built one. It's called The Vencer Operating System and it's the longer answer to the same four questions, with a framework for the second move. No strings - the eBook is free and the diagnostic that comes with it is free too. If both sides aren't better off, it's not worth doing. That includes whether reading what we wrote is worth your hour.

Or just answer the four questions over a coffee with somebody you trust. That's the version of this work that doesn't involve us at all, and it's still useful. The point of the diagnostic isn't that you call us. The point is that you know what you're carrying.

Notes & Methodology

About these figures: Industry data in this article is either from named external sources cited inline with what each report measured, or from Vencer Group estimates derived from observations across recent client engagements - framed explicitly with "approximately" or "(Vencer Group estimate)" so the basis is visible. Vencer's own operating data (transaction count, breach record, tenure) is drawn from Vencer's record. Cost ranges reflect the spread between low-complexity and high-complexity operators based on the Vencer client sample.

The part where our lawyers smile

Pattern recognition from 19 years of running operator IT - not prescription for your specific situation. Anyone offering prescription from a blog post is selling something. (Possibly to you.) The 30-min Strategy Review is where the pattern becomes specific to your operation. Free, no proposal, no slide deck.