5 Exclusions Every IT Consultant Forgets (And How They Cost You)

Scope creep doesn't announce itself. It arrives as a friendly Slack message: "Hey, while you're here, can you also…" or a confused call three weeks after go-live: "Wait, I thought you were handling that too?"

Most scope creep is preventable. It happens not because clients are dishonest but because they genuinely assumed your project covered something you assumed it didn't. The solution is a well-written exclusions section in your SOW — specific, numbered, and reviewed with the client before work starts.

Here are five exclusions that experienced IT consultants forget to write down, and the real-world scenarios that make each one painful.

1. ISP Coordination

What clients assume: You will handle everything related to getting their internet working correctly after the project.

What actually happens: An MSP completes a firewall replacement for a manufacturing client — new Fortinet FortiGate replacing an aging SonicWall, clean config, full testing on the bench. Installation day goes smoothly. Then the client's SD-WAN fails to route correctly because the ISP's BGP peering was configured for the old firewall's MAC address and WAN IP. The ISP needs 72 hours to update their end. The client blames the MSP. The MSP spends 6 hours on the phone with Comcast Business and Cox enterprise support chasing escalations that have nothing to do with their work.

The scope creep cost: 8–15 hours of unplanned senior engineer time, plus client relationship damage from an outage that looks like it's your fault but technically isn't.

What to write in your SOW:

"ISP coordination, circuit provisioning, and BGP or routing configuration changes at the carrier level are excluded from this engagement. ISP-side changes required to support this project are the client's responsibility to initiate. Estimated ISP lead times for configuration changes range from 2–30 business days depending on carrier and circuit type. The MSP will provide technical requirements documentation for the client to submit to their ISP."

Note: if you're willing to coordinate with the ISP, price it as an add-on. ISP coordination typically runs $500–$1,500 depending on circuit complexity, and clients are often happy to pay for it when it's a clear line item.

2. End-User Training

What clients assume: After you deploy the new system, you'll make sure everyone knows how to use it.

What actually happens: A law firm brings you in to migrate from Google Workspace to Microsoft 365. The migration goes perfectly — mailboxes moved, SharePoint provisioned, Teams deployed. Two weeks after cutover, you start getting calls. "How do I find my shared calendar?" "Where did my Google Drive shortcuts go?" "Teams keeps showing me notifications, how do I turn that off?" The office manager escalates to the managing partner: "Your IT people left us with a system nobody knows how to use."

Forty-five hours of informal hand-holding later, you've effectively donated a week of billable time to end-user training that was never in scope.

The scope creep cost: End-user training for a 50-person firm runs $3,000–$8,000 as a formal engagement. When it happens informally through support calls and ad-hoc desk visits, MSPs typically absorb 60–80% of that cost uncompensated.

What to write in your SOW:

"End-user training is excluded from this engagement. The MSP will provide a technical handoff document and administrator-level orientation session for the client's designated IT contact. Training end users on new applications, workflows, or features is outside the scope of this project and can be quoted separately as a training engagement."

Follow through by offering a formal training add-on. A structured half-day M365 training session for office staff is a $2,500–$5,000 add-on that clients will readily purchase when it's presented as a distinct service.

3. Electrical and Cabling Work

What clients assume: "IT infrastructure" means you handle all the physical stuff too.

What actually happens: You scope a server room buildout for a regional accounting firm — new rack, UPS, top-of-rack switching. On installation day, you discover the server room has a single 20-amp circuit shared with the coffee maker down the hall. The UPS needs a dedicated 30-amp 240V circuit. You either stop the project (creating a delay the client blames you for) or call in an electrician on short notice (paying their emergency rate and eating the cost to keep the project moving).

Or the classic scenario: you quote a wireless access point deployment covering a 15,000 sq ft warehouse. The client expects you to run Cat6A from each AP location back to the IDF. That's structured cabling — a licensed trade in most jurisdictions — and it wasn't in your quote because you were quoting AP configuration and mounting, not cabling infrastructure.

The scope creep cost: Emergency electrical work runs $150–$300/hr. A proper structured cabling run in a commercial building (conduit, plenum-rated cable, termination, labeling) is $200–$500 per drop. A warehouse AP deployment might need 20–30 drops — that's $4,000–$15,000 in cabling work that never appeared in the original quote.

What to write in your SOW:

"Electrical work, including installation of new circuits, panel modifications, conduit installation, and grounding systems, is excluded from this engagement and requires a licensed electrician. Structured cabling (horizontal runs, cable pulling through walls or conduit, punch-down terminations, and certification testing) beyond pre-terminated patch cables is excluded. The MSP will provide cabling requirements documentation that can be used to obtain a cabling subcontractor quote."

4. Third-Party Application Integrations

What clients assume: Getting "the new system" working means everything they currently use will keep working.

What actually happens: An MSP completes an on-premises to Azure migration for a healthcare client. The migration covers their file server, print server, and Active Directory. Sign-off is clean. Two weeks later, the client's practice management software — a niche healthcare EHR that authenticates against a local AD OU with specific Group Policy settings — stops working. The EHR vendor blames the MSP. The MSP's engineer spends 12 hours tracing Kerberos authentication issues through Azure AD DS that have nothing to do with the original project scope.

Or the scenario most MSPs have lived: "While you're migrating to M365, can you also make sure our Salesforce integration keeps working?" That Salesforce integration uses OAuth against a custom domain, and the email domain change breaks it. Salesforce integration re-configuration is a $2,000–$4,000 professional services engagement on its own.

The scope creep cost: Third-party integrations are black boxes. You don't control the vendor's architecture, their support queue, or their documentation quality. A single integration issue can consume 20+ hours of highly skilled engineer time with no predictable end point.

What to write in your SOW:

"Integration with third-party applications, platforms, or services not explicitly listed in this scope document is excluded. This includes but is not limited to: ERP systems, CRM platforms, line-of-business applications, VoIP systems, building management systems, and cloud-based SaaS tools. The MSP will document integration dependencies identified during discovery; each integration requiring reconfiguration will be scoped and quoted separately."

Then actually do the discovery. Spend two hours before proposal writing asking "what software does your team use every day?" A complete application inventory during scoping catches most of these issues before they become disputes.

5. Ongoing Maintenance and Break-Fix Support

What clients assume: The MSP who built it is now responsible for keeping it running.

What actually happens: You deploy a new Hyper-V cluster for a distribution company. Beautiful project — redundant nodes, Storage Spaces Direct, proper DR plan documented. Three months later you get a call: a VHDX is showing errors and they want you to fix it. You're not on a managed services agreement. But you built the system. And the client can't fathom why you'd charge them to fix something "you installed."

This is the most insidious form of scope creep because it's not a single event — it's a permanent unpaid support relationship that clients feel entitled to because of the project relationship. An MSP with five active project clients who each make one "quick call" per week is absorbing 10–15 hours of uncompensated support labor monthly.

The scope creep cost: At $150/hr blended rate, 12 hours/month of informal post-project support costs $1,800/month, or $21,600/year across a small client base. That's a half-FTE of lost revenue.

What to write in your SOW:

"This engagement covers project implementation and a 30-day post-implementation support window for issues directly related to the work performed. Ongoing maintenance, break-fix support, monitoring, patching, and helpdesk services are not included. Clients requiring ongoing support are encouraged to discuss a Managed Services Agreement (MSA) to ensure continued coverage at a defined SLA."

Then use project completion as the opportunity to sell the MSA. A client who just had a successful project experience is the warmest lead for managed services you'll ever have.

Stop Letting Scope Creep Eat Your Margins

Every one of these exclusions is a missed line item that turns a profitable project into a break-even or loss. Writing them into every SOW takes less than five minutes and prevents disputes worth thousands.

ScopeDrafts automatically includes industry-standard exclusions for each IT project type — network refresh, cloud migration, server deployment, wireless, and more. Stop drafting exclusions sections from memory at 10pm the night before a client meeting. Try it free at scopedrafts.com.