Fine Is the Most Dangerous Word in IT Consulting

When did someone last look at your IT environment with no stake in what they found? 

That is the question that comes up most in my first conversation with a CFO in the resources sector. Not because I ask it. But because once we start talking about where the technology decisions in their business actually get made, it surfaces on its own. 

Usually, just before they tell me everything is fine. 

It’s no dramatic risk, breach or system failure. It’s quieter. The kind that sits underneath a business running well enough today but carrying decisions that were made years ago, for a version of the operation that no longer exists. 

That is what an IT consultant is actually there for. Not to fix things. To look at your environment the way a structural engineer looks at your site. To tell you what the current state of play is, and whether what is holding the place together was built to carry this much weight. 

That is worth sitting with for a moment. 

Running well today is not the same as being built for where the operation is heading. 

What Does an IT Consultant Actually Do That My Current IT Setup Does Not? 

Your IT support keeps things running. An IT consultant tells you whether what is running is still right for where the business is heading. 

Think of the difference this way. Your IT support team is the maintenance crew on site. They are there to keep the equipment operational. 

An IT consultant is more like a structural engineer. They walk in, look at what the maintenance crew has been working with, and decide whether the foundations are still sound for the scale of the operation you are now running. 

Is My IT Set Up for the Operation I’m Running Now, or the One I Started With? 

Probably the latter. The IT environment in most resource businesses is a snapshot of where the operation was when it was first commissioned. Not where it is now. 

I have reviewed a lot of IT environments across mining and energy businesses, and the pattern is consistent. The operation has grown. New sites have come online. Contractor numbers have expanded. The data coming from operational technology has multiplied. And underneath it all, the IT infrastructure is still running on what made sense when the business was half the size. 

In my experience, the last time anyone formally reviewed the setup was either ‘when we moved offices’ or ‘I’d have to check.’  

It is almost always one of those two answers. 

Can an IT Consultant Help With More Than Just My Technical Problems? 

Yes. The technical problems are usually a symptom. The real issue is almost always a business decision that was made without adequate independent input. 

An energy business approaching a SOCI Act compliance review came to me believing their IT environment was broadly in order. What the review uncovered was OT systems connected to the corporate network during a site expansion, without the segregation controls that the connection required. 

Nobody had signed off on it or flagged it, and that is not unusual. 

The compliance risk was significant. The remediation cost was a fraction of what a failed audit would have cost. The consulting input did not find a technical problem. It found a decision made without the right lens on it. 

That is the kind of work IT consulting services are built for. OT security assessments, IT/OT segregation design, capital expenditure planning and SOCI Act compliance preparation. These are not IT problems. They are business decisions with significant regulatory and financial consequences. 

What Is The Difference Between IT Consulting and the Support I Already Have in Place? 

Managed IT support keeps your critical systems operational. IT consulting services tell you whether those systems meet the security, compliance, and resilience obligations of a critical infrastructure business. 

For a business like yours, this distinction has real regulatory weight. Your managed IT services team is responsible for keeping the environment running day to day. An IT consultant is responsible for telling you whether that environment would hold up under a SOCI Act audit, a cyber incident, or the stress of a major site expansion.  

If you are asking the same team to manage your environment and assess whether it is fit for purpose, you are asking the wrong question of the wrong people. Not because they lack capability. Because they lack independence. That is like asking the maintenance crew to do your structural engineer's job. Their job is to keep the site running, not to tell you whether it should have been built differently. 

How Do I Know If My Business Would Actually Benefit From an IT Consultant? 

If technology decisions in your business are being made without independent input, you would probably benefit. The question is not whether your IT is working. It is whether anyone with no stake in the current setup has looked at it recently and told you what they found. 

You are probably not in a crisis. When IT has done its job quietly and reliably for long enough that nobody is asking hard questions about it anymore, the gap keeps growing without anyone noticing.  

You wouldn’t skip a turnaround because nothing has visibly failed. The same logic applies here. 

What Are the Signs I’ve Outgrown My Current IT Setup? 

Honestly, your IT team won’t tell you. Not because they are hiding it, but because they are too close to the problem. The signs are operational, not technical, and your team worked around them long ago. 

One of the most consistent patterns I see in mining and energy businesses that have outgrown their IT setup is when operational teams start finding their own workarounds for data access or connectivity problems rather than escalating them.  

The unofficial WhatsApp group your ops team uses to share site access credentials is not a security solution. But it is a sign. 

Specific signals worth looking for: 

• You get a bill you did not expect, and nobody can explain where it came from 
• Someone asks a compliance question in a board meeting, and the room goes quiet 
• A project stalls as your tech can’t do the job you need it to 
• Your operations manager is making IT decisions because there is nobody else to make them 
• You find out a former contractor still has system access. Not from IT. From the contractor 
• You are about to sign off on a major capital project and realise nobody has checked whether the IT can support it 

None of these are disasters on their own. But together, they are a reasonable indicator that your  IT environment has stopped keeping pace with the business. 

Does My Industry Change What Kind of IT Consulting I Actually Need? 

Significantly. In mining and energy, the technology risk sits much closer to the operational risk than in almost any other sector. A system failure is not an inconvenience. It can be a safety event, a compliance breach or both at once. 

Your business is categorically different from most of the organisations a general IT consultant works with. The compliance obligations alone put you in a separate category. If you are subject to the Security of Critical Infrastructure Act (SOCI Act), your IT and OT environments carry obligations that someone without genuine sector experience may not be equipped to navigate. 

Beyond compliance, your OT environment changes the nature of the work entirely. SCADA systems, remote site architecture, IT/OT segregation, and the security posture of systems never designed to be network-connected. None of this appears when a consultant is working with a retailer. It is front and centre when they are working with you. 

Is Now the Right Time to Bring in an IT Consultant? 

Fine is the answer you get when nobody is looking hard enough to find something else. 

In mining and energy that is not good enough. A system failure is not an inconvenience. It can be a safety event, a compliance breach, or both. The cost of fine tends to arrive all at once and at the worst possible moment. 

An IT consultant is the person who looks harder. Who has no stake in what they find and every reason to tell you the truth. 

In my experience the first conversation rarely starts with a technology problem. It starts with a CFO who, when asked when someone last looked at their IT with no stake in what they found, pauses for just a moment before saying fine. 

That pause is where we start. 

If the signals in this article look familiar, the conversation is probably overdue. Start by understanding what the support layer should look like when it is working properly. yesIT's managed IT services is a good place to start.