The Mid-Market Advantage: What Should a Growing Company Keep In-House?

As growing businesses rely on a wider mix of employees, remote specialists and external teams, the important boundary is increasingly defined by knowledge, judgment, customer responsibility, and continuity, with payroll forming only one part of the picture.

When Francesco Picciariello’s lead developer resigned, the problem at Overthink looked like a familiar staffing disruption. The company was building TheChat, an AI platform that brings OpenAI, Gemini and DeepSeek into one workspace, and the person carrying much of the project knowledge had left.

The codebase remained and so did the product idea, and the work was already started. What Overthink lacked was a dependable way for another developer to understand the current state of the platform and continue from it.

There was no usable handover documentation. The incoming engineer first had to make the project runnable, map what already existed, document configuration and deployment requirements, and trace the main product flows.

That work created a technical baseline that somebody else could inherit. When the scope later expanded and a second specialist joined, she could enter a project whose architecture, environment and next steps were visible rather than reconstructed from memory.

The episode exposes a problem that is easy to hide inside a small or mid-sized company. A business can employ the person doing the work and still have little organizational control over the knowledge surrounding it. A specialist working from another country can remain deeply integrated with the company when documentation, decision rights and continuity are built into the relationship. Employment status tells only part of the story.

The same question appears in finance, customer service, engineering, and regulated technology. A manager may be the only person who understands how monthly numbers are assembled. A customer service employee may carry years of account history that was never captured elsewhere.

An engineer may know why a product was designed in a certain way and what would break if a component changed. As the organization grows, those individual pockets of context begin to determine how resilient the business really is.

For a growing company, deciding what to keep in-house therefore requires more than sorting activities into internal and external columns. The more useful exercise is to identify which knowledge must remain accessible, which decisions require internal authority, which customer promises the company must continue to own, and which risks cannot be transferred simply because somebody else performs the work.

When Knowledge Has to Survive the Individual

Small teams often move quickly because experienced people carry large amounts of context. Decisions are made in conversation, shortcuts are remembered, and documentation is deferred because everybody involved already knows what happened. The arrangement can work well for years. Its weakness becomes visible when somebody leaves, responsibilities expand, or a second team needs access to the same knowledge.

At Overthink, the resignation converted an invisible dependency into a project delay. The recovery mattered because it transferred technical history from one person into something the company could use again. The new developer documented prerequisites, environment variables, service endpoints, deployment steps, and key application flows. The value of that work was operational. A replacement no longer had to rebuild the project’s context before contributing.

The repair work also changed how the product could be developed. Instead of relying on an informal sequence known to one engineer, the team had a repeatable environment and a visible map of the application. That made later expansion less dependent on a fresh handover every time the team changed. The business still relied on individual expertise, but the surrounding context had become an organizational asset rather than a private memory.

Research from APQC suggests that many organizations struggle with the same issue. In its 2025 survey of 1,000 respondents, only 30% said their organizations captured knowledge from departing retirees most of the time or always, while 41% said they rarely or never did. The study focuses on retirement, although the underlying exposure applies more broadly whenever important knowledge is concentrated faster than it is transferred.

The lesson for growing businesses is not that every specialist or every piece of knowledge must remain in-house. It is that the organization must retain access to the knowledge needed to understand, evaluate and continue the work, regardless of who performs it. Once that knowledge is accessible beyond the individual, companies can begin to separate the execution they can distribute from the decisions they need to own.

Where Execution Ends and Judgment Begins

At Howlett Farms, the issue emerged through financial administration. The agricultural business was handling growing volumes of invoices, payables, receivables, and reconciliations, while management lacked a dependable view of operating spend and outstanding amounts.

A remote financial specialist began digitizing records and organizing the underlying data. The case study reports more than 2,000 invoices processed, a 78% faster invoice process, four-times-faster month-end closing and full visibility across operating spend.

The numbers matter because they changed what management could see. Howlett operates across grain handling, feed manufacturing, and related agricultural activity, where cash moves through a steady flow of suppliers, processors, and customers.

Better reconciliation and cleaner records gave managers a more timely view of debtors, collections, and operating costs. The specialist created the information structure. Decisions about credit, purchasing, cash use and investment still required knowledge of the business beyond the ledger.

The case also shows why financial control does not require managers to process transactions themselves. What management needed was a reliable line of sight into the records, confidence in how they had been prepared, and the ability to question the resulting picture. Once those conditions were in place, detailed financial administration could sit elsewhere without separating the company from the decisions the information was meant to support.

Extreme Marquees reached the same boundary through digital marketing. The Australian outdoor-equipment company worked with an external team across development, SEO, content and paid advertising.

As the relationship expanded, one recurring problem was measurement. The company was investing in PPC, but the available conversion data did not show clearly enough which campaigns, calls, forms, and support interactions were producing commercial results.

The measurement setup became more sophisticated. More than 140 forms were tracked, Zendesk interactions were incorporated, and call tracking moved from CallRail to Delacon to improve visibility into phone leads generated through advertising.

The work sat inside a broader digital operation spanning site performance, content, search, and paid media across several markets. Better measurement gave management a stronger basis for deciding where to allocate the next pound or dollar of marketing investment.

The broader relationship made the governance question more important because several activities could influence the same commercial outcome. Site changes could affect conversion. Content and search could change discovery.

Paid media could increase demand, while incomplete tracking could make one channel appear stronger or weaker than it really was. The company needed specialists to improve each layer and a management view that could connect the results across them.

Howlett Farms and Extreme Marquees show how much execution can sit outside senior management while commercial responsibility remains inside the business. Specialists can reconcile the accounts, identify patterns, build dashboards, and recommend action.

Their judgment can become increasingly valuable as they learn the company. Leadership still has to connect those recommendations to cash, risk, customers, hiring and longer-term priorities that sit outside any one function.

The boundary becomes more immediate when the work reaches customers. A management team can review a report before acting on it. A customer interaction is already shaping the company’s reputation while it happens. Superior Window Tint and RSI Security show how far customer-facing responsibility can extend beyond the physical office while still remaining part of the business itself.

When Customers Depend on a Distributed Team

At Superior Window Tint in California, the operational problem was visible at the front desk. The same small team was trying to serve customers in the garage, answer calls, and keep up with inquiries arriving through Google, Yelp, and other channels.

Delayed responses meant potential customers could simply move to another provider. The company began with one remote assistant handling four tasks. Within six months, three assistants were managing more than 30 responsibilities across calls, online inquiries, invoices, follow-ups, offers, and remote reception.

Their contribution also changed the way the company handled reviews. The assistants noticed that satisfied customers were willing to leave feedback but often failed to return later and complete it.

Sending review links with invoices and following up with past customers turned review management into part of the service routine. The case records reviews rose from 68 to 247, and the Google rating moved from 4.3 to 4.9. Owner Attif Raza later said sales had doubled during the relationship.

The remote reception arrangement pushed the same idea further. A customer arriving at the premises could be acknowledged by somebody who was not physically sitting behind the desk, while the local team continued working on vehicles. The staffing model disappeared from the customer’s point of view. What mattered was whether the business responded quickly and carried the interaction through to the next step.

Research from Qualtrics XM Institute helps explain why these apparently small interactions matter. Its 2025 contact-center study, based on more than 23,000 consumers, found waiting time was the weakest-rated element of the contact-center experience and fewer than two in three issues were resolved on the first call. Customers rarely care whether the person answering them is in the same building as the owner. They experience the response as part of one company.

Continuity therefore becomes part of customer ownership. When one Superior Window Tint assistant planned a week’s leave, he trained other employees to prepare invoices and shared guidance on offers and add-on services before stepping away. The handover is a small detail, but it shows how quickly an external or remote role becomes operationally important once customers and revenue depend on it.

The consequences were more technical at RSI Security, a California cybersecurity company serving more than 1,000 clients. Its support environment included internal IT requests, customer tickets, reporting, licensing work, and network alerts.

The case describes 10 to 20 internal tickets, and 50 to 100 client tickets a day. A remote support team introduced prioritization rules, consolidated several tools into a more unified workflow, and created a dashboard showing open, ongoing and completed work.

Those queues also contained different kinds of work. Internal support issues, client requests, licensing reports, backup checks, and network alerts did not carry the same urgency or consequence. Prioritization therefore required more than clearing tickets in order of arrival. The support team needed enough operating context to recognize what could be handled routinely and what needed to move quickly to someone with greater authority.

Salesforce’s 2025 State of Service research found improving customer experience remained the top priority among 6,500 service professionals, even as automation and AI reshaped service operations.

The finding fits the cases here. Companies can distribute who answers, tracks, and resolves customer issues. They still need defined standards, escalation paths, and continuity because the customer associates the outcome with the company rather than with its staffing model.

Where Accountability Stays with the Business

Customer service makes responsibility visible through reputation. Healthcare adds obligations around sensitive information, access, and security. Doctor’s Aid was developed as a healthcare communication application for doctors, staff and other employees working across medical facilities.

Messaging, audio and video communication, document sharing, and patient-related functions had to operate in an environment where medical information required stronger controls than ordinary application data.

The development team implemented Transport Layer Security, end-to-end encryption for messaging and calls, AES-based encryption, secure key exchange, and controlled cloud storage for documents. Those safeguards formed part of a wider application architecture that also had to support search, multilingual functionality, and cross-platform use.

The technical work translated security requirements into software, while the organization operating the product still had to determine who should have access and how those permissions should be governed.

Usability remained part of the same problem. Healthcare professionals still needed to communicate, share files, and access relevant patient information without turning security into a barrier to normal work. The application therefore had to translate policy into a practical user experience. Technical controls mattered because they made organizational decisions about access and confidentiality enforceable inside the product.

The U.S. Department of Health and Human Services describes the HIPAA Security Rule as requiring administrative, physical, and technical safeguards for electronic protected health information.

This means healthcare data security extends beyond encryption to include access policies, authentication, monitoring, workforce practices, and data protection throughout its lifecycle. In the Doctor’s Aid project, these considerations shaped the technical safeguards built into the application.

The same governance problem appears in other sectors whenever outside providers become closely connected to critical systems. NIST treats external dependency management and supplier risk as part of cybersecurity supply-chain risk management, reflecting the extent to which modern organizations depend on software, services, and technical partners they do not directly employ.

For a growing business, the practical requirement is to know which systems matter, who has access, what standards apply, and who has authority when a risk decision has to be made.

The distinction is particularly useful because it avoids an overly simple rule that sensitive work must always sit inside the company. External specialists can build and maintain important systems, including systems handling regulated data. The organization still needs internal clarity over policy, permissions, risk appetite, and accountability because those decisions affect customers, regulators, and the business as a whole.

As external relationships deepen, the challenge becomes maintaining that clarity while the specialists themselves become part of normal operations. Swisslog Healthcare shows what this looks like when a technical relationship develops across several years and begins supporting workflows used by suppliers and partners as well as internal teams.

When Outside Expertise Becomes Part of the Operating Model

By the time Swisslog Healthcare needed a new partner portal, it had already worked with the external development team across multiple projects for about three years. During the pandemic, when developers were scarce in Switzerland, the company returned to people who already understood its environment.

The portal was intended for suppliers, vendors, and other partners, with onboarding, document exchange, invoice approval, user permissions, and chat support. Separate versions were required for EMEA and North America, and the EMEA version needed support for five languages.

The project sat close to day-to-day operations because partners would use it to upload documents, manage users and roles, raise queries, and move invoices through approval. Swisslog defined how those workflows should operate across regions. Developers translated the requirements into a working platform and dealt with the technical problems that surfaced along the way.

Regional differences made the portal more than a single technical build. EMEA and North American users were working through different client workflows, while the European version had to support English, Italian, German, French and Spanish. The developers were solving architecture and implementation problems, but the distinctions they were encoding came from how Swisslog’s business operated across regions.

Single sign-on became one of those problems. The original implementation could not accommodate the requirement cleanly because embedded libraries blocked the feature, and the relevant code was eventually rewritten.

Multilingual support created another constraint because Swisslog did not want third-party translation tools embedded in the final portal. The engineering solutions changed, while the business requirements and acceptable operating boundaries continued to come from Swisslog.

Once relationships reach this level, the labels “in-house” and “outsourced” describe less than managers often assume. Two companies can use the same proportion of external talent and have very different levels of control. The difference lies in whether knowledge travels across the organization, whether decisions have clear owners, and whether the company can continue operating when people or providers change.

For a mid-sized business, an integrated external team can therefore become part of the operating model itself. The company can extend its technical or operational capacity without recreating every specialist function internally, while still retaining the context required to direct the work.

The arrangement becomes part of the operating model because the external specialists are connected to the same priorities, systems, and standards as the people inside the company.

Deciding What Must Remain Inside

Francesco Picciariello’s experience at Overthink is worth returning to because the original weakness appeared inside the company. A direct employee had been building the product, yet one resignation interrupted development because the technical history had not become accessible to the organization.

Once the project was documented and another specialist could join without reconstructing the environment from scratch, continuity improved even though the work itself remained distributed.

Across the other cases, control took different forms. Howlett Farms needed dependable financial information so management could make commercial decisions. Superior Window Tint needed service standards and handovers that survived changes in who was available. RSI Security needed clear escalation around customer-facing technical work.

Doctor’s Aid required technical safeguards around sensitive information together with organizational rules governing access. Swisslog needed external developers capable of working deeply inside its systems while the company retained authority over how partners and regions should operate.

These examples suggest a practical way to think about what a growing company should keep in-house. Strategic judgment, customer commitments, risk appetite and the standards governing important work need clear internal ownership because they draw on context across the whole business. The execution around them can be distributed much more widely, provided the organization remains able to understand the work, challenge it and continue it.

The appropriate boundary will vary by function and by the cost of failure. Losing access to product architecture can halt development. Weak customer handovers can affect revenue and reputation. Errors involving protected health information can create legal and regulatory exposure.

A reporting delay in another part of the business may be inconvenient without being existential. The level of internal control should therefore reflect how consequential the activity has become and how difficult the knowledge would be to replace.

A useful test is whether the company could absorb a change in the arrangement without losing the ability to operate.

• Could another engineer understand the product?
• Could managers still see the financial picture?
• Would customer issues continue to be escalated correctly?
• Could access to sensitive information be changed or withdrawn quickly?

These questions expose the dependencies that matter long before a formal insourcing or outsourcing decision has to be made.

That boundary also changes as the company grows. A specialist relationship may remain effective for years, then become important enough to justify internal leadership or a larger permanent team. Another function may continue to operate through a small internal core supported by external specialists. Management gains better information over time about demand, dependency and the value of accumulated knowledge, allowing the structure to evolve as the work develops.

For the mid-market, the central question is practical. Important activities can be distributed across direct employees, remote specialists and external teams while the company retains reliable access to the knowledge behind the work, clear authority over consequential decisions, continuity around customers and systems, and visible accountability when responsibilities cross organizational boundaries.

Those elements determine whether the business still controls what matters as its operating model becomes more distributed.