How do mid-market Canadian operators build IT that compounds across oil cycles? · Crude Truth

James's perspective is shaped not only by 25 years of operator experience but by active participation in the global communities setting the agenda for technology leadership, AI policy, and digital sovereignty - from Calgary to the United Nations in Bangkok.

Before we go further, it helps to be specific about who this book is for. Because the phrase "oil and gas company" hides three very different businesses underneath it, and the IT decisions that fuel growth in one of them will stall another.

Three companies will keep appearing throughout this book as recurring examples. They are not real names - they are archetypes drawn from dozens of clients and engagements over the past two decades. What matters about them is not where they are today. What matters is where they intend to be in five years - and what their IT will have to become to get them there. If you do not recognize yourself in one of these three trajectories, this book is probably not for you. If you recognize yourself in two, you are operating across the seam between segments and this book gets even more relevant.

Look at the three trajectories above. Same commodity exposure. Same Canadian basin geography. Same boom-bust dynamics. But fundamentally different growth problems - and therefore fundamentally different IT problems.

The Operators's path from 80 to 200 people, from 140 to 400 wells, runs almost entirely through M&A. Their IT problem is integration capacity - can their data architecture absorb a 30-person operator without breaking their own operations? Can they run a clean diligence on the next target in 14 days? Can they produce a data room that justifies a premium multiple when they themselves go to market? If their IT is messy at $107 oil, they will buy at full price and sell at a discount. The math compounds against them every cycle they don't fix it.

Directional/Fracking Service's path from 65 to 200 people, from one basin to four, runs through operational discipline - crew scheduling, equipment utilization, customer-system integration, and a back office that can price work faster and more accurately than their competitors. Their margin is measured in single-digit percentages and their utilization in days. Their growth is constrained by how many active jobs they can manage simultaneously without dropping the ball. That's an IT problem dressed up as an operations problem.

Operators' path from 25 to 100 people, from specialty to standard, runs through professionalization. They have the technique. They lack everything else - ERP, HR, project costing, cyber program, compliance, audit trail. Their IT problem is the one they don't know they have - they are about to scale 4× without ever having implemented the systems even a 60-person company needs, and the contract they just signed has audit clauses they have not yet read carefully.

All three of them share three things, and those three things are the reason this book exists.

First, all three are leveraged to the same commodity curve. When WTI moves, they feel it within 90 days - sometimes within 30. The Operators's revenue moves with the price. Directional/Fracking Service's day rates move with operator capital programs. Operators' customers cancel discretionary work first. Their ambitions do not change with the cycle. Their ability to execute those ambitions does.

Second, none of them can afford to be wrong about IT. A supermajor can absorb a failed $50 million digital initiative. A 65-person directional drilling company cannot absorb a failed $500,000 system implementation that pulls senior operations people off the rigs for six months. The margin for error is small. The cost of being wrong is the company.

Third - and this is the one that gets buried in most strategy conversations - all three of them are at a stage where IT either becomes a growth engine or a growth ceiling. The companies that build IT for the growth arc they're actually on become uniquely positioned to acquire in the next downcycle and consolidate in the next upcycle. The ones that don't, become the targets that get acquired. The cycle is the same for both groups. The IT decisions are different.

Because three running examples can get confusing, here is the map. Each archetype operates from a different posture relative to the cycle - and the IT decisions that fit each posture differ accordingly. Where you see yourself in this map will largely determine which chapters land hardest.

If you are reading this and find yourself somewhere between two of these archetypes, that is normal. Most operators do. The map gives you the framework; your judgment supplies the details.

This is the audience. Three companies, three growth arcs, three postures, one cycle. Let's look at why most companies on those arcs get the IT part wrong.

Supermajors are not subject to the same cycle physics as the rest of the industry. They have global diversification, vertically integrated operations from wellhead to refinery to retail, and balance sheets that absorb extended periods of $40 oil without losing investment-grade ratings. They lay people off, yes. They cut capex, yes. But they do not die.

The 25 to 200-person drilling, service, or production company has none of those buffers. You feel the cycle within 90 days. You can be insolvent within 18 months. The math is not symmetric - when oil rises 50%, your revenue might rise 30%. When oil falls 50%, your revenue might fall 70%. Because the activity disappears faster than the prices do.

Three structural reasons.

One - concentration risk. A supermajor has thousands of producing wells across multiple basins, multiple countries, multiple commodity types. A 60-person operator has a focused acreage position. A 65-person service company often has one or two anchor customers that account for half its revenue. When those customers cut their capex, that revenue evaporates almost overnight.

Two - financing leverage. Mid-market operators run on reserve-based lending. Service companies run on equipment financing. Both lenders mark to market faster than supermajor bondholders do. When the cycle turns, your borrowing base gets redetermined, your covenants get tested, and the same banker who was your friend at $90 oil is asking for a recovery plan at $40.

Three - talent gravity. Senior engineers, experienced field hands, and seasoned operations leaders all flow to the perceived safest employer in a downturn - which is usually the supermajor or the largest independent. Mid-market companies lose the people whose institutional knowledge keeps the rest of the company running. Six months later, when the survivors are trying to acquire the cheap assets, they have neither the people nor the systems to actually integrate them.

The conventional wisdom is that IT is the first thing you cut in a downcycle. It is "discretionary." It can wait.

This is exactly backwards. The IT capabilities you build at $107 oil are the only ones you will have at $47 oil. Downturns are not when you build. Downturns are when you find out what you already built.

The operators that came out of the 2014–2016 collapse in acquiring positions had something in common: they had invested in production accounting and JIB automation when they could afford to, so when the time came to absorb a competitor's assets, the integration took weeks instead of years. The service companies that survived 2020 had something in common: they had invested in crew scheduling, equipment utilization tracking, and remote operations capability before the pandemic forced everyone home. The ones that didn't, didn't survive.

Which leads to the question that defines the rest of this book: what are the IT investments that actually pay off across the curve? What is worth doing now, while oil is at $107 and you can afford it, that will still be paying dividends when oil is at $47 and your competitors are panicking?

The answer is not "all of them." It is six, specifically. Chapter four.

The conventional advice for mid-market oil and gas companies is straightforward and largely wrong: "Be conservative. Don't over-extend. Survive the downturns. Wait your turn." It is the advice of consultants who have never run a business with a payroll and a covenant. It produces small, careful companies that survive cycles by becoming smaller each time one turns.

The companies that actually compound through cycles do something different. They build IT capability designed to make the cycle work for them, not against them. They acquire in downcycles when assets are cheap and competitors are distressed. They expand in upcycles when capital is available and growth is rewarded. They turn cyclicality from a threat into a structural advantage that compounds every time the curve turns.

That is the Growth Engine. This chapter is about how to build it.

Most operators read the cycle as symmetric - prices rise, prices fall, plan accordingly. The cycle is not symmetric. It rewards different behaviors on the up versus the down, and the operators who recognize this earn outsized returns at every turn.

Look at that side-by-side. Every row on the right depends on something that had to be built on the left. You cannot acquire a competitor in 90 days if your own data architecture cannot absorb them. You cannot hire fleeing supermajor talent if your internal systems are still being held together by tribal knowledge. You cannot win partner trust at $40 oil if your JIB statements were already in dispute at $80 oil. The downcycle is when the work pays off - but the work happens during the upcycle, when most operators are too busy hiring and over-building to do it.

For oil and gas companies in the 10 to 30-person range with bigger plans, the next five years are about scaling roughly 4×. Twenty people to eighty. One basin to two or three. One service line to two or three. Zero acquisitions to maybe one or two small ones. The IT requirements at 80 people are not "more of what works at 20." They are categorically different. Five things change.

Standardization replaces ad-hoc. At 20 people, every system was bought ad-hoc by different people for different reasons. Your CFO uses QuickBooks because she's always used QuickBooks. Your operations lead uses spreadsheets because that's what worked at his last job. Your CEO has a stack of SaaS subscriptions only she has the logins for. At 80 people, this fragmentation compounds quarterly. Data lives in 20 places. Nothing reconciles. Onboarding new employees takes a week per person because nobody can articulate what "our systems" actually means.

Cyber stops being optional. At 20 people, you might be invisible to attackers. At 80 - with field operations, partners, a known reputation in the basin, and a recognizable business name on the regulator's website - you become a real target. Ransomware attacks against oil & gas surged 935% between April 2024 and April 2025. The cyber posture you didn't need at 20 is existential at 80. Multi-factor authentication on every account. Network segmentation between IT and OT. Offline backups that have actually been tested. A documented incident response plan. None of this is optional anymore.

Identity and access becomes a discipline. At 20 people, everyone trusts everyone. Shared passwords. Nobody locks their laptop. Former employees still have email access six months after leaving. At 80 - especially if you have field operations or international staff - this is the single largest cyber risk you carry. Single sign-on. MFA. Documented offboarding. Privileged access controls. Not glamorous. Existential.

Vendor management becomes a function. At 20 people, you have 5 SaaS vendors and your CFO knows them all. By 80 people, you have 40 SaaS subscriptions, three of which nobody can find the admin for, and you are paying for 12 seat licenses on a system that 4 people actually use. The annual SaaS bleed for a 60-person company averages $80-200K in unused or duplicated subscriptions.

The IT leadership gap appears. At 20 people, you don't have a CIO and you don't need one. At 80, you absolutely need one but probably can't afford a full-time hire at $180-280K base plus stock. This is the gap that breaks the most growth-stage companies - they're too big to run IT informally and too small to staff it properly. The fractional or co-managed engagement model exists precisely for this gap.

For operators in the 60 to 100-person range planning to grow to 200+ over five years, the playbook is different again. This is the professionalization stage - the stage where what got you here categorically will not get you there. Five new requirements emerge.

Technical debt becomes a strategic liability. The IT environment has grown organically for five to ten years. There are systems running on hardware that should have been retired. There are integrations duct-taped together. There are critical workflows that depend on one person remembering how something works. At 80 people you can absorb this. At 200 people, the technical debt compounds into operational risk and slows every strategic move.

M&A integration capability becomes a competitive weapon. If you intend to grow from 80 to 200 in five years, M&A is almost certainly part of the path. You will be doing bolt-on acquisitions every 12-18 months. You need a repeatable integration playbook, not a heroic per-deal scramble. That means standardized financial systems your targets can be absorbed into. Production data architecture that can ingest a competitor's well portfolio in two weeks. Cyber and identity systems that can onboard 30 new employees and decommission their old credentials in 48 hours. The operators that win the next M&A wave are the ones who built this capability before they needed it.

Multi-site complexity becomes operational reality. Multiple basins. Multiple JV structures. Multiple regulatory regimes - AER, BLM, Texas RRC, state agencies, possibly international. Data unification across all of it becomes a strategic project, not an IT chore. The data warehouse you didn't need at 80 is the data warehouse that determines whether you can actually manage a 200-person operation.

Cyber moves from posture to program. At 80, "good hygiene" was the bar. At 200, you are a real target with real insider risk, real regulatory exposure, real cyber insurance requirements, and real partner audit demands. Cyber becomes a documented program with a CISO function, a tested incident response, a tabletop exercise discipline, and an executive-level reporting cadence. Most insurance carriers in 2025-2026 require this for any operator above 100 people.

OT/IT convergence at scale becomes a strategic asset. SCADA, historians, control systems, telemetry - at 80 you had OT, at 200 you have OT as a strategic asset that needs proper management. The data your SCADA is generating becomes the foundation for AI-driven optimization, predictive maintenance, and the production data integrity that drives the McKinsey-documented $5+ per BOE uplift. Treat it as IT's annoying cousin and you will leave that value on the table.

So far we have been talking about growth in headcount and well count. Real growth in oil and gas usually moves on four dimensions simultaneously, and each one has IT consequences most operators discover only after the expansion is underway. Plan for all four.

The growth engine for mid-market oil and gas companies in 2026 is not complicated. It is just uncomfortable.

It says: build IT for the cycle, on both ends. Build standardization, identity, and cyber at 20 → 80 because that is what enables you to absorb the next acquisition or win the next contract. Build M&A integration capability, multi-site discipline, and OT/IT convergence at 80 → 200 because that is what makes you the consolidator instead of the consolidated. Plan for the four expansion dimensions even if you only intend to pursue two of them. Acquire in downcycles when assets are cheap. Expand in upcycles when capital is available.

Companies that build this engine arrive at every cycle turn with a wider moat than the previous turn. That is the asymmetric return. It is also the reason a handful of mid-market operators consistently emerge from cycles as the consolidators while the rest get consolidated. The choice is not "do I plan for IT" - every operator plans for IT. The choice is whether IT is a cost line you cut at $40 oil or a moat you compound at $107 oil.

The rest of this book is about how to actually do that work - which growth walls hit at which stages, which engagement model fits which stage, how to think about M&A from both sides of the table, how to measure IT in a cyclical business, and what to do in your first 90 days.

Most oil and gas companies between 10 and 200 people have three structural options for how they get IT capability into the business. Build it internally. Buy it from a managed services firm. Or run some hybrid of the two. Each has trade-offs. The right answer depends almost entirely on where you are on the growth arc, what stage you're approaching, and what your CEO's actual five-year intent is.

This chapter is the framework. Not a sales pitch. The trade-offs are real on every option, and the wrong choice - at any stage - is expensive.

The honest mapping looks something like this.

Headcount is the easiest signal but not the only one. Four questions matter more.

Many CEOs default to "we'll just hire someone internal." On paper it looks cheaper. It usually isn't.

A full internal IT capability for a 100-person O&G operator - one CIO/Director, one operations lead, one security analyst, one help-desk technician, and the tooling/licensing to run a modern stack - typically runs $1.4 to $2.1 million per year fully loaded. Plus 18-24 months of recruiting and ramp time before that team is actually delivering. Plus the opportunity cost of the CEO and CFO time spent managing the function.

A bundled engagement with a firm that already has the team, the tooling, and the playbook typically runs $25-50 per seat per month for the equivalent capability - call it $25,000-50,000 per month for a 100-person operator. That's $300,000-600,000 per year, against $1.4-2.1M internal, with deployment in 90 days instead of 24 months. The math is not subtle. The reason most operators between 80 and 200 people end up partnering rather than building is not ideology. It's TCO.

The exception: very large companies, very stable companies, or companies whose IT is a strategic competitive asset rather than infrastructure. For most mid-market O&G operators, IT is the latter - necessary infrastructure that has to be excellent but does not need to be invented in-house.

If you are between 25 and 200 people in oil and gas with bigger plans, you are in the M&A funnel whether you have thought about it or not. The only real question is which side of the table you are sitting on when the next deal closes. Are you the operator absorbing a competitor at a favorable multiple, or are you the operator being absorbed at a discount? Both are valid outcomes. They produce very different five-year wealth pictures for the owners.

The good news: the IT decisions that prepare you to be the acquirer are roughly the same as the ones that prepare you to be acquired well. The bad news: both require three to five years of investment before the deal happens. You cannot fix this in the 60 days of a diligence window.

2024 was a record year for US oil and gas M&A - $206.6 billion in deal value, more than three times 2023's $47.9 billion. Exxon paid $60 billion for Pioneer in May. SLB announced $7.7 billion for ChampionX. Chevron, ConocoPhillips, Diamondback - the megadeals dominated headlines. But the analysts at EY, Akin Gump, and Deloitte all expect the next wave to be mid-market. The megamergers have closed. Now the consolidators are buying smaller. Now the smaller operators are being absorbed at the pace of one or two per active consolidator per year. That smaller pool is you.

For the ambitious 60-person operator who intends to be the 200-person platform, the next five years are about deciding to be the acquirer. Not someday. Now. The window opens when oil prices fall and competitor balance sheets get stressed. The window closes about 18 months later when prices recover. To be ready when it opens, you need three capabilities in place - and you need them in place before the cycle turns, not during.

The single most common failure mode for ambitious mid-market acquirers: they close the deal, then discover they cannot absorb the acquired company without breaking their own. The acquired company's wells live in a different production accounting system. The JV partners have different reporting requirements. The financial close cycle that used to take 5 days is now taking 15 because the new entity's data does not flow cleanly into the consolidated reporting. Six months in, both companies are running at less than their pre-deal effectiveness. The synergies vanish into the integration cost.

Integration capacity is not a project. It is a permanent organizational capability that has to exist before you sign your first LOI. Master data management. Standardized chart of accounts. Repeatable production data ingestion. Identity migration playbooks. Cyber onboarding procedures. The operators who have done five acquisitions can do the sixth in 90 days. The operators on their first acquisition are usually still wrestling with it a year later.

The next time the cycle turns, several distressed competitors will become available simultaneously. You will have weeks, not months, to evaluate, decide, and bid. If your own data architecture cannot quickly compute "what would our combined production, LOE per BOE, and JV exposure look like if we owned their wells too?" - you will pass on deals you should have done, or worse, you will do deals you shouldn't have.

Fast diligence requires that your own house is in order first. You cannot evaluate a target's data quality if you don't know what good data looks like in your own systems. The operators who buy well in downcycles are the ones who built their analytical and data-room capabilities during the upcycle, when there was no immediate deal pressure to justify the investment.

When you acquire a target, you face a fundamental decision: do you fully integrate their IT into yours, run them as a holding company with separate systems, or leave them largely alone and just consolidate the financials? Most acquirers get this wrong because they default to "fully integrate" without testing whether they should. Three useful tests:

1. Geography test. If the target operates in a basin you don't already operate in, with different regulators and different operating practices, leave their operational systems alone. Integrate the financial reporting. That's it.
2. System age test. If your systems are 8 years older than theirs, and theirs are working, do not force their data into your platforms. Consider the reverse direction instead.
3. JV complication test. If the target has working interest partners who require specific reporting formats or platforms, integration will trigger partner approvals, change orders, and disputes. Run them parallel until next renegotiation cycle.

The cases where full integration is the right move: identical basins, identical workflows, your systems are demonstrably better, no JV complications, and you have the integration capacity to do it without breaking the acquired company in the meantime. This is rarer than most acquirers assume.

Even ambitious operators who intend to consolidate sometimes get sold instead. A founder retires. A health event changes the timeline. A strategic acquirer makes an offer that is too good to refuse at $107 oil. Or the cycle turns the other way and the over-leveraged competitor down the street turns out to be you. For all these outcomes, the second half of the M&A playbook matters: how to be acquired well, not badly.

The variance in deal multiples is enormous. That 6.9× EBITDA average hides a range from roughly 4× to 9× - depending almost entirely on the quality of what the buyer finds when they open the data room. Clean operations command the high end. Messy ones get discounted 0.5× to 2× EBITDA, depending on the severity. On a $50 million EBITDA company, that is $25 to $100 million of value left on the table because the seller didn't invest in IT four years earlier.

Your IT vendor will tell you to measure adoption rates, license utilization, and ticket close times. These are not the metrics that matter. These are the metrics that justify the next renewal.

In a cyclical business, the metrics that matter are different - and they look different for operators versus service companies. They have to answer one question: are we becoming more or less resilient to the next downcycle, and more or less ready for the next M&A wave? Everything else is noise.

1. IT spend per BOE. Total IT spend divided by total BOE produced. A clean number, comparable to peers, and useful in both directions of the cycle. The supermajors run this at 0.25–0.50 per BOE. Mid-market operators range widely - 0.80 to 2.50 - and the high end is usually a sign of vendor overspend, not strategic investment.
2. Days to close, with full reconciliation. Not just "did we close the month" but "did we close the month with production data tied to revenue tied to JIB tied to AFE with zero unreconciled variances." Three days is the upper benchmark. Nine days is the warning that you are at Wall 2. Anything more, you are losing partner trust and burning your accounting team out.
3. M&A-readiness composite. A binary self-assessment, scored quarterly. Can you produce a clean data room in 30 days? Are your production volumes reconcilable to revenue distributions? Is your cyber posture documented and tested? If the answer to any of those is no, you are not M&A-ready, regardless of how strong your EBITDA looks.

1. IT spend per dollar of revenue. Total IT spend divided by revenue. For asset-light service companies, this typically runs 1.5–3.5%. For asset-heavy (drilling, frac, completion), often lower because equipment costs dominate. Either way: track it quarterly across the cycle. Spend goes up too fast in upcycles, gets gutted in downcycles. Smooth it.
2. Equipment / crew utilization rate. The single most important operating metric in service O&G. What percentage of available equipment-hours and crew-hours produced billable revenue last quarter? The upper benchmark for drilling: 75–85% utilization. Service companies that survive downcycles run this metric weekly and act on it in days, not months.
3. Time from job-complete to invoice-issued. Days between work completion and invoice in customer's hands. Service companies with manual processes run 30+ days. Companies with proper field data capture and integrated billing run 5–10 days. That 20-day difference is your working capital cycle. In a downcycle, that is the difference between solvency and a covenant breach.

Be cautious about measuring "IT cost reduction" as a success metric in isolation. It rewards the wrong behavior - gutting capability instead of building it. The companies that cut IT hardest in 2014–2016 had the worst recoveries in 2017–2019, because the senior knowledge had walked out with the layoffs and could not be rehired.

Be equally cautious about measuring "system uptime" as a primary IT KPI. 99.9% uptime is meaningless if the data inside the system is wrong, the partners are disputing the JIB statements, and the production accountant is still reconciling by hand at month end. Uptime measures the system. The metrics above measure the business. Choose the latter.

Twenty-five years in this work, two cycles weathered, and the pattern is familiar enough that it borders on tedious. Oil rises. Mid-market operators and service companies hire aggressively, build aggressively, and assume the price will stay. Oil falls. The same companies gut IT first. Senior knowledge walks out with the severance. Eighteen months later, the price recovers and the survivors discover their competitors who did not gut IT just bought their best assets at a discount.

This is not a story about technology. It is a story about discipline. The companies still standing in 2030, and ready to acquire in 2031, will be the ones that built their IT for the cycle - both ends of it - starting in 2026, when they could still afford the choice.

If you take one thing from this book, take this: the cycle is patient. It will collect on every decision you make in the next eighteen months. The IT capabilities you build at $107 oil are the only ones you will have at $47 oil. The data room you create today is the multiple you receive at exit tomorrow. The cyber program you implement now is the difference between an incident and a casualty. The companies that win the next cycle are not building it in the moment of crisis. They are building it now.

Three companies. Three IT realities. One cycle. The choice is yours.