I have hired or been close to 4 hires of IT consultants so far. Every time the process was very simple:

1. Do we know a company that offers that service?

2. If yes: Hire them.

3. If no: Don't hire.

Of course this is maybe a little bit oversimplified but at least in the cases I witnessed there was no big selection process of multiple different consulting services. In smaller companies the personal connection is much more important than the best offer on paper.

Its almost always through personal connections or word of mouth/referrals.

The primary concern for small to medium business is if the consultant being hired is actually capable of providing the service they are claiming to provide.

Hiring someone off of an online ad, cold call, etc. is just unnecessary risk. They'd happily pay more when they know that the output is going to be what they expect.