5 questions to ask your IT provider every quarter

The quarterly report from the IT provider arrives. 14 pages, mostly green checkmarks. Patch compliance 98 percent. Tickets closed within SLA. Backups: running. The owner skims it in 90 seconds, files it and gets back to running the business. The report answered every question except the ones that matter.

Most owners of 10 to 50 person companies feel unequipped to supervise their IT provider because they are not technical. That instinct is wrong. Governing the relationship does not require reading firewall configs. It requires asking a handful of questions that cannot be answered with a dashboard screenshot, then listening for whether the answer sounds like evidence or like reassurance. Here are the 5 we would ask, 15 to 30 minutes each quarter, ideally inside the quarterly business review your provider should already be offering.

1. What broke recently, and what did you change because of it?

Every environment has incidents. A patch that hung, a phishing email that got through, a restore that took longer than expected. Honest providers have a list.

• A good answer names 1 or 2 specific failures and the change that followed. “The June patch window knocked out the label printers, so we now stage printer-adjacent updates on a test machine first.”
• A bad answer is “everything has been quiet.” Quiet means either nobody is looking or nobody is telling you. Both are problems.

This question does more than surface facts. It teaches your provider that you reward candor, which changes what they tell you in a real crisis.

2. When did we last test a restore, and what did the test cover?

Not “are backups running.” Backups that have never been restored are a hypothesis, and we have written about why tested restores are the only backup verification that counts.

• A good answer is a date, a scope and a duration. “August 14. We restored the finance share and 2 mailboxes to a sandbox. Files came back in 40 minutes.”
• A bad answer is a green checkmark, a monitoring screenshot or the word “daily” doing all the work.

If the date is more than 6 months old, ask for a test this quarter and a standing cadence of at least 2 per year.

3. What is our biggest unresolved risk, and what would fixing it cost?

Every environment carries known risk. The aging server, the vendor with standing remote access, the 3 people sharing an admin login. You are asking the provider to rank them and price the fix.

• A good answer names a specific risk, gives a cost range and tells you the consequence of waiting. It might even be “defer it,” with a reason.
• A bad answer is a product pitch with no risk attached, or the claim that there are no unresolved risks. There are always unresolved risks. The question is whether anyone has ranked them.

Owners who ask this quarterly end up with a running, prioritized list, which is most of what a fractional security executive would build. When the list gets long enough to need an owner of its own, that is the moment to consider whether a vCISO makes sense.

4. Who has admin access to our systems, including at your company?

Admin credentials are the keys to everything, and the honest answer usually surprises the owner. It includes past employees nobody deprovisioned, a vendor from a project 2 years ago and a shared account at the provider itself.

• A good answer is a short named list, confirmation that MFA is enforced on every one of those accounts and a description of what happens when a technician leaves the provider’s own staff.
• A bad answer is “our techs have access,” with no names, no count and no offboarding story.

Ask for the list in writing once a year. It belongs in the same place as the rest of your continuity documentation, and if your provider cannot produce it, revisit our post on the documentation test, because the gap is bigger than this 1 list.

5. What are we paying for that we are not using?

Licenses accumulate. Seats for departed employees, a security tool that overlaps another, a premium tier nobody turned on.

• A good answer is an honest audit that finds something, because it always finds something. A few orphaned licenses often cover the cost of the review that found them.
• A bad answer deflects to the invoice. A provider who resells your licenses has a mild conflict here, which is exactly why asking the question out loud matters.

Make it a standing agenda

Put the 5 questions on a recurring quarterly calendar invite and let your provider know they are coming. The point is not to play gotcha. Providers do better work for clients who ask, and the pattern of answers over 4 quarters tells you more than any single report. Answers that get specific over time mean the relationship is working. Answers that stay glossy mean the report is a brochure.

If your provider has no quarterly review to host these questions in, that absence is itself an answer.

When the answers are bad

1 glossy answer is a prompt to dig. A pattern of them deserves a process, not an argument.

• Put the concern in writing. “We asked for the last restore test date and did not get one. Please run a test this month and send the result.” Written asks create a record and remove ambiguity about what you wanted.
• Attach a date. Open-ended requests to a busy provider evaporate. Requests with a deadline either get done or produce a revealing excuse.
• Escalate past your account manager once. Sometimes the gap is a person, not the firm.
• If 2 consecutive quarters produce the same unanswered questions, start a quiet market check. Switching providers is disruptive, which is exactly why the decision should rest on 6 months of documented non-answers rather than 1 bad meeting.

None of this requires technical judgment. It requires the same follow-through you would apply to any vendor holding something you cannot afford to lose.

Atticus Rowan runs quarterly business reviews with every managed client, and these questions are the spine of ours. If your current provider’s reports are 14 pages of green and you still cannot answer what would happen after a bad Tuesday, talk to us.