← All Blogs

Is Your MSP's Quarterly Business Review a Sales Meeting?

By Best IT MSP Editorial Team - Updated October 21, 2026 - 9 min read

The Best IT MSP editorial team maintains this directory's provider data across the US and Canada. We rank providers on verified rating and firmographic data, label paid placement, and do not sell IT services.

What should an MSP quarterly business review actually produce?

An MSP quarterly business review should produce decisions. Three or four of them, each with an action owner, a date, and a number beside it. A service review that ends in a green dashboard and a quote produced nothing, and you paid for the hour either way.

Price the hour before you judge the meeting. Employer compensation costs for private industry workers averaged $46.89 per hour worked in June 2026. Put three of your people in a 90-minute review and the labor alone is about $211 at that average, four times a year, and senior staff cost more than the average. Your provider's hours are already inside the monthly fee. The meeting is not free. It is prepaid.

The governance case is stronger than the cost case. CISA's current baseline sets the outcome that the risks posed by a managed service provider are identified, recorded, assessed, prioritized, monitored, and updated over the course of the relationship. Read the last six words. Over the course of the relationship, not at the point of signature. For most small firms the quarterly review is the only standing slot where that can happen.

No standard we checked requires a quarterly meeting at all. Your provider chose the cadence, which is fine, and the content is still yours to set. Almost no buyer tries. We covered the wider supervision habit in Supervising the IT Provider You Already Have. This post is about the meeting itself: the tells, the agenda, and the decisions it should leave behind.

Seven tells that your service review is a sales meeting

Seven tells separate a review from a pitch, and you can spot five of them before anyone opens a laptop.

• The deck arrives in the room. You see the numbers for the first time while the account manager narrates them, so nothing gets checked.
• Totals replace trends. Tickets closed last quarter is a total. Whether that is up or down across four quarters is trend analysis, and only the trend supports a decision.
• Every indicator is green. A dashboard with no amber on it is either a perfect quarter or a filtered view, and your staff already know which.
• Nobody technical attends. The account manager presents and no engineer who touched your systems is in the room.
• Last quarter never comes up. Skipping the previous decision log means nothing was ever owned, so nothing was ever governance.
• The only dated number is the price. The technology roadmap says next year. The quote is valid for 30 days.
• The hour ends with a signature request. A meeting that produced exactly one decision, and the decision was to buy, was a sales call with slides.

None of this makes your provider dishonest. It makes the meeting the wrong shape. A proactive provider usually wants the harder agenda, because the harder agenda is where a renewal gets justified on evidence instead of goodwill.

The agenda to send before the next meeting

To fix the agenda, send one 10 days ahead and take it from a regulator instead of writing it yourself. The FTC Safeguards Rule already defines what a security report to a governing body must cover, and it reads like a review agenda written by someone with nothing to sell you.

The rule requires a report in writing, regularly and at least annually, to your board of directors or equivalent governing body. It then names six issues as examples of the material matters that report must cover, and this is the part worth copying: risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events or violations and management's responses thereto, and recommendations for changes in the information security program.

Count the nouns the regulator chose. Decisions. Responses. Results. Recommendations. It did not ask for a status update, and it put recommendations last, after the evidence. Six matters, in that order, with the proposal at the end.

The rule does not bind most readers of this post, and saying otherwise would be sloppy. It covers financial institutions under the FTC's jurisdiction, and paragraphs (b)(1), (d)(2), (h) and (i) do not apply to financial institutions that maintain customer information concerning fewer than five thousand consumers, which exempts smaller firms from the reporting paragraph itself. Use it as a model agenda, not as a compliance stick.

The same six matters, in plain English, are listed below.

• Risk. What sits on the risk register now, what moved since last quarter, and what is newly open.
• Decisions. Which control decisions were taken since the last review, and who took them.
• Provider. What changed in the arrangement itself: scope, subcontractors, provider access, and the service level agreement.
• Test results. What was tested, on what date, and what failed.
• Events. Every security event and major escalation, with what was done about it.
• Recommendations. What the provider thinks should change next, priced and dated.

Send that list and two useful things happen. The deck has to arrive early, because half the agenda needs data you have not seen. And the vCIO or account manager has to prioritize, choosing the three recommendations worth your money rather than presenting all nine.

Five artifacts that must be in the room

Five artifacts turn a presentation into a review: ticket data with trends, the asset register, a dated technology roadmap, the open risk register, and a written list of what changed since last quarter. Ask for all five in writing, 10 days before the meeting, and read them cold. For the wider document set, start with 8 Documents Your MSP Should Be Able to Hand You on Request.

Ticket data with trends, not totals

Ask for ticket volume by month across the last four quarters, split by category and by site, rather than one closed-ticket total. NIST's measurement guide exists so an organization can develop information security measures to identify the adequacy of in-place security policies, procedures, and controls. Adequacy is a comparison, so a number with nothing to compare it against cannot measure anything. Three cuts of the same data do the real work: repeat tickets on the same machine or the same user, tickets caused by a change the provider made, and the tail of tickets open longer than 30 days.

CSAT belongs in the pack, with one caveat worth saying out loud. CSAT is usually collected when a ticket is closed, so it surveys the people whose problem got solved. The staff who gave up and worked around it never answer. For what your service level agreement actually promises on those tickets, read First Response or Resolution: Which SLA You Should Actually Care About.

The asset register, because every other number is scored against it

The asset register is the denominator for patch compliance, backup coverage, and license spend. CISA's baseline asks organizations to maintain a regularly updated inventory of all organizational assets, and that inventory is what turns a patch-compliance percentage into a measurable figure rather than a share of an unknown total. Verify two columns while everyone is still in the room: the device count against your own headcount, and the date the register was last refreshed. The IT asset register you can demand from your MSP today sets out the fields it should carry.

A technology roadmap with dates, costs, and the risk each item closes

A roadmap item needs three things or it is a wish list: a quarter, a cost, and the named risk it removes. Use the provider's own cadence commitments as the floor. CISA advises that network reviews should be performed and tracked on an annual basis, which gives you one dated item you can expect to see every year. The roadmap is also where the budget forecast comes from. Ask your provider to forecast the next four quarters as a range, with the renewal date and any hardware refresh marked on it, so finance can plan instead of react.

The open risk register, with an owner on every line

A risk register is a central record of current risks, comprising both accepted risks and risks with a planned mitigation path, which means every line either has someone working on it or a signature accepting it. There is no third state, and vagueness is not one. NIST already defines the artifact that holds the plan. A plan of action and milestones is a document that identifies tasks that need to be accomplished, the resources required, milestones for meeting the tasks, and the scheduled completion dates for the milestones. Owner, task, date. Insist on those three columns and most arguments about accountability end in the meeting.

Open risks age faster than buyers expect, which is why the register needs a date column and not a status color. Verizon found only 26 percent of critical known exploited vulnerabilities were fully remediated, with a median 43 days to full resolution. That figure is the patching window rather than a help desk time, and it tells you how long a known hole typically stays open. In a survival analysis of third-party cloud-based MFA exposures, Verizon found 58 percent still unresolved after 7 days, 42 percent after 90 days, and 32 percent after 240 days. A risk that gets reviewed every quarter and closed by nobody is the normal outcome, not the unlucky one.

What changed since last quarter

Ask for one page listing every change: staff who left, systems added, access granted and revoked, and tests run. CISA's baseline hands you two checkable lines. It advises organizations to review user access and disable accounts when inactive for a specified period, giving 30 days as the example, and to test backups and recovery on a recurring basis, no less than once per year. So ask for the leaver list and the date of the last restore test. Both have specific answers, and a quarter that produced neither is itself the finding.

The questions that turn a presentation into a decision

Seven questions convert a slide into a decision, and each one asks for a date, a name, or a number. Ask them in this order, because the first one resets the whole meeting.

• What did we decide last quarter, and what happened? Open the decision log before anyone opens a new slide.
• Which three of these would you do first with my money? A vCIO who will not prioritize is presenting, not advising.
• What is on the risk register that we are choosing to accept? Accepted risk is a decision, and it needs a name against it.
• Which ticket would have been prevented by something on this roadmap? That question ties the spend to your own history.
• What did you escalate to us that we never acted on? The answer is often the real problem, and it is usually yours.
• What is the one number that got worse this quarter? A review with no bad number in it was not a review.
• Who owns each action, and by what date? Document the answers while everyone is still in the room.

One outside number explains why the dull questions matter. IBM reports that it takes an average of 247 days to identify and contain an active breach across all industries, so the quarter you are calmly reviewing may still contain something nobody has found yet. A green dashboard is a report on what was detected, never on what happened. To test the escalation side properly, run the drill in How to Test Your MSP's Escalation Path Before You Need It.

When a proposal in the QBR is fine

A proposal is fine when the review happened first and the proposal closes a risk already on the register. An upsell is not misconduct. Selling you the next thing is how your provider stays solvent, and the firms that never propose anything are usually the ones coasting on a flat fee. The test is sequence and output, not whether money came up.

• Sequence. The review ran to the agenda before any pricing appeared.
• Traceability. The proposal maps to a line already on the risk register, not to a vendor's quarterly target.
• Symmetry. The same meeting also produced a decision that costs the provider something, such as a fix, a credit, or a change to the service level agreement.

Then separate the two decisions in time. Record the review decisions in the meeting, and take the proposal away to compare against an independent benchmark. Price is not the only thing to compare. The FTC rule expects you to be periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards, which is a question about capability rather than cost. It matters more than most buyers assume, because Verizon reports that breaches involving a third party now account for 48 percent of all breaches, with third-party involvement up 60 percent in a year. Your provider holds privileged access to everything you own, so it is the third party most worth reviewing.

Where the proposal exists because a task has quietly fallen between the two of you, fix the ownership before you buy the product. Who Owns What? 12 Security Tasks That Fall Between You and Your MSP is the cheaper place to start than a quote.

How to close the meeting so the next one counts

Close the meeting by reading the decision log back out loud before anyone leaves the call. Five fields per line are enough: the decision, the action owner, the date, the number it should move, and where the evidence will appear next quarter. Email it the same day. A documented decision nobody circulated is a memory, and memories do not survive a staff change.

Then set the next review against your contract rather than the calendar quarter. A review held 60 days before your notice window still carries leverage, and one held two weeks after an automatic renewal carries none. Auto-renewal and the notice window you already missed explains how that window works and how to track it.

Count the decisions at the door. If the number is zero, you did not hold a review. You watched a presentation, and the hour was billed to you either way.

Your provider can be genuinely excellent and the meeting can still be broken, which is the part most buyers get wrong. Fix the shape first. Send the agenda, demand the five artifacts, insist on accountable owners with dates, and then challenge the numbers those artifacts produce. One quarter of that is usually enough to tell you whether you are being governed or being sold to, and it costs you an email.

FAQ

What should be on an MSP quarterly business review agenda?

Six items, taken from the FTC Safeguards Rule, which requires a report on material matters and names these as examples: risk assessment, risk management and control decisions, service provider arrangements, results of testing, security events and management's responses, and recommendations for changes. Recommendations come last, after the evidence. That order keeps the proposal at the end of the meeting rather than the middle.

Is it a problem if my MSP brings a proposal to the QBR?

No, as long as the review ran first and the proposal closes a risk already on your register. Judge three things: whether pricing appeared only after the agenda was worked through, whether the proposal traces to a documented risk, and whether the same meeting produced a decision that costs the provider something too.

What ticket numbers should I ask my MSP for?

Ask for ticket volume by month across four quarters, split by category and site, plus repeat tickets per user or device, tickets caused by provider changes, and anything open past 30 days. A single total cannot show whether service improved, because measures exist to identify the adequacy of in-place controls, and adequacy is a comparison.

Who should be in the room for a quarterly service review?

On your side, whoever owns risk and whoever owns budget, which in a small firm is often one person. On the provider side, insist that an engineer who actually worked your tickets attends alongside the account manager or vCIO. An account manager cannot answer why a server failed twice, and that is usually the question that matters.

What is a vCIO supposed to do in a quarterly review?

A vCIO is there to prioritize and to forecast, not to narrate a dashboard. Expect a ranked shortlist of recommendations with costs and dates, a budget forecast for the next four quarters, and a named risk against each roadmap item. If every recommendation is presented as equally urgent, you are receiving a catalog, not advice.

← All Blogs