An MSP review meeting should help business leaders understand performance, risk, cost and the decisions ahead. Ticket totals have a place, but the most useful discussion connects technology to resilience, productivity, compliance, budgets and business plans.
The short answer
Business leaders should ask about the organisation's biggest technology risks, priority cybersecurity improvements, Microsoft 365 value, planned investment, service performance, recurring issues, incident readiness, compliance, support for growth and what the MSP would change first. Every answer should identify evidence, business impact, ownership and a target date.
In this guide
How to prepare
1. Biggest technology risks
2. Cybersecurity priorities
3. Microsoft 365 value
4. Technology investment
5. Service performance
6. Recurring support demand
7. Incident readiness
8. Compliance and governance
9. Business growth
10. What would you change?
Suggested review agenda
Meeting scorecard
Turning discussion into action
BUSINESS OVERSIGHT
Why Do MSP Review Meetings Matter?
Regular reviews create a formal point for leadership and the provider to assess the service, examine changing risk and agree priorities. They should look forward as well as reporting what happened during the previous period.
Understand service outcomes
Review business impact, response, resolution, communication and recurring demand rather than ticket volume alone.
Make risk visible
Discuss cybersecurity, recovery, unsupported technology, compliance and supplier dependencies in business terms.
Decide what comes next
Align roadmaps, budgets, lifecycle, projects and improvements with the organisation's plans.
BEFORE THE MEETING
How Should Business Leaders Prepare for an MSP Review?
Ask for the agenda and supporting information early enough to review it. Bring operational concerns and upcoming business changes so the provider can connect its recommendations to real priorities.
Confirm which commitments were completed, delayed or superseded and why.
Review response, resolution, recurring incidents, escalations and user experience.
Request an updated view of security, backup, lifecycle, compliance and supplier concerns.
Share planned recruitment, locations, services, tenders, audits, projects and budget dates.
Include the people who can approve priorities, accept risk and resolve ownership questions.
Identify the approvals, choices or information leadership expects from the meeting.
QUESTION 1
What Are Our Biggest Technology Risks Right Now?
Ask the MSP to identify the risks most likely to affect operations, finances, customers or reputation. The answer should be prioritised and specific to the organisation rather than a generic list of threats.
Ask for
The risk, affected systems or processes, likelihood, potential impact, current control, recommended action, owner and target date.
What good looks like
A short, current risk register written in business language with evidence and clear decisions for leadership.
Typical areas include unsupported systems, ageing infrastructure, weak identity controls, untested recovery, supplier dependencies and known compliance gaps.
QUESTION 2
Which Cybersecurity Improvements Should We Prioritise?
Cybersecurity should be a standing agenda item. Ask what has changed since the last meeting, which controls are incomplete and which actions would reduce the most meaningful risk.
| Area | Evidence to review | Leadership question |
|---|---|---|
| Identity | MFA, administrator accounts, Conditional Access and access reviews. | Which accounts or users remain outside the required controls? |
| Devices | Endpoint protection, patch status, encryption and unsupported equipment. | Which devices create the highest exposure and when will they be addressed? |
| Email and people | Filtering, awareness, phishing results and incident reporting. | What behaviour or attack pattern needs attention? |
| Recovery | Backup coverage, alerts, retention and restore tests. | What can we recover, in what order and within what time? |
Explore What Cybersecurity Protections Does a 50-Person Business Actually Need? for a practical protection baseline.
QUESTION 3
Are We Making Effective Use of Microsoft 365?
Many organisations pay for Microsoft 365 capabilities that are underused or inconsistently governed. The review should cover value, security and adoption rather than licence count alone.
Collaboration
Are Teams, SharePoint and OneDrive structured, governed and used in a way that improves work?
Identity and devices
Are MFA, Conditional Access, Defender, Intune and administrator controls applied consistently?
Licensing and adoption
Are licences matched to needs, inactive accounts removed and useful capabilities supported with guidance?
The MSP should distinguish quick improvements from changes that need discovery, governance and user adoption. See Microsoft 365 Services for the broader management approach.
QUESTION 4
What Technology Investment Should We Plan for Over the Next 12–36 Months?
Ask for a forecast that separates recurring services, lifecycle replacements, risk remediation and business projects. This gives finance and leadership time to plan instead of approving urgent expenditure.
Recurring costs
Support, licences, cloud use, connectivity, security services and known renewal changes.
Lifecycle costs
Devices, servers, networks and software reaching warranty, support or capacity limits.
Projects
Migrations, office changes, new systems, automation and improvements linked to business plans.
A useful Technology Roadmap explains timing, dependencies, cost range, risk and expected outcome.
QUESTION 5
How Is the Service Performing Against Business Expectations?
Service reporting should help leaders understand the employee and operational experience. A high percentage of tickets within target can still hide recurring disruption, weak communication or a small number of serious unresolved problems.
| Measure | What to ask | Why it matters |
|---|---|---|
| Response | How quickly were issues acknowledged by priority? | Shows whether the provider engaged within the agreed time. |
| Resolution | How long until service was restored or a safe workaround supplied? | Shows the duration of business impact. |
| Communication | Were users and leaders kept informed during material incidents? | Reduces uncertainty and repeated chasing. |
| Experience | Which teams, sites or applications generated dissatisfaction? | Highlights problems hidden by overall averages. |
| Open risk | Which long-running incidents, problems or actions remain unresolved? | Prevents difficult work disappearing from headline reporting. |
For a detailed explanation of service measures, read What Response Times Should You Expect From an IT Support Provider?
QUESTION 6
What Is Causing the Most Support Demand?
Ticket data should reveal more than how busy the helpdesk was. Ask which problems repeat, which users or sites are most affected and what permanent improvements would reduce future disruption.
Operational view
Top ticket categories, repeat incidents, escalations, ageing tickets, affected users and time lost.
Improvement view
Root causes, planned fixes, training needs, device replacement, configuration changes and accountable owners.
QUESTION 7
How Prepared Are We for a Cyber Incident or Major Outage?
Prevention matters, but leaders also need confidence that the organisation can respond and recover. Ask for evidence rather than reassurance.
Who declares an incident, coordinates technical work and updates leadership?
Which systems must return first and what business dependencies determine the order?
When were important systems last restored successfully and what was learned?
How will employees, customers, insurers, regulators and suppliers be informed?
How will decision makers communicate if normal email or identity services are unavailable?
When was the response plan last exercised and which actions remain open?
The review should distinguish backup success from proven business recovery and record any accepted risk.
QUESTION 8
Are We Meeting Compliance and Governance Requirements?
Ask the MSP which requirements it supports, what evidence it maintains and where responsibility remains with the organisation or another adviser. This may include Cyber Essentials, data protection, insurance conditions, customer questionnaires and sector obligations.
Clarify responsibility
Document which controls, records, assessments and approvals belong to the MSP, internal teams and specialist third parties.
Clarify evidence
Confirm which reports, configurations, tests, training records and improvement actions can support governance and assurance.
The provider should be precise about its role and should not imply that using managed IT support transfers accountability away from business leadership.
QUESTION 9
Is Technology Helping or Hindering Business Growth?
Share the organisation's plans and ask whether current systems, security, skills and suppliers can support them. The answer should identify constraints before they delay recruitment, new services, locations, acquisitions or regulatory commitments.
Capacity and performance
Can infrastructure, licensing and support processes accommodate more users, data and locations?
Projects and integration
Are there dependencies, ownership gaps or technical debt likely to delay planned initiatives?
People and process
Will employees receive the training, communication and support required for change to deliver value?
A strategic provider should connect technology decisions to measurable business outcomes, risk and cost.
QUESTION 10
If You Were Running Our Organisation, What Would You Change First?
This question tests whether the MSP understands the business and is willing to offer a clear professional opinion. The best answer is candid, proportionate and supported by evidence.
A useful answer
Identifies a small number of priorities, explains the business reason, acknowledges cost and disruption, and proposes a realistic sequence.
A weak answer
Promotes products without context, avoids difficult issues, lists every possible improvement or cannot link recommendations to business goals.
Ask what the provider would stop, start and continue. This often reveals whether the relationship is strategic or mainly transactional.
MEETING STRUCTURE
What Should Every MSP Review Meeting Cover?
A consistent agenda makes trends easier to see and prevents urgent operational topics from consuming the whole meeting.
Actions and changes
Previous commitments, significant business changes and decisions required today.
Service and users
Performance, material incidents, recurring demand, escalations and employee experience.
Cybersecurity and recovery
Current risks, control status, incidents, backups, testing and priority improvements.
Assets and lifecycle
Unsupported technology, warranties, capacity, reliability and planned replacement.
Microsoft 365 and suppliers
Security, collaboration, licensing, adoption and important third-party dependencies.
Roadmap and budget
Business priorities, projects, cost forecasts, dependencies, owners and target dates.
REVIEW QUALITY
What Are the Warning Signs That an MSP Review Lacks Value?
A review may be too operational when leaders leave without a clearer view of risk, priorities or decisions. Watch for repeated meetings that describe activity but do not create progress.
Reports show volume and percentages without business impact or root causes.
Current threats, controls, recovery and improvement are absent from the agenda.
Replacement and project costs appear only when they become urgent.
Leaders cannot understand the implication, priority or required action.
The same concerns return because responsibility and target dates remain unclear.
The provider does not ask about growth, change, compliance or operational priorities.
If these patterns persist, review whether the service still matches the organisation's needs using What Are the Warning Signs That We've Outgrown Our Current MSP?
MSP Review Meeting Scorecard
Use this table to assess whether the review supports leadership decisions. Record evidence and actions rather than marking an item complete because it was briefly mentioned.
| Review topic | Evidence or decision expected | Covered? |
|---|---|---|
| Previous actions | Completed work, exceptions and revised owners or dates. | Yes / No |
| Technology risks | Prioritised risks with business impact and treatment. | Yes / No |
| Cybersecurity | Control status, incidents and improvement priorities. | Yes / No |
| Service performance | Response, resolution, experience and recurring demand. | Yes / No |
| Backup and recovery | Coverage, alerts, restore evidence and open gaps. | Yes / No |
| Microsoft 365 | Security, adoption, governance and licence value. | Yes / No |
| Lifecycle and capacity | Unsupported assets, replacement priorities and cost. | Yes / No |
| Compliance and governance | Requirements, responsibility, evidence and actions. | Yes / No |
| Business plans | Upcoming changes, dependencies and technical constraints. | Yes / No |
| Roadmap and budget | Priorities, owners, dates, cost ranges and decisions. | Yes / No |
PRACTICAL EXAMPLE
How a Scottish Charity Improved Its MSP Reviews
A 40-person charity held quarterly meetings that focused almost entirely on ticket statistics. Trustees had limited visibility of cybersecurity, future spending and technology risk.
The new structure
Reviews added cybersecurity, lifecycle, Microsoft 365, business continuity, roadmap priorities and budget forecasts, with actions assigned to named owners.
The outcome
The charity gained clearer technology priorities, better budgeting, reduced risk and greater trustee confidence in the decisions being made.
The meeting became more valuable because it connected technical evidence to governance and business outcomes.
AFTER THE MEETING
How Do You Turn an MSP Review Into Action?
End by summarising decisions, accepted risks, open questions and actions. Each action should state the expected outcome, owner and target date, then remain visible until completed or formally changed.
Record decisions
Capture approvals, priorities, deferred work and risks leadership has accepted.
Assign responsibility
Name one accountable owner for every action across the business, MSP and other suppliers.
Review progress
Use target dates and evidence so actions do not disappear between meetings.
Where leadership needs independent structure and planning, Strategic vCIO support can connect technology evidence to risk, budgets and business priorities.
FREQUENTLY ASKED QUESTIONS
Questions About MSP Review Meetings
How often should an MSP review meeting take place?
Quarterly is common for a growing organisation, with more frequent operational contact where risk or change requires it. The right frequency depends on complexity and pace of change.
Who should attend?
Include a business leader who can make decisions, operational or finance representatives where relevant, and MSP contacts able to discuss both service delivery and strategy.
How long should the meeting last?
Allow enough time for decisions rather than presentations. A focused agenda, pre-read and action log usually matter more than a fixed duration.
Should ticket statistics be included?
Yes, when they explain business impact, recurring demand and improvement. Raw totals alone rarely help leadership decide what to change.
What should the MSP provide beforehand?
A concise pack covering previous actions, service performance, material incidents, risks, security, recovery, lifecycle, roadmap and decisions required.
What if the review never leads to action?
Introduce named owners, deadlines and evidence. If the same gaps persist, assess whether the provider can meet the organisation's current requirements.
Do Your MSP Reviews Support Better Decisions?
Stratiis can help structure service reviews around performance, cybersecurity, risk, budgets and a practical technology roadmap for your organisation.
