The Quarterly Technology Review Every Owner Should Demand
Most QBRs are a ticket count and a slide of green checkmarks. Here is the agenda that makes the meeting useful, and the numbers your provider should bring.
The short answer
The standard quarterly business review reports on the provider's activity rather than your business's position. A useful version runs 60 to 90 minutes in five parts: business context first with you talking, risk position, operational trends read across four quarters, roadmap with the cost of deferral, and three decisions with owners and dates.
The quarterly business review is the most wasted hour in the managed services relationship. The standard version is a deck showing tickets closed, uptime percentage, a patching compliance number, and a slide of green checkmarks. Everyone nods. Nothing changes. The next one is scheduled.
The problem is that the meeting reports on the provider's activity rather than on your business's position. Here is an agenda that fixes it, and the numbers to insist on.
Open with the business, not the technology
Fifteen minutes, and you talk first. What changed in the business last quarter and what is changing next. Headcount, new locations, a new client with unusual requirements, a system you are outgrowing, a seasonal peak coming.
If your provider does not know that you are opening a second location in October, everything else in the meeting is guesswork. This section exists because most technology problems are actually planning problems that were visible a quarter earlier.
The risk position
Twenty minutes, and this is the core of the meeting.
Open findings from your last assessment, with status and target dates. Items that have been open for three consecutive quarters get discussed specifically, including why.
What changed in your exposure. New systems, new vendors with access, new data you are holding, people who left with access that took too long to remove.
Incidents and near misses, including the ones that were stopped. A provider who reports only what got through is reporting on failure. You want to see what the controls caught, because that is the evidence the spending works.
Recovery testing results with measured times, not targets. If no test was run this quarter, that is the finding.
Any change in your compliance or insurance obligations.
The operational picture, read differently
Fifteen minutes, and the numbers to ask for are not the ones usually presented.
Ticket volume trend over four quarters, not the raw count for this one. Rising volume with a stable headcount means something is degrading. Falling volume is the goal, and it is the metric that reveals whether anyone is fixing root causes or just closing tickets.
Repeat issues, grouped. The same problem appearing eleven times is one problem, and it should have a root cause analysis attached.
Time to resolution by severity, and how often the SLA was missed.
Which users or departments generate disproportionate volume, since that is usually a training or tooling gap rather than a people problem.
Anything the provider chose not to escalate, and why.
The roadmap and the money
Ten minutes. What is coming in the next two quarters, what it costs, and what happens if you defer it.
That last part matters most. Every recommendation should come with the consequence of saying no, stated plainly. Some deferrals are perfectly reasonable and a good provider will tell you which. A provider who has never advised you to skip a purchase is selling rather than advising.
Also cover end of support dates coming in the next eighteen months, license renewals, and hardware reaching the end of its refresh cycle. None of these should ever be a surprise, and all of them routinely are.
Close with decisions
Five minutes. Three items maximum, each with an owner and a date, written down and read back before anyone leaves.
Then the standing question, asked every quarter without exception: what is the biggest risk we are carrying right now that we are not addressing.
The answer tells you a great deal. A provider who says nothing significant is either not looking or not comfortable telling you.
Who should be in the room
You or whoever owns the P&L. Your operations lead. Someone from finance if there is spending to discuss. From the provider, the person who understands your account, not a rotating account manager reading a template.
Sixty to ninety minutes, four times a year. If the meeting cannot fill an hour with substance, that itself is the finding.
What to do with the output
Keep the completed scorecards. Four of them side by side tell you the story of the relationship better than any single meeting can. Trend lines on open findings, ticket volume, and recovery test times are the honest measure of whether the arrangement is working.
Bring them to your renewal conversation. It changes the tone from negotiation to evidence.
Get the agenda and scorecard
The QBR Agenda and Scorecard includes the timed agenda, the metrics request you can send your provider two weeks ahead so they arrive prepared, the risk register format, a decision log, and a quarter-over-quarter trend sheet that builds automatically as you add each review.
Send the metrics request before your next one. A provider who cannot produce those numbers has just answered a question you have been meaning to ask.
Frequently asked questions
What should be on an MSP quarterly business review agenda?
Five sections: business context with the client talking first, risk position including open findings and measured recovery test times, operational trends read across four quarters, roadmap with the cost of deferring each item, and a close with three decisions each carrying an owner and a date.
What metrics should I ask my IT provider for?
Ticket volume trended across four quarters rather than a single count, repeat issues grouped with root cause status, resolution time by severity with SLA misses, volume concentration by department, open findings with age in days, and recovery test results with measured elapsed time.
What is the most revealing question to ask an IT provider?
What is the biggest risk we are carrying right now that we are not addressing. Ask it every quarter without exception. A provider who says nothing significant is either not looking or not comfortable telling you.
How long should a quarterly technology review be?
Sixty to ninety minutes, four times a year, with the person who owns the P&L present. If the meeting cannot fill an hour with substance, that itself is the finding.