Free checklist
Ten questions to help you examine what your IT provider reports. Ask for supporting evidence, record its scope and date, and note what still needs checking.
All ten are below, in full, with evidence to request and questions to follow up. The form sends the printable five page version, for taking into the meeting.
Want the printable version?
The purpose
This is a starting point for an evidence-based conversation, not a test of honesty or a complete audit. A document can support an answer without proving that every relevant control or service works.
Why these ten
A conversation helps explain the work. Supporting records help you examine it. Check when each record was produced, what it covers and whether it answers the question about your own environment.
Adapt these questions to your agreement and business needs. A missing record, an excluded service and a verified delivery problem require different responses.
The ten questions
01 · Security
Ask to review. A dated report with scope, findings, limits and a responsible person for follow-up.
Follow up. A product name alone does not show how the control is configured, monitored or tested.
02 · Security
Ask to review. A current list with each account's purpose, permissions and responsible owner, including service and emergency accounts.
Follow up. A count alone, or “only the IT team.” Neither identifies the accounts or why their access is needed.
03 · Backup and recovery
Ask to review. A date, duration, scope, test result and any unresolved recovery dependencies.
Follow up. “Backups run nightly.” That describes backup jobs, not a demonstrated recovery.
04 · Backup and recovery
Ask to review. Written recovery objectives, supporting test results and the assumptions or dependencies not yet verified.
Follow up. “We would have you back up quickly.” Quickly is not a number, and nobody can plan around it.
05 · Provider performance
Ask to review. The service list from the contract, set beside a report written against that same list.
Follow up. A ticket count alone. Relate activity and outcomes to the services and reporting period you agreed.
06 · Provider performance
Ask to review. The previous report’s actions, each with a status and a date.
Follow up. A fresh report that omits earlier actions. Ask whether they were completed, deferred, superseded or still need work.
07 · Technology spending
Ask to review. Licence counts and usage, checked against business needs, with reasons to retain, change or cancel each item.
Follow up. “It is all bundled.” Bundling is a pricing choice, not an answer about what you use.
08 · Technology spending
Ask to review. A written explanation of resale margins, commissions or additional work associated with each recommendation.
Follow up. Discomfort, or “we are vendor neutral” with nothing behind it. You are asking about incentive, not integrity.
09 · Strategy
Ask to review. A list of systems with end-of-support dates, and the budget year each one lands in.
Follow up. “We will deal with it when it happens.” Ask for an owner and a plan before support ends.
10 · Independence
Ask to review. The name of an independent party, or an honest “nobody currently.” Both are real answers.
Follow up. “Our own internal process” without its scope or results. Internal review can be useful, but is not an external independent review.
That is the whole document. The five page version is the same ten questions laid out to print, with room beside each one to write the answer you were given.
Reading your own answers
A missing or unclear answer is something to investigate. Record what is missing, why it matters and who will follow up. The number of gaps alone does not establish whether your provider is delivering the agreed service.
How to evaluate the provider you already have sets out what to do with the answers: how to run the exercise, how to read what comes back, and how to plan follow-up. The rest of the questions worth asking are on the Checks.
Review unresolved questions with your provider. Agree what evidence or action is needed, who owns it and when to follow up. Keep missing evidence, agreed exclusions and verified delivery problems distinct. Explore an independent review if you need a second view of the evidence.
Keep reading
Compare agreed services with records, reported claims and unresolved questions.
The ChecksEleven plain language pages on the situations that make a business doubt its provider.
The Actually BriefPlain language answers to the technology questions leaders actually ask. No pitches.