6 Questions Smart Companies Ask Their IT Provider Every Quarter

Waiting until contract renewal to have a real conversation with your IT provider is one of the most common — and costly — mistakes business owners make. Technology changes every quarter. So do cyber threats, compliance expectations, staffing, and the way your team actually uses its tools.

If you only hear from your provider when something breaks, you do not have an IT strategy. You have a support line. And for small and mid-sized businesses in Minneapolis-St. Paul and Central Minnesota, that gap can show up fast in the form of downtime, surprise spending, audit headaches, or a security incident that should have been prevented.

The good news: you do not need to be technical to get better answers. You just need to ask better questions every quarter.

Why Quarterly Check-Ins Matter

A strong managed IT partner should be reviewing performance, risk, and strategy with you on a regular cadence, not just closing tickets and waiting for the next crisis. Quarterly check-ins force a different kind of conversation — one focused on trends, accountability, and business impact.

That matters because most problems do not happen all at once. They build quietly. A few unpatched devices here. A backup job that has not been tested there. A subscription someone forgot to cancel. An employee in accounting clicking a convincing phishing email on a busy Friday afternoon. Then one quarter later, the issue becomes expensive.

For Minnesota businesses, the stakes are even higher when compliance, vendor requirements, customer trust, and seasonal operations are on the line. A financial services firm in Minneapolis cannot afford to discover weak MFA coverage after a client due diligence review. A construction company in St. Paul cannot lose access to jobsite files because a laptop fails and the backups were never validated. A manufacturer in Central Minnesota cannot keep production moving if outdated systems create recurring outages on the shop floor.

Quarterly reviews are where you catch those problems before they turn into business interruptions.

1. What Security Incidents Did You Catch or Prevent This Quarter?

This is the first question to ask because it reveals whether your provider is watching for threats or just waiting to respond after the fact.

A proactive IT team should be able to tell you:

• •How many phishing attempts were blocked
• •Whether any suspicious logins were detected
• •Which devices were isolated for unusual behavior
• •Whether endpoint protection stopped malware or ransomware activity
• •What user accounts triggered alerts or needed investigation

The answer should not be vague reassurance like “we haven’t had any issues.” You want actual data. Even better, you want context. For example, if your finance team has been targeted by business email compromise attempts, your provider should be able to explain how those were handled and what controls were tightened afterward.

In a real quarterly review, a smart provider might say, “We blocked 214 malicious emails, stopped one device from downloading a known malware payload, and found two users who needed additional phishing training.” That tells you the security stack is working and your provider is paying attention.

2. How Does Our Patch and Update Compliance Look Right Now?

Unpatched systems remain one of the most common entry points for attackers. That includes operating systems, browsers, line-of-business software, firmware, and third-party applications many companies forget about.

Ask for a current compliance snapshot. A good provider should be able to break it down by device group, application type, and severity. You should know:

• •What percentage of devices are fully up to date
• •Which endpoints are behind on critical patches
• •Whether any servers are overdue for maintenance
• •If any high-risk vulnerabilities are open and unaddressed
• •How quickly updates are being applied after release

This is especially important for businesses running older systems or specialized software. A manufacturer in the Twin Cities may have production equipment tied to a legacy application that cannot be updated casually. A construction firm may have field crews using tablets that miss patches because they are rarely back in the office. A wealth management office may have compliance-sensitive systems that require coordinated updates outside business hours.

Your provider should not just tell you patching is “in progress.” They should show you where you stand and what is being done to improve it.

3. What’s Our Current Backup and Recovery Testing Status?

Backups are not protection until they are tested.

A lot of businesses assume they are safe because they pay for backup software or see green check marks in a dashboard. That is not enough. The real question is whether the data can be restored quickly and completely when something goes wrong.

Ask your provider:

• •When was the last successful restore test?
• •What was restored — a file, a mailbox, a full server, a virtual machine?
• •How long did recovery take?
• •Were there any errors, gaps, or delays?
• •Do we have a documented recovery plan for a ransomware event or site outage?

If your provider cannot answer those questions clearly, that is a problem.

Consider a St. Cloud accounting firm that loses access to client records during tax season. Or a Minneapolis contractor whose project management platform is encrypted after a phishing attack. If backups are untested, recovery is a gamble. If restores are tested quarterly, you can make business decisions with more confidence.

This question also helps you understand whether your provider has a realistic recovery objective or just a theoretical one. There is a big difference between “we have backups” and “we can restore the right system in the time your business can actually tolerate.”

4. Are There Any Tools or Licenses We’re Paying For but Not Using?

Software sprawl is one of the easiest budget leaks to fix, and most companies have more of it than they realize.

Over time, businesses accumulate duplicate licenses, unused subscriptions, and tools that were purchased for a short-term project and never removed. A quarterly review should identify waste like:

• •Duplicate Microsoft 365 or security licenses
• •Unused user accounts still being billed
• •Overlapping backup, chat, or file-sharing tools
• •Paid software no one has logged into in months
• •Premium support plans attached to products your team no longer uses

This is not just about cutting costs for the sake of it. It is about making sure your technology spend matches how your company actually operates.

For example, a construction company may be paying for extra field management seats that no longer match staffing. A financial services firm may be carrying additional security tools that overlap with existing controls. A manufacturer may have old inventory or scheduling software licenses tied to a process that has since changed.

Good IT partners do not wait for you to discover waste on your own. They bring it to you with a recommendation and a plan.

5. What New Risks or Opportunities Should We Be Planning For?

This is where a true partner separates itself from a break-fix vendor.

A strong provider should not only tell you what happened last quarter. They should help you prepare for what is coming next quarter.

That might include:

• •New cyber threats targeting your industry
• •MFA or identity requirements from clients, carriers, or auditors
• •Replacement planning for aging devices or servers
• •Business growth that will strain your current network or storage
• •Cloud migration opportunities that could reduce overhead
• •Changes in insurance requirements or compliance expectations

This question matters because technology is not static. A company that is growing from 25 to 60 employees will outgrow its old setup. A financial services firm may need better logging and retention. A construction company taking on larger commercial work may need stronger mobile access and tighter file control. A manufacturer adding another shift may need more resilient infrastructure and faster help desk response.

If your provider only talks about help desk tickets, they are missing the bigger picture. Your IT environment should support your business goals, not just keep the lights on.

6. How Do Our Metrics Compare to Last Quarter?

Numbers tell the truth. If your provider cannot show progress over time, it is hard to know whether you are actually getting better service.

Ask to review the basics:

• •Average response time
• •Average resolution time
• •Ticket volume by category
• •Uptime or service availability
• •Number of repeat issues
• •Security events blocked or remediated

You are not looking for perfection. You are looking for trend lines. Response times should improve or stay strong. Repeat issues should go down. Uptime should stay high. Security events should be caught earlier, not later.

This is also where you can spot patterns that affect productivity. If your office manager in Bloomington is opening the same printer ticket every other week, that is not just an inconvenience — it is lost time. If users in your manufacturing office are reporting slow logins every morning, that could point to a network or identity issue. If your operations lead keeps chasing the same document permission problem, the process needs fixing, not just more ticket closure.

Metrics give you leverage. Without them, you are guessing.

What Good Answers Look Like

A strong IT partner welcomes these questions and comes prepared with data, not defensiveness. They should be able to explain what happened, what changed, and what they recommend next.

Good answers usually include:

• •Clear numbers, not generalities
• •A plain-English explanation of risk
• •A specific next step or recommendation
• •Ownership of any issues found
• •A plan to improve before the next quarter

Red flags include:

• •“Everything’s fine” with no evidence
• •Blame-shifting when you ask for results
• •Surprise charges that were never discussed
• •No documentation of testing, trends, or improvements
• •Silence between emergencies

If your provider gets uncomfortable when you ask for visibility, that tells you something important. Transparency should not be hard.

Make Quarterly Reviews Part of How You Run the Business

The best managed IT relationships are not built on rescue calls. They are built on regular business conversations that connect technology to risk, cost, and growth.

Quarterly reviews give you a chance to catch security gaps, trim waste, improve reliability, and make better decisions before problems become expensive. For SMB leaders in the Minneapolis-St. Paul area and across Central Minnesota, that kind of discipline is not a luxury. It is a practical way to protect uptime, support staff, and keep operations moving.

If your current provider only checks in at renewal time, you are not getting the level of service your business needs.

The Bottom Line

If your IT provider cannot answer these six questions clearly, consistently, and with evidence, you may not have the proactive partnership you think you do. Quarterly reviews are one of the simplest ways to hold your provider accountable and keep your business ahead of avoidable problems.

If your business is not having structured quarterly IT reviews, now is the time to fix that. Ask for a real review and see whether your provider is truly on your side.