A scan gives you an inventory. It does not tell you which server the business stops without, which application nobody will let you touch, or why there is a machine in the storage room that has not been patched since 2019. Those answers come from asking people, and from asking the right people.
This is the bank we work from, grouped by who you are talking to. You will not use all of it in one visit. Pick what fits the client and the time you have, and pay as much attention to how a question is answered as to what the answer is.
Start with the business, not the network
Ask these before you open a laptop. They set the value of everything you find later. A file server is just a file server until you learn that losing it for a day costs forty thousand dollars in stalled production.
The business
- Walk me through what happens here on a normal Tuesday.You are listening for the workflow that touches the most systems. That is the one you cannot break.
- If the internet went down right now, what stops?Answers range from “nothing, we’d keep working” to “everything, immediately.” Both change your continuity plan.
- What is your busiest week of the year, and when do you close your books?Every maintenance window you schedule has to avoid these. Nobody volunteers them.
- How many people work here, and how many of them are remote or in the field?Compare to the license count later. The two rarely match.
- Are you planning to grow, shrink, move, or acquire anyone in the next two years?A move or an acquisition rewrites the roadmap. Better to know now than in month four.
- What does an hour of downtime cost you?Most owners have never calculated it. Walking them through it is often the most valuable thing you do all day.
The owner or decision maker
This conversation is about expectations and money. It is also where you find out whether the assessment is a real buying process or a free second opinion on their current provider.
Decision and expectation
- What made you start looking?The trigger event tells you what has to be fixed first for this to be judged a success.
- What is working well today that you would not want to lose?Ask it out loud. There is usually one thing the current provider does that people quietly rely on.
- Who else is involved in this decision, and what does each of them care about?The person who signs and the person who has to live with it are rarely the same person.
- What are you spending on IT today, across every line?Support, licensing, hardware, phones, connectivity, and the software subscriptions finance pays without telling anyone.
- What is your appetite for change in the first ninety days?Some clients want everything modernized at once. Others will tolerate two changes. Price accordingly.
- How do you want to hear from us, and how often?The gap between an MSP’s reporting habits and a client’s expectations is behind most of the churn in this industry.
- What would make you fire us in a year?Uncomfortable question, and the answer is almost always specific and useful.
The person who actually fixes things
Every company has one. Sometimes it is an office manager, sometimes a controller who is good with computers. They know more about the environment than the owner and more than the outgoing provider’s documentation. Find them and give them half an hour.
The informal fixer
- What breaks most often?You will get a real answer here that no ticket report contains, because half of these were never logged.
- What do people ask you for help with?The gap between this list and the ticket history is the work happening outside the support agreement.
- Is there anything that only works if you do it a certain way?The workaround that has been running for six years. Document it before someone optimizes it away.
- Who has passwords they probably should not have?Ask casually. People answer honestly because they have been uncomfortable about it for a while.
- What did the last IT company never get around to?The backlog you are inheriting, described by someone who watched it accumulate.
- Is there any equipment nobody uses but nobody will unplug?There is. It is usually in a closet, running one application for one department.
Users on the floor
Two hours walking desk to desk beats a survey. Keep it to three questions and let people talk. You are not collecting data so much as finding out where the friction is and letting the staff see that someone asked.
At the desk
- What is the most annoying part of your day, technology wise?Slow logins, a printer that drops off, a shared drive that takes twenty seconds to open. Small things, and they set the client’s opinion of IT.
- Is there anything you have stopped reporting because nothing happened?This is the number that matters. Silent problems are the ones that turn into churn.
- What do you use that is not on the company’s list?Personal Dropbox, a free PDF tool, a spreadsheet on a home machine. You will find something.
Applications, and who owns them
Line of business applications cause more onboarding delays than anything on the network. The vendor relationship usually sits with a department rather than with IT, and the support contract may have lapsed years ago.
Per application
- Who inside the company owns this application?Not who administers it. Who decides about it and pays for it.
- Is the vendor support contract current, and who is the authorized caller?If it is not you, every vendor issue routes through someone on vacation.
- What version are you on, and when was it last updated?An application two major versions behind is a project, not a support item.
- Does it run locally, in the vendor’s cloud, or on a server here?The answer is sometimes all three, on different sites.
- What happens to this application if the server it lives on dies tonight?Ask the vendor too. Their answer and the client’s answer often differ.
- Is anyone still using the version this replaced?Somebody always is, usually for historical records nobody migrated.
Risk, insurance, and obligations
These questions are worth the whole assessment. Clients routinely attest to security controls they do not have, and they have no idea that it matters until a claim is denied.
Exposure
- Do you carry cyber insurance, and can I see the application you signed?Read what they attested to. Then check whether it is true. This single question has saved clients from uninsured losses more than once.
- What regulations or contracts impose requirements on your data?HIPAA, CMMC, PCI, state privacy law, or a clause in a customer’s master agreement that nobody in the building has read.
- Has anything happened before? A breach, a ransomware event, wire fraud, a lost laptop?Ask directly. It shapes both the technical plan and how the leadership will react to your recommendations.
- Who can approve a wire transfer, and how is that approval verified?Not a network question. It is the attack that actually empties the account.
- What happens when someone leaves? Walk me through the last time.The gap between the written process and the last real departure is where the dormant accounts come from.
- If everything here were encrypted tonight, what is your plan?Most clients do not have one. Saying so out loud is often what unlocks the budget.
What to verify rather than ask
Some answers cannot be trusted, and not because anyone is lying. People report the state of the environment as they last understood it, which may be several years out of date.
Check these yourself:
- Backups. Do not ask whether backups run. Restore something and watch it come back.
- MFA coverage. Not a yes or no. Pull the report and get the percentage, then look at who the exceptions are. It is usually the executives.
- Admin accounts. Count them yourself. The answer you are given is always lower than the real number.
- Patch level. Ask the endpoints, not the person.
- Headcount against licenses. Both numbers exist in writing. Put them side by side.
- Inbound firewall rules. Every one of them should have an explanation. The ones that do not are the finding.
Questions that tell you to walk away
An assessment qualifies the client as much as it qualifies the environment. A few answers should slow you down.
- “We’ve been through four IT companies in six years.” Sometimes the providers were bad. Ask what happened each time and listen for whether anything is ever their responsibility.
- “We just need someone to fix things when they break.” A fine business to be in, and not the one a managed agreement describes. Price it as hourly work or pass.
- “Whatever you recommend, but we can’t spend anything this year.” You will inherit every risk on the register with no way to resolve any of it.
- “The owner’s son handles some of it.” Not disqualifying on its own. Find out what he controls and whether he is losing the work to you.
- Nobody will give you an hour. If you cannot get time during the sale, you will not get it during the onboarding either.
Turning answers into a proposal
The assessment is worth nothing to the client until it comes back as a document they can act on. Attach every recommendation to the finding that justifies it, so the price is arguing from evidence rather than from your judgment alone.
Three things belong in what you hand back. What you found, in their language rather than yours. What it would cost to resolve, separated into what has to happen now and what can wait. And what happens if it does not get done, stated plainly and without theater.
Keep the findings after the deal closes. They are the starting point for the onboarding, and twelve months later they are the baseline that makes the first annual review a conversation about progress. The sequence for that first month is in the onboarding checklist, and if you are taking the client from another provider, the takeover playbook covers the handover.