Your monthly IT report: what it should show and what to ask
If you pay for managed IT, your monthly report is your only regular view of how your systems are really doing. What a useful one contains, and the warning signs.
If you pay an IT provider every month, you should get something every month that shows what was done and what state your systems are in. Many owners receive a long automated PDF full of green ticks and never open it. Others get nothing at all. A good monthly report is short, honest about problems and written so a non-technical owner can act on it. Here is what it should contain and what to ask when it does not.
Why the report matters
Most of what a managed IT provider does is invisible when it works: updates install overnight, backups run, alerts are handled before anyone notices. That is the point, but it also means you cannot tell a well-run network from a neglected one until something fails. The monthly report is your only regular view. It is also the evidence you will need for a cyber insurance renewal, a client security questionnaire or a dispute about what was covered.
What a useful monthly report should show
1. Patching, with the exceptions named
A percentage on its own is not enough. "97% of devices patched" tells you nothing about the 3%. The report should list which computers and servers are missing updates, how long they have been behind, and why: offline, failed install, waiting for a reboot, or deliberately held back. It should also cover firewalls, Wi-Fi equipment and other network devices, not only Windows PCs, because those are often the ones attackers go after first.
2. Backups, and proof that they restore
You want to see which systems are backed up, whether each job succeeded, and when a restore was last tested. A backup that reports success but has never been restored is a hope, not a plan. Ask for at least a periodic test restore of a real file or system, recorded in the report with the date and the result. Microsoft 365 data such as email and OneDrive should appear here too if it is supposed to be backed up.
3. Security alerts and what was done about them
Antivirus or EDR detections, suspicious sign-ins, blocked phishing and accounts locked out should be summarized, with a short note on anything that needed action. The aim is not a scary number of blocked threats. It is a clear line between "handled automatically" and "a person looked at this and here is what they found".
4. Devices, users and licences
A count of managed computers, active user accounts and paid licences, compared with last month. This is where you spot former employees whose accounts are still active, laptops that have not checked in for weeks and licences you are paying for but not using.
5. Support tickets
How many requests were raised, how quickly they were answered and closed, and which issues keep coming back. Recurring problems with the same printer, laptop or application usually point to something worth fixing properly rather than patching every week.
6. Open risks and recommendations
The most valuable part of the report is often the shortest: a plain list of known problems the provider has not fixed and why. Examples are a server running an unsupported operating system, a firewall out of warranty, an admin account without multi-factor authentication or a backup that only exists on site. Each should have a suggested next step and who needs to decide.
Warning signs in a report
- It is identical every month, or everything is always green.
- It covers only Windows PCs, with nothing about network devices, Macs, Microsoft 365 or backups.
- There is no mention of any restore test.
- Problems are listed with no owner, date or plan.
- Nobody offers to walk you through it, and questions take weeks to answer.
Questions to ask your provider
- Which devices are not covered by your monitoring, and why?
- When was our last successful test restore, and what was restored?
- Which of our accounts have administrator rights, and do they all use multi-factor authentication?
- What are the three biggest risks you see in our setup right now?
- Can we review this report together once a quarter?
A good provider will welcome these questions. If the answers are vague, it may be time to review the relationship. Our IT provider handover checklist explains what to collect before any change.
How we can help
Our managed IT services include regular reporting in plain language, covering patch management, backups and security alerts. If you would like a second opinion on the reports you receive today, call (213) 986-4855 or visit our contact page.