Before the meeting
- Confirm the client and check source and assessment freshness.
- Inspect automated failures and evidence gaps. Complete due manual reviews where you have the required evidence; keep unfinished work visible.
- Review risk acceptances and proposed work, including expiry, costs and delivery assumptions.
- Prepare a saved client report. Check its generation time and contents before sharing.
- If using the portal, verify the intended person’s external access and visible information. Staff preview does not establish client access, and portal exclusions do not redact an internal report export.
Use a clear agenda
Example: explain a backup concern without overstating it
Suppose fictional Acme has an observation showing a backup older than the agreed window, and its restore review is overdue. These are separate findings. You could say:The latest available backup observation is outside the window we agreed. We need to investigate collection and the backup job before concluding why. Separately, the restore review is overdue, so we do not have a current human review showing the recovery procedure was tested. We propose investigating the backup evidence and arranging the restore review, then checking both outcomes.Use the actual observation time, control threshold and review record in your meeting. Do not replace those details with the example or describe a successful backup as a successful restore test. For a worked technical assessment, see Backup confidence.
Record the right kind of decision
- Investigation: assign the relevant follow-up and retain the unanswered question.
- Risk acceptance: record a reason and future expiry through the supported risk workflow. Acceptance does not make the control pass.
- Planned improvement: create or update a roadmap proposal. Keep one-off, monthly and annual costs distinct.
- Client proposal response: an authorised portal user can approve or decline a visible proposal. This is separate from the MSP’s internal approval and does not execute work.
- Operational change: use the supported remediation workflow and its approval requirements.