Home / Insights / Article
The QBR Is Dead. Long Live the Scorecard.
Ticket counts describe MSP activity. A scorecard helps the client decide what should happen next.
Consented evidence, service records, and client decisions
Steve Copeland
Author
Steve Copeland
Last reviewed: August 13, 2026
On this page
Use the section headings below to scan the evidence, understand the boundary, and take the next step.
# The QBR Is Dead. Long Live the Scorecard.
The traditional QBR reports what the MSP did. A useful scorecard helps the client decide what to do next. Build the meeting around three questions: What improved? What changed? What needs a decision in the next 90 days? That structure turns service data into a business conversation without treating every red item as an automatic upsell.
Stop leading with activity
Closed tickets, response times, and patch percentages may matter operationally. They rarely answer the executive question: “Where do we stand?”
Keep operational metrics in an appendix. Lead with position and movement:
controls that improved since the last review;
new or materially changed exposure;
unresolved items and their business relevance;
accepted risks and the person who accepted them; and
decisions due before the next meeting.
Use a three-page scorecard
Page 1: Position
Show a small set of agreed categories—identity, email, public exposure, recovery readiness, and any relevant compliance or insurance evidence. Mark the source and review date.
Page 2: Movement
Show what changed since the prior review. A green control should connect to completed work. A red control should show whether it is new, unchanged, or awaiting evidence.
Page 3: Decisions
List no more than five decisions. Each needs an owner, options, estimated effort or cost range when known, and a decision date.
Run a 30-minute agenda
5 minutes: Confirm business changes that may affect the technology plan.
10 minutes: Review movement, not every metric.
10 minutes: Discuss the two or three decisions with the highest consequence.
5 minutes: Confirm owners, dates, and the next evidence check.
If an item requires discovery before it can be priced, say so. The scorecard should make uncertainty visible, not hide it behind a project estimate.
Measure the meeting
Track whether the meeting produced:
a recorded risk decision;
an assigned remediation owner;
an approved investigation;
an updated target date; or
a documented acceptance of the current condition.
That is more useful than counting slides or attendees.
The QBR does not need a new name. It needs a better purpose. Report enough activity to maintain accountability, then spend the meeting helping the client understand position, movement, and choices.
Next step: Rebuild your next QBR agenda around “improved, changed, decide” and move ticket metrics to the appendix.
Key takeaway
Rebuild your next QBR agenda around “improved, changed, decide” and move ticket metrics to the appendix.
SCOUTz provides security posture evidence and workflow support. It does not provide legal, insurance, or compliance certification advice.