Twelve questions to ask your IT provider before renewing your licences

You do not need to understand the technical answers. You need to know whether the answer is a fact, an opinion, or a silence. Guide published on 13 September 2026.

How to use this list

Ask the questions in writing, a week before the renewal date. A good provider answers on one page with dates and names; it is the sign they keep their records. A provider who answers "everything is in order" without detail, or gets annoyed, also gives you information. None of these questions is a trap: they are the ones I ask in every IT Audit Express.

The twelve questions

1. Who holds the administrator access to our mail, our domain name and our line-of-business software?
   Reassuring: "you do, with a recovery account kept in this vault". Alarming: "we do, it is simpler". If the provider disappears, you must be able to take everything back tomorrow.
2. How many active user accounts do we have, for how many staff?
   Reassuring: two close figures and a list. Alarming: a gap above 20%, or no list. Ghost accounts of former staff are the first finding in my audits.
3. Is two-factor authentication on for everyone? For administrators?
   Reassuring: "yes, everyone, since this date". Alarming: "for those who asked". Without two-factor, a stolen password is enough.
4. When was the backup last restored, and by whom?
   Reassuring: a date under six months old and a short report. Alarming: "the backup runs every night" (that is not the question). A backup never restored is an assumption, not a backup.
5. Where is our data physically, and under which law?
   Reassuring: a list per service, with country and provider. Alarming: "in the cloud". See the CLOUD Act guide.
6. If everything is encrypted by ransomware on Monday morning, what happens, in what order, and how long until we are back?
   Reassuring: a written procedure, a realistic timeline (days, not hours), an emergency number. Alarming: "that does not happen to small organisations". The Swiss Federal Office for Cybersecurity says exactly the opposite.
7. What remote access exists to our network, and who watches it?
   Reassuring: a short list (VPN, the provider's remote support), with logging. Alarming: a remote desktop exposed to the internet, or "I don't know". It is the most frequent entry point for attacks.
8. What happens the day an employee leaves?
   Reassuring: a five-line procedure, executed the same day, with an owner. Alarming: "you tell us and we handle it", with no deadline or list.
9. What does IT cost us per year, all included, and what do we pay for without using it?
   Reassuring: a table of subscriptions, licences and services, with unused licences identified. Alarming: figures scattered across three invoices. On average, a quarter of an SME's licences sit idle.
10. On which products do you earn a commission or a margin?
    Reassuring: a frank answer. It is not illegitimate, but you must know it when you are advised to renew. Alarming: evasion.
11. Which AI tools are used in the company, with which accounts, and what do our settings say about training and retention?
    Reassuring: a list and verified settings. Alarming: "nobody uses that here". See the one-page AI policy.
12. What would we find in our documentation if you were gone tomorrow?
    Reassuring: an up-to-date file (diagram, access in a vault, contracts, procedures) that you can open yourself. Alarming: "it is all in my head", said with pride.

What it tells you about the provider

A provider who answers all twelve with dates is a good provider: keep them and renew. A provider who answers eight and admits the other four is honest, and the four gaps become your plan for the next six months. A provider who does not answer, or answers in generalities, should not be renewed without looking elsewhere, whatever the relationship.

Frequently asked questions