How to use QBRs to justify MSP pricing
Most MSPs waste QBRs on status updates. The best use them to build evidence that makes price increases easy to justify - and clients who rarely push back.
Quarterly business reviews are the most underused commercial tool in MSP-land. Done well, they justify your pricing without you ever having to defend it. Done badly, they're a tax everyone resents.
Here's the version of the QBR that holds margin and unlocks expansion deals.
Why does a QBR justify pricing better than any contract clause?
Pricing pressure shows up in 2 places. Renewal time. And during the year when a client compares your invoice with a cheap quote.
A contract clause can't help you in either moment. The clause says you charge £X. It doesn't say why. The QBR is where the why lives.
A good QBR shows the client what they got for the money in the previous quarter. Not in marketing language. In specifics. "237 vulnerabilities patched in the last 90 days. 14 phishing emails blocked before they reached your team. 99.94% backup success rate against your RPO of 1 hour. 8 hours of unplanned outages avoided based on the 4 critical incidents we caught proactively."
Once that conversation happens, the conversation about a cheaper alternative changes shape. The cheaper provider's quote is a price. Yours has 237 patches, 14 blocked phish, and 99.94% backup success behind it. The client now has a frame to compare like with like, and they don't have it without you running the QBR.
The MSPs we work with at Assurix who run quarterly evidence reviews book 18 to 24 percent fewer pricing renegotiations than peers in the same revenue band. Same service, same margin, but the price stops being the argument.
(The Assurix platform pulls every metric we just listed automatically from your PSA, RMM, M365, and security tools. So the QBR becomes 30 minutes of conversation off a live dashboard, not 4 hours of slides built from scratch.)
What should be on a QBR slide if you want to defend price?
7 things, in this order, on no more than 6 slides.
Slide 1: Service summary
What we delivered, in plain English. Not features. Outputs. "We answered 412 tickets, resolved 96% within SLA, and prevented 4 outages."
Slide 2: Security posture
MFA coverage, EDR coverage, patch compliance, backup success, last security incident. Numbers, not adjectives. If a number's down, lead with it. Honesty plays better than cover-ups every time.
Slide 3: Operational risk surface
Top 3 risks the MSP is currently tracking on the client's environment. End-of-life software, missing controls, unpatched edge devices. With a recommended action and a quote.
Slide 4: User experience
CSAT score from the client's own users, ticket volume by priority, top 3 user issues. Lets the client see what their team is actually experiencing, not what you're hearing third-hand.
Slide 5: Compliance and audit position
Cyber insurance status, framework readiness (CE+, ISO 27001, Trustmark), pending audit dates. This is the slide that sells expansion. The client sees their compliance posture and what's missing.
Slide 6: Strategic priorities for next quarter
3 things you and the client both think matter. Owned. Dated. Sized.
That's it. Six slides. 30 to 45 minutes of meeting. No vendor logos, no "trusted partner" guff, no graphics that take a senior engineer 3 hours to format.
(Assurix builds 4 of the 6 slides automatically. The security posture, operational risk, compliance position, and user experience slides are pulled live from the integrations we already have. The MSP brings the service summary and the strategic priorities. Saves around 4 hours per QBR.)
Who needs to be in the room?
Two people from the client, two from you. No more.
From the client: the budget holder, and the operations or security lead. The budget holder cares about commercial value. The operations lead cares about whether your service is actually working day-to-day. If the budget holder's the only one in the room, the QBR drifts into a sales pitch. If the operations lead's the only one in the room, the QBR drifts into a status update.
From you: the account manager, and the technical lead who owns the client's environment. Account manager owns the relationship and the commercial frame. Technical lead owns the answers when the operations lead asks something specific. If the technical lead can't make it, reschedule. The QBR without the technical voice loses its bite.
Don't bring the CEO. Don't bring sales engineers who don't know the client. Don't bring "the new junior to learn the format." All three additions dilute the meeting.
How often should you actually run QBRs?
Quarterly, sticking to the name, for clients above a defined revenue threshold (most MSPs use £24k ARR or £2k MRR). Every 6 months for the layer below that. Annually for the bottom 30% of the book.
The temptation is to run QBRs for everyone. Don't. A QBR for a £6k ARR client costs you more in time than the client's net profit margin. Run a 30-minute remote check-in instead, with a single dashboard PDF.
The other temptation is to skip QBRs when the client's calm. That's the worst time to skip. The QBR locks in the perceived value during the period when nothing's broken. If you only show up when there's a problem, the client only associates you with problems.
The discipline is calendar discipline. Block the QBRs for the next 12 months at the start of the year. Don't move them unless someone's actually unavailable.
How do you handle a QBR when something went wrong?
Lead with the problem.
If you had a 4-hour outage in the quarter, slide 1 of the QBR is the outage. What happened, why it happened, what you've changed to prevent it.
The instinct is to bury the bad news in the middle. Don't. The client already knows. They're waiting to see whether you'll mention it. If you don't, you've confirmed the worst suspicion: that you'll cover for yourself when it matters.
The right move is the opposite. Open with the bad. Be specific. Take ownership. Then move into the positive.
In the 6 client recovery situations we've watched MSPs handle through Assurix in the last year, the pattern is consistent. The MSPs who opened the QBR with "here's what went wrong, here's what we did" kept the contract. The MSPs who tried to gloss over the outage lost it within 2 quarters.
(The Assurix platform timestamps every incident, response, and recovery action automatically. So the post-mortem slide writes itself, with auditable detail and no opportunity for the technician to fudge timelines.)
How do you use the QBR to expand the account without sounding like a sales pitch?
Three questions, embedded in the meeting, none of them asked for sales reasons.
Question 1, on slide 3 (operational risk)
"These three risks need investment to fully resolve. Want to scope them as projects, or accept and document the residual risk for now?" That's not a sales question. That's an operational question. The client either says "scope them" or "document them." Either way, you've named the work.
Question 2, on slide 5 (compliance)
"Your insurer's renewal is in October. The questionnaire's likely to ask about X and Y. Should we do the readiness work in advance, or wait?" Again, operational. The client decides. If they say "wait," you've planted the flag. If they say "advance," you've scoped a project.
Question 3, on slide 6 (strategic priorities)
"If you had to pick the one outcome from us next quarter that would matter most commercially, what would it be?" That's the highest-return question in the meeting. Their answer tells you what to upsell against.
Frequently asked questions
What if the client cancels the QBR every quarter?
Then the contract has a problem the QBR isn't going to fix. Escalate to the budget holder once, ask why, and listen. If it keeps happening, the relationship's already drifting and the QBR was a leading indicator.
Should the QBR be in person or remote?
Remote for clients under £50k ARR. In person at least once a year for clients above. The annual in-person QBR is one of the best retention investments an MSP can make.
What if we don't have the data for half these slides?
Then the QBR becomes the forcing function for getting the data. You can't run a meaningful QBR without service metrics, security metrics, and CSAT. If you don't have them, work backwards from the QBR slide template and stand the data up over the next quarter.
How long should the deck be?
Six slides is the cap. Anything more, you're padding. The client will respect a sharp 30-minute QBR more than a 90-minute slide tour.
Can the QBR be a template?
Per-client, yes. Per-MSP, no. Build a template per client based on what they care about, then update each quarter.
The closing principle
Show the client what they paid for. Lead with the bad. Anchor every claim to a live number. The fastest way to stop running ad-hoc evidence packs from scratch every 90 days is to let a Trustmark do the heavy lifting. That's what Assurix is for.