Begin with a business dependency
Ask which systems the business needs to take orders, deliver work, pay staff and serve customers. Then ask how long each could be unavailable before the consequences become difficult to manage.
Those answers give the review a purpose. They help you assess whether the current arrangements meet your needs and which questions require evidence from your IT provider.
A recovery question worth asking
Consider a fictional distributor that needs its order system working to dispatch goods. Its managers have been told that backups complete successfully. What they need to decide is whether deliveries could resume within the interruption the business can tolerate.
I would ask what has actually been restored, when it was tested, how long it took and which other systems were required. I would also ask who has the authority, access and instructions to carry out recovery. A successful backup job and a demonstrated business recovery answer different questions.
What the management briefing could look like
Business dependency: the order system is needed for dispatch. Management needs to agree the longest acceptable interruption.
Evidence available: backup reports have been provided. A timed recovery of the complete order process has not been demonstrated in this example.
Decision required: agree a controlled recovery exercise and the conditions under which it can be carried out safely.
Responsibility: name a business owner to set the requirement and an IT owner to plan and perform the exercise.
Follow-up: compare the measured result with the business requirement, document the gaps and agree the next work.
Agree the response before buying more tools
The answer may involve changing a configuration, documenting a dependency, clarifying responsibility or purchasing an additional service. Each recommendation needs a reason. Ask what problem it addresses and how you will know whether the change worked.
Some findings need immediate action; others can be scheduled. Where the evidence is incomplete, the next step may be a focused test or investigation. A review should distinguish these situations so an uncertainty does not become an unsupported assurance.
Keep the improvement managed
Agree who checks the arrangements as staff, suppliers and systems change. Record the findings, decisions and follow-up dates in a form the business and its IT provider can use. A report only remains useful when someone owns the work that follows.
My role is to examine the position, explain the implications and help you agree practical improvements with the people who maintain your systems.