6 Questions Smart Property Management Companies Ask Their IT Provider Every Quarter

6 Questions Smart Property Management Companies Ask Their IT Provider Every Quarter

If you're the person holding your property management operation together, you probably spend part of every day worrying about things that shouldn't be your job.

You worry about lease documents being accessible when needed.

You worry about owner statements getting delivered.

You worry about whether the maintenance team's devices are secure.

You worry about whether the broker will have the information they need during an audit.

And you worry about technology issues you don't even know exist yet.

Most operations leaders don't struggle because they're unprepared.

They struggle because they're expected to manage technology risk, compliance risk, operational risk, and business risk without having visibility into all four.

That's why quarterly IT reviews matter.

Not because your technology needs another meeting.

Because your business needs fewer surprises.

The difference between a reactive property management company and a proactive one often comes down to six questions.

Question 1: What Security Risks Changed This Quarter?

Don't ask whether you're secure.

Ask what's different.

Every quarter brings change:

• New employees
• New vendors
• New software
• New devices
• New threats

The question isn't whether risk exists.

The question is whether anyone is tracking it.

For example, imagine a leasing coordinator changes roles but keeps access to sensitive owner financial records she no longer needs.

Nothing breaks.

Nobody notices.

Until an audit asks who has access to trust-account information.

A strong IT provider should be able to show:

• New risks identified
• Risks eliminated
• Open vulnerabilities
• High-risk user accounts
• Changes in security posture

If the answer is "everything looks good," you're receiving reassurance—not information.

Question 2: Have Our Backups Been Tested Recently?

Most property managers believe they're protected because backups exist.

That isn't the same thing as recovery readiness.

A backup only proves data was copied.

It does not prove data can be restored.

Ask:

• When was the last recovery test?
• How long did recovery take?
• What systems were tested?
• Are lease records included?
• Are owner statements included?
• Are Microsoft 365 files included?

Consider a common scenario.

A property manager accidentally deletes a folder containing hundreds of lease amendments.

If restoration takes ten minutes, it's a minor annoyance.

If restoration takes three days, it's an operational crisis.

The difference isn't the backup.

The difference is whether it was tested.

Question 3: Where Is Technology Quietly Slowing Us Down?

Not all technology failures create emergencies.

Most create friction.

A maintenance technician waits for cloud applications to load.

A property administrator creates duplicate spreadsheets because CRM data isn't reliable.

An assistant manager manually rebuilds reports because systems don't talk to each other.

Nobody submits a critical ticket.

Everyone just works around it.

Eventually, those workarounds become the actual process.

Ask your provider:

• What recurring tickets do we see?
• What systems generate the most complaints?
• Where are employees creating workarounds?
• Are applications performing as expected?
• Are integrations producing duplicate records?

Small frustrations are often signs of larger operational inefficiencies.

Question 4: If an Auditor Walked In Tomorrow, What Would We Be Missing?

This may be the most important question on the list.

Because it forces everyone to look at technology through an external lens.

Imagine:

• A cyber insurance review
• A compliance review
• A trust-account audit
• A legal dispute
• An ownership inquiry

Could you immediately produce:

• User access reports?
• Backup testing documentation?
• Security policies?
• Access logs?
• Change management records?
• Vendor access approvals?

Technology isn't judged by what exists.

It's judged by what can be documented.

Question 5: What Should We Budget For Next Quarter?

The most expensive technology purchases are usually the ones nobody planned for.

A server reaches end-of-life.

Workstations begin failing.

Software licenses expire.

Phone systems require upgrades.

Suddenly leadership is being asked for budget approval during a crisis.

A strong provider should already be forecasting:

• Aging hardware
• Expiring warranties
• Upcoming software renewals
• Security improvements
• Infrastructure projects

Good planning turns emergency spending into strategic spending.

Question 6: Where Are We Falling Behind Compared to Similar Firms?

Most providers focus on maintaining systems.

Strategic providers focus on improving them.

Ask:

• What security controls are becoming standard?
• How do our processes compare with similar firms?
• What operational weaknesses concern you?
• What technology debt are we accumulating?
• What risks are growing faster than we're addressing them?

Technology isn't standing still.

Neither are regulators.

Neither are cybercriminals.

The companies that stay ahead ask what is changing before they're forced to react.

How Mature Is Your Quarterly IT Review?

Not all IT reviews create the same value.

Use this maturity scale to determine where your organization stands.

Level	Description
Reactive	Reviews occur only after problems, outages, or complaints.
Basic	Quarterly meetings exist but focus primarily on tickets and projects.
Managed	Reviews include security, backups, documentation, budgeting, and operational metrics.
Strategic	Reviews actively reduce risk, improve compliance readiness, support business objectives, and guide executive planning.

Most firms believe they're operating at the Managed level.

Many discover they're still operating at Basic.

The gap is usually visibility.

How One Property Management Firm Found a Major Access Gap

A property management company with approximately 60 users believed its employee offboarding process was working properly.

As part of a quarterly review, a user-access review was performed.

The review revealed multiple active accounts assigned to former employees.

One account still had access to operational files and financial records months after departure.

Nothing malicious occurred.

No breach happened.

No client data was exposed.

But the exposure existed.

The remediation process included:

• Immediate account removal
• Permission review
• Offboarding checklist revision
• Quarterly access certification

The outcome wasn't dramatic.

That's the point.

The issue was discovered before it became expensive.

The best quarterly reviews prevent headlines nobody wants to explain.

How These Questions Support Audit and Insurance Reviews

Most executives think IT reviews are technology conversations.

They're actually business-risk conversations.

Question	Business Impact
Security Risks	Supports cyber insurance renewals and risk assessments
Backup Testing	Demonstrates recovery readiness and business continuity
Productivity Review	Improves operational efficiency and service delivery
Audit Readiness	Supports compliance reviews and litigation preparedness
Budget Planning	Reduces surprise expenditures and planning risk
Strategic Gaps	Supports long-term competitiveness and governance

When leadership asks whether technology is being managed properly, these are the conversations they're expecting.

Property Management Peer Benchmarks

Use these benchmarks as discussion starters during your next review.

Area	Strong Performance
Multifactor Authentication	Enabled for all users
Backup Testing	Tested every quarter
User Access Reviews	Performed quarterly
Device Replacement	Planned lifecycle management
Documentation	Updated and centrally maintained
Vendor Access Review	Reviewed at least quarterly
Trust-Account System Access	Role-based permissions documented

You don't need perfection.

You need consistency.

The Cost of Doing Nothing

Most technology risk doesn't arrive dramatically.

It arrives quietly.

Inactive User Accounts

Former employees retain access longer than intended.

Untested Backups

Recovery takes far longer than expected during an emergency.

Missed Renewals

Critical systems operate without current support or warranty coverage.

Duplicate CRM Records

Teams lose confidence in reporting and create manual workarounds.

Poor Documentation

Audits become stressful because nobody can prove what happened.

Each problem seems manageable on its own.

Combined, they create operational drag that compounds every quarter.

The Quarterly IT Review Dashboard Every Firm Should Receive

Your provider should be able to produce a one-page report containing:

Risk Score

• Critical risks
• Moderate risks
• Resolved risks

Open Actions

• Assigned owner
• Due date
• Current status

Compliance Gaps

• Documentation issues
• Security gaps
• Process deficiencies

Backup Status

• Last test date
• Recovery results
• Coverage summary

Budget Forecast

• Upcoming renewals
• Replacement planning
• Infrastructure investments

If leadership can't understand the state of technology in one page, the reporting is too complicated.

Next Week's Action

Pull the last quarterly IT review your organization received.

Then answer four questions:

• Did it identify specific risks?
• Did it include measurable metrics?
• Did it assign ownership?
• Did it demonstrate audit readiness?

If not, your quarterly review isn't managing risk. It's reporting activity.

Schedule your 10 minute discovery call with 911 IT. Use the maturity scale, dashboard, and benchmark framework above to determine whether your current review process is actually reducing risk. You'll know quickly whether you're operating proactively or simply hoping nothing gets missed.