How an Adeo engagement unfolds, in specimen form.
Three engagements — a Quick-Scan, a Baseline Audit, and a month on a vCIO retainer. Each is a composite drawn from recurring patterns across Australian SMEs rather than a single client record; fees, timelines, scopes, and deliverables match the published rate card.
A five-day read on MSP value and performance.
A suburban law firm, around fifty staff across multiple offices, satisfied with the day-to-day service of its MSP but unsettled by invoices drifting upward with no change in scope. The managing partner wanted a plainly written second opinion before the annual review.
What we examined
Microsoft 365 licence assignment reconciled against paid seats; ninety days of ticket data from the MSP's service desk; twelve months of invoices cross-walked against the master services agreement; the monthly service-review cadence written into clause 7 of the MSA.
Representative findings
- Twelve M365 E3 seats paid for and unassigned — A$2,100/month leakage; annualised, A$25,200.
- Ticket-resolution SLA contractually 95%; actual ninety-day attainment 68%, with no credit or remediation triggered.
- Monthly service review mandated by MSA clause 7; last conducted fourteen months prior.
- A standing A$180/month "extended monitoring" line item billed for eleven months without a signed change order.
- One contract-schedule indexation of 7.2% applied on renewal, above CPI, without notice.
What changed
A four-page executive brief with a one-page MSP accountability section designed to be forwarded to the account manager without edit. Seat reconciliation delivered within a fortnight; the first commercial credit in three years posted the following month. Monthly service reviews re-instated. The firm did not change MSPs; the relationship became measurable.
The specimen outcome for a Quick-Scan is not a replaced MSP. It is a relationship with a written scorecard — forwardable, defensible, and recurring only if the client asks us to repeat it.
A cyber-insurance renewal, defended on evidence rather than assertion.
An eighty-eight-staff accounting practice with two offices, regulated under APES 230, approaching its cyber-insurance renewal. The carrier's control questionnaire had grown from nine items the year prior to forty-seven. The managing partner wanted the renewal defended on evidence rather than assertion, before any commercial conversation with the broker.
What we examined
All eight domains of a Baseline Audit: identity & access; endpoint posture; Microsoft 365 security configuration; backup and recovery readiness; network exposure; data-sharing and third-party access; incident-response readiness; and MSP governance — contract, SLA, commercial, and roadmap quality. Evidence was collected through authenticated API reads on the practice's own tenants plus document review across three years of invoices and ticket exports.
Representative findings
- Essential Eight maturity: five of eight controls at ML1, one at ML2, two not met. MFA-on-privileged-admin enforced but shared break-glass account not rotated in fourteen months.
- Backup restore test last conducted one hundred and twenty-eight days prior; insurer policy wording required a successful restore test within the preceding ninety days.
- Microsoft price step-up — a re-tiered Business Premium uplift of 11.3% — applied at auto-renewal without a re-negotiation conversation.
- No documented incident-response plan; no tabletop exercise on file; Notifiable Data Breach escalation path undefined.
- Twelve third-party integrations granted tenant-wide access; three held by former vendors, unrevoked.
- ISP contract auto-renewed at 22% indexation, noticed by accounts payable after the first billing cycle under the new rate.
What changed
A sixty-two-page Baseline Audit report, a one-page executive scorecard, a detached MSP accountability matrix, and a twelve-month remediation roadmap with named owners and dates. The roadmap was sequenced so that every item closing before the renewal date hit a control on the carrier's questionnaire. The broker accepted the scorecard as supporting evidence; the renewal landed with cover expanded, excess reduced, and premium materially below the indicative notice. Maturity Level 2 across all eight controls was scoped as a six-month programme and handed to the MSP as instructed work.
The specimen outcome for a Baseline Audit is not a scare report. It is a document that is simultaneously useful to the board, the insurer, and the MSP — without requiring any of the three to read it through each other's eyes.
What the fourth month of a retainer actually looks like.
A forty-six-staff not-for-profit carrying federal grant exposure, whose long-serving IT consultant had retired earlier in the year. The board had no independent view of IT spend or risk; Adeo was engaged on a mid-tier vCIO Oversight Retainer. The specimen below is the fourth month of the first twelve, when the cadence settles and the artefacts are regular.
What a month on retainer contains
- Eight advisory hours, booked by the CEO and the operations manager, drawn on as needed.
- One Adeo Pulse monthly performance scorecard, issued first business day of the month.
- Attendance at the MSP's quarterly business review — as observer, not party.
- Roadmap maintenance: twelve-month remediation roadmap updated with the month's closures and new additions.
- Written advice on any commercial or technical decision raised by the client during the month.
- Quarterly board-ready appendix, built progressively month by month so the quarterly pack is not written under deadline.
What this particular month contained
- Pulse scorecard: overall 78 / 100, green, up two from month three. Two amber flags — backups (a restore-test gap) and commercial (a Microsoft price step-up detected without a re-negotiation conversation on file).
- A short-form written review of a helpdesk-services RFP the operations manager had received from an adjacent MSP — scope adequate, pricing reasonable, but governance and reporting clauses thin; recommended negotiation points supplied.
- A disaster-recovery tabletop exercise facilitated with the senior leadership team — two hours, one scenario (ransomware on the finance platform), six decisions needed, three gaps identified and added to the roadmap.
- A phishing-simulation programme scoped, vendor-neutral, to commence in month six.
- Draft board appendix — three pages — covering IT risk posture, roadmap status, and a one-line commentary on commercial drift.
What the retainer is not
Not a help desk, not a hands-on delivery arm, and not a vendor. The MSP continued to operate the environment; Adeo continued to oversee. The retainer's value sits in the continuity — the client always knows who to call before a procurement decision, a renewal conversation, or a board question — and in the independence of the voice on the other end of that call.
The specimen outcome for a vCIO retainer is not a dashboard. It is an advisor on retainer, measured monthly, with a scorecard that the board never has to chase.
If one of these specimens resembles your situation, the next step is a conversation.
Thirty minutes, no cost, no sales script. We will scope the question you are actually trying to answer and tell you plainly whether a Quick-Scan, a Baseline Audit, or a retainer is the right shape of engagement — or whether none of them is, and why.
Book a conversation →Read the full rate card at /services, or write directly to contact@adeo.au.