WHAT AN MSP OMA SHOULD COVER

What it covers:Service packaging, per-user and per-device pricing, MRR per endpoint, true gross margin per agreement, tool cost as COGS, SG&A with fair-market owner comp, EBITDA based on real numbers, and project vs recurring mix.

Why it matters:If the financials are broken, every other initiative is built on sand. Most MSPs do not know their actual gross margin per client. That is the first thing this section fixes.

What it covers:Revenue targets at 12, 24, and 60 months, organic vs M&A growth mix, written ICP with firmographics and tech standards, services in and out of scope, minimum acceptable MRR, retention rate, and top churn reasons.

Why it matters:Direction matters before discipline. Without a real ICP and a target, you cannot say no to bad-fit clients and cannot price the good ones properly.

What it covers:Accountability chart across SDM, AM/vCIO, Projects, QA, and NOC. Single points of failure. Career ladder and compensation bands. Utilization by tier. Tech tenure and training. Org structure for the next revenue stage.

Why it matters:The owner working in the business is a ceiling, not a feature. Single points of failure quietly cap growth and burn out the people who should be running things.

What it covers:Ticket volumes, FRT, MTTR, SLA adherence, FCR, L1 resolution rates, escalation/rework/reopen rates, tech utilization by tier, after-hours coverage, billable hours per tech, effective hourly rate, and stack integration health.

Why it matters:This is the engine. If service delivery is reactive, undocumented, and dependent on heroics, scaling just multiplies the chaos.

What it covers:Pre-classification rates, dispatch ownership and backup, auto-assignment rules, call and chat to ticket flows, structured wrap-up forms, and which workflows are candidates for automation or AI.

Why it matters:Triage is where MSPs leak the most time. Cleaning it up is the highest-leverage operational change in most businesses below $3M.

What it covers:RMM policy consistency, patch compliance, golden images and automated provisioning, PSA/RMM/docs/security integration health, RMM alert noise, false positive ratios, and reusable automation scripts.

Why it matters:Baseline hygiene is non-negotiable. Inconsistent patching and noisy RMM alerts erode trust with clients and burn your senior techs on work that should be automated.

What it covers:Documentation standards and enforcement, SOP coverage of top ticket types, required documentation at ticket close, onboarding and offboarding checklists, new user automation, and documentation scorecards.

Why it matters:You cannot scale heroics. Documentation is what lets you trade superstar dependence for repeatable systems and lets you bring on techs who are not already in the inner circle.

What it covers:QBR/SBR cadence by client tier, 12 to 24 month client roadmaps and budgets, approval hit rate, unified client health scoring, attach rates for security and add-ons, and referral and review motion at SBR close.

Why it matters:Expansion revenue is cheaper than acquisition. A real lifecycle motion turns existing clients into multi-year roadmaps and predictable add-on revenue.

What it covers:Documented 5-stage sales process, deal scoping ownership, SOW templates, pricing guardrails, top 3 lead sources and volumes, average sales cycle, win rate, vertical targeting, and onboarding capacity per month.

Why it matters:You cannot sell what you cannot deliver. Growth without onboarding capacity and pricing discipline is how MSPs blow up their margin and their team in the same quarter.

What it covers:Baseline controls across the stack, percent of clients meeting the minimum standard, security as required vs optional, phishing simulation and awareness cadence, and tested incident response playbooks.

Why it matters:Security is either a productized program with tiers and accountability or it is the thing that ends the business. There is no comfortable middle ground at $3M+.