Pro-Owner perspective: This document frames your systems as a technical estate — an asset to be stewarded, documented, and bequeathed. Treat these steps as craftsmanship: protect the continuity, auditability, and transferability of your digital legacy.
What it is
A structured quarterly review between technical leadership and executive stakeholders to assess operational health, decide budget allocation, and set priorities for the next quarter. QBR covers five domains: Reliability (uptime, incidents), Security (vulnerabilities, compliance), Cost (spend trends, optimization), Roadmap (delivery, blockers), Risks (top 5 risks, mitigation status).
QBRs are evidence-driven: every claim backed by metrics, logs, or artifacts. No "everything's fine" theater. QBRs result in decisions (budget approvals, priority shifts, resource allocation) documented in decision log.
Why it matters
Without QBRs, technical and business priorities drift: engineering works on "interesting problems" while business needs "revenue-critical features." QBRs force alignment: leadership sees what's actually happening (incidents, spend, delays), engineering sees what business cares about (customer impact, budget constraints).
QBRs also create accountability: decisions are documented, action items have owners, next QBR reviews whether commitments were met.
How we do it
- Pre-QBR preparation (1 week before):
- Reliability tab: Uptime % (last quarter), incident count by severity, MTTD/MTTR trends, top 3 failure modes.
- Security tab: Vulnerability count (critical/high/medium), compliance status (SOC2, GDPR), security incidents, pending remediations.
- Cost tab: Infrastructure spend (compute, storage, network), cost per user/transaction, optimization opportunities.
- Roadmap tab: Features delivered vs planned, velocity trends, blockers, carryover work.
- Risks tab: Top 5 risks (from risk register), severity, mitigation status, budget requests.
- QBR meeting (2 hours):
- Reliability review (20 min): Trends, incidents, action items (what we'll do to reduce MTTR).
- Security review (20 min): Vulnerabilities, compliance gaps, security initiatives (MFA rollout, access reviews).
- Cost review (20 min): Spend trends, optimization wins, cost forecast (next quarter).
- Roadmap review (30 min): Delivered features, velocity, blockers, priority adjustments.
- Risk review (20 min): Top risks, mitigation plans, budget requests (e.g., "Need $50K for backup infrastructure").
- Decisions (30 min): Budget approvals, priority changes, resource allocation. Documented in decision log.
- Post-QBR:
- Decision log published (who approved what, budget amounts, priority order).
- Action items created (tickets with owners, deadlines, success criteria).
- Next QBR scheduled (90 days out).
What you receive
- QBR dossier: Five-tab report (reliability, security, cost, roadmap, risks) with metrics, trends, insights.
- Decision log: All decisions made (budget, priorities, resource allocation) with approval timestamps.
- Action items: Tickets with owners, deadlines, success criteria (reviewed in next QBR).
- Trend analysis: Quarter-over-quarter comparison (are metrics improving? worsening?).
All artifacts stored in wiki (Notion, Confluence) and linked from project management tool (Jira, Linear).
Evidence
Interactive QBR dossier:
- Tabbed interface: Reliability, Security, Cost, Roadmap, Risks. Each tab shows:
- Key metrics: Uptime %, incident count, spend, velocity, risk severity.
- Trends: Quarter-over-quarter charts (going up/down/flat).
- Outputs/decisions expected: What leadership should decide based on this tab.
- Reliability tab: Uptime graph, incident heatmap, MTTD/MTTR trends, top failure modes.
- Security tab: Vuln count by severity, compliance status badges, pending remediation list.
- Cost tab: Spend breakdown (compute, storage, network), cost-per-user trend, optimization ROI.
- Roadmap tab: Features delivered vs planned (velocity), blocker analysis, carryover work.
- Risks tab: Top 5 risks (color-coded by severity), mitigation status, budget requests.
Download QBR package (dossier template + metric dashboards + decision log template): [Link]
Failure modes & guardrails
Failure mode: QBR becomes status report (no decisions)
Guardrail: QBR must produce decisions. If no decisions made, meeting was unnecessary. Reschedule when decisions are needed.
Failure mode: Metrics cherry-picked (only good news)
Guardrail: Required metrics (uptime, incidents, spend, velocity, risks) non-negotiable. No hiding bad news.
Failure mode: Action items ignored
Guardrail: Next QBR starts with action item review. Incomplete items escalated or re-prioritized.
Failure mode: QBRs too frequent (disruption)
Guardrail: Quarterly cadence fixed. No ad-hoc QBRs. If urgent decisions needed, use separate exec meeting (not QBR).