What to Expect from a vCIO in the First 90 Days
Engaging a vCIO means putting trust in someone before you have much to go on. In our experience, that is the part people find hardest. Not the cost, not the commitment. The question underneath both of them: how will I know I can rely on this person to deliver what I actually need?
It is the right question to ask. And the best answer is not a credential or a reference. It is a clear picture of what the first 90 days should produce, so you can hold the engagement to something concrete from day one.
If you are still deciding whether a vCIO is the right fit, start with our article on what a vCIO does before reading this one.
Why the first 90 days matter more than the Rest
The first 90 days of a vCIO engagement are the diagnostic test for everything that follows.
A vCIO who listens carefully, asks the right questions, and earns the trust of your leadership team in this window will set the engagement up properly. In contrast, the one who skips straight to recommendations will not.
The reverse is also true. If you and your vCIO do not lay the foundations properly in this period, the engagement drifts. Reporting becomes periodic rather than continuous. Risks sit in spreadsheets rather than being actively tracked. Leadership meetings cover activity rather than progress.
Most of the time, when a vCIO engagement underperforms, the problem started in the first 90 days. Not because the wrong person was hired, but because the setup was rushed.
Week 1 to 4: Assessment and listening
What your vcio should be doing
In the first month, your vCIO should be asking more questions than answering them.
First, this is the assessment phase. That means conversations with your leadership team and the people who actually run things day to day. That leads into a current-state review of your technology environment and an IT health check covering your systems, risks, policies, and gaps.
You should also see early triage at this stage. Not a full roadmap. An initial read on where the urgent risks sit, where IT is actively holding the business back, and what can be resolved without waiting for the full picture.
One of those early priorities is ICT risk management. Notably, it comes up every time.
What you should be doing
From your side, this means scheduled conversations, access to whatever IT documentation exists, and introductions to the right people. It is not a heavy lift. But your engagement here matters. What your vCIO learns in month one determines what they produce in month two.
What you should see by end of week four
By the end of week four, you should know your vCIO understands your business and has identified the critical unknowns. What comes next should be clear. And agreed.
By the end of month one, you should know where you stand. Month two is where you find out what to do about it.
Month 2: from assessment to recommendations
The draft technology roadmap
Month two is where listening turns into output.
By day 60, a draft technology roadmap should be on the table. Not a finished document. A structured first view of priorities, recommended actions, and a sequenced plan for what month one uncovered.
The risk and priority register
Alongside the roadmap, you should have a risk and priority register. A working document that names the risks your organisation is carrying, rates them by likelihood and impact, and assigns ownership for each. This is not a static report. Instead, it is a live instrument that your vCIO maintains and updates as the engagement progresses. By month three, it feeds directly into your board reporting.
Your role at this stage
Consequently, your role shifts at this point. You move from information provider to active reviewer. You and your vCIO will be working through the draft recommendations together, testing them against your business priorities, your appetite for change, and your budget reality. The roadmap is not something your vCIO hands over. Rather, it is something you build together.
Month two is also when the cost of doing nothing becomes clear. What are the highest-value changes to make first? What can be resolved quickly and what requires a longer lead time? Those are the questions month two should be answering.
If they are not, ask them directly.
By the end of month two, the picture is clear and the plan is taking shape. Month three is where it all becomes a governance function.
Month 3: Governance, cadence, and continuous oversight
Establishing the reporting rhythm
By month three, the engagement should be operating as a proper governance function, not just an advisory relationship. What that means in practice: regular reporting rhythms are in place and your leadership team and board have current visibility of technology risk and progress. Your vCIO has completed the first formal quarterly review.
AgendisRISK and continuous governance
The reporting is not a slide deck assembled the night before. In our experience, real-time visibility is what separates a governance function that actually drives outcomes from one that simply documents them. That is why we use AgendisRisk. It gives you and your leadership team continuous, on-demand access to your risk and governance picture, not a snapshot prepared for a quarterly meeting. That transparency creates accountability. For your vCIO, for your team, and for the decisions being made on your behalf.
AgendisRisk is our Microsoft 365 enterprise risk management software. Instead, it replaces the spreadsheet most organisations use to track risk and keeps every item logged, owned, and visible in real time.
This matters particularly for organisations with formal governance or compliance obligations. The reporting structure and risk register a well-run vCIO engagement produces gives you the documented evidence trail those obligations typically require.
The 90-day review
By day 90, you should also have a documented 12-month plan in draft. Not a list of aspirations, but a structured programme with clear priorities, defined owners, and measurable outcomes.
The 90-day review is a formal checkpoint. What has been delivered against what was planned? Has anything changed that affects the priorities, and what does the next quarter look like? Done well, that conversation is one of the most valuable hours you will spend on technology all year.
What you should have at day 90
The seven deliverables to look for
If your vCIO has set up and delivered the engagement properly, you should be able to point to all of the following by day 90.
A completed current-state assessment of your technology environment, systems, risks, and governance posture. Alongside it, a draft technology roadmap with priorities sequenced by business impact.
A risk and priority register with ownership assigned to every item on it. An active reporting rhythm, with board-ready visibility in place. A clear picture of your ICT risk profile and the controls in place or needed.
A 12-month programme of work in draft, with key decisions and milestones defined. And a direct line of communication between your vCIO and your leadership team that does not depend on a quarterly meeting to stay current.
That is not ambitious. Rather, it is the baseline.
What to do if the engagement is not on track
Four signals to watch for
- Your vCIO is delivering observations but not recommendations. However, assessment without output by the end of month two is a problem. You should be seeing a draft roadmap and a risk register by day 60. If you are still in listening mode, ask directly what is preventing the shift to recommendations.
- Reporting is irregular or retrospective. If you are receiving ad hoc updates rather than a regular rhythm, or if reports describe what has happened rather than what is at risk, the governance function has not been established. That needs to be addressed before month three closes.
- Your leadership team does not know what is being worked on. If the people accountable for the business cannot describe the current priorities and the plan for addressing them, the engagement has not embedded properly. That is a communication and cadence issue, and it is fixable.
- Risks are being identified but not tracked. If you heard about a risk in month one and it has not appeared in a structured register with an owner and a resolution plan, the engagement is operating at the advisory level rather than the governance level.
In all of these cases, the right move is a direct conversation with your vCIO about the gap between what you expected and what you are seeing. A good vCIO will take that conversation seriously. If they do not, that tells you something important too.
All of these are fixable. But you have to name them first.
Frequently asked questions
Visible output begins at the end of month one in the form of early risk triage and an initial read on priorities. A clearer picture emerges by day 60, when the draft roadmap and risk register are in place. Structured governance takes hold by day 90. The engagement does not take 90 days to start being useful, but it takes 90 days to be running properly.
A consultant delivers a recommendation. A vCIO owns the outcome.
The distinction matters because that value accumulates over time. The longer the relationship, the better your vCIO understands your business, your risk appetite, and where the real opportunities sit.
It depends on where you are in the engagement. In the first 90 days, the touchpoints are more frequent as the assessment and roadmap work requires active collaboration. In an established engagement, the typical rhythm involves monthly strategy sessions, quarterly reviews with roadmap updates, and continuous fractional support in between. The goal is regular, structured contact, not meetings for their own sake.
The engagement moves from setup into ongoing governance and optimisation. By day 90 the foundations are in place: the roadmap, the risk register, the reporting rhythm, and the 12-month plan. From that point, the work is tracking progress, adapting the plan as the business evolves, managing vendors and projects, and ensuring the board always has current visibility of technology risk and investment.
The pace changes. The rigour does not.
No. A vCIO provides strategic oversight, not operational support. The two roles are distinct and complementary. Your managed service provider or internal IT team handles day-to-day operations, helpdesk, and infrastructure. Your vCIO provides the strategic layer above that: governance, roadmaps, vendor accountability, and board reporting. In practice, one of the things a vCIO does well is hold your MSP to account and make sure their work aligns with the broader technology strategy.
Simon Cohen
Written by Simon Cohen, Founder, Cohesis. Simon has over two decades of experience working with Australian SMEs and local government organisations on technology strategy, governance, and implementation.
Strategic IT leadership without the full-time cost. Find out if it is the right fit.
We will learn about your current technology environment, show you what the first 90 days looks like in practice, and give you a clear picture of whether a vCIO engagement is the right fit.
