The work sits in another team's queue. A fix identified in March may ship in June, so an agency that measures its own output by findings delivered looks busy while nothing improves.
Status belongs to the client. Recommended, accepted, scheduled, shipped and verified are five different states, and without tracking them a monthly call becomes a negotiation about what was said rather than what was done.
Proof requires dates. Attributing a recovery to a change means knowing exactly when it was deployed, so a record of deployment dates alongside the metric is what turns a claim into evidence.
Access sprawls across environments. Staging credentials, analytics, crawlers and repository permissions accumulate for every client, and an agency that never revokes them carries a risk it has not measured.