The single most common problem we fix is a business that cannot access its own domain because an agency registered it under the agency name years ago.
Ownership
Insist the domain is registered in your company name, with your email as the administrative contact. You can give an agency technical access without giving away ownership.
Backups
Ask what the backup schedule is, how long backups are kept, and how you restore one. If the answer is vague, assume there are no backups.
SSL
Check whether SSL is included and whether it auto-renews. An expired certificate takes a site down as effectively as a server failure, and it happens every year to somebody.
Renewal pricing
Finally, get the renewal prices in writing. Introductory hosting rates frequently triple at the first renewal.