IT audit for an SMB: what we check first

Many SMB executives know their IT “holds up”, without knowing how fragile it really is. The server was installed by someone who has since left, the backups run “normally”, passwords circulate within the team, and nobody has the full picture. The day a disk fails or ransomware strikes, it is too late to take stock. An audit exists precisely to answer, before the incident, one simple question: what does your business rely on, and what could stop it?

An IT audit does not need to take three weeks or produce a hundred-page report. At ALLSAFE SOLUTIONS the initial audit is free and takes one day on site. It answers five questions, in this order.

Before the audit: what to prepare

One day is enough if the right information is available. To make it count, prepare:

• An internal contact who knows the history: the person who calls the provider when something does not work.
• Administrator access to the servers, the firewall, the Microsoft 365 or Google Workspace console, and the backup tool.
• The list of current contracts: internet provider, IT provider, software vendors, hardware maintenance.
• Recent licence invoices, to see what is paid for and what is actually used.
• The list of business applications: ERP, accounting, payroll, point-of-sale or industry-specific management software.

If some information is missing, that is fine: its absence is already an audit finding.

1. If everything stops tomorrow morning, what do you lose?

We list your critical applications (email, ERP, shared files, telephony) and measure, for each one, the acceptable downtime and the amount of data you can afford to lose. Those two numbers dictate everything else: backup frequency, redundancy, support level.

Specialists call them RTO and RPO:

• The RTO (Recovery Time Objective) is the maximum interruption the business can tolerate before the service is restored.
• The RPO (Recovery Point Objective) is the maximum amount of data you are willing to lose, expressed as time: the gap between the moment of failure and the last usable backup.

These two values are decided with management, not with the IT person. Stopped invoicing, a silent switchboard or an unreachable ERP do not cost every company the same. Once set, they become the specification for the disaster recovery plan.

2. Do your backups actually exist?

We do not look at the screen that says “backup successful”. We restore a random file, then a full machine where possible. All too often, the restore fails or takes hours nobody had planned for.

Beyond the restore test, we check:

• What is backed up: the servers, but also workstations holding data, email and files stored in the cloud.
• Where the copies are: a backup on a disk plugged into the server disappears with it in a disaster or a ransomware attack.
• Who can delete them: if a compromised administrator account can erase the backups, an attacker will do it first.

The benchmark remains the 3-2-1 rule: three copies of the data, on two different media, one of them off site. We explain how to apply it with an immutable copy in our guide to the immutable 3-2-1 backup.

3. Who can get in?

Administrator accounts, former employees still active, shared passwords, remote access without MFA, open ports on the firewall. We list every door and check who holds the key.

In practice, this part often reveals the risks that are easiest to fix:

• accounts of people who left long ago, still active and still holding a licence;
• users working day to day with administrator rights;
• remote access to the server exposed directly to the internet;
• email without multi-factor authentication, even though it is the first target of phishing.

Enabling MFA is often the measure that brings the most security for the least effort. Our MFA rollout guide explains how to deploy it without blocking your teams.

4. What does all this run on?

Server age, OS versions, warranties, licences. A seven-year-old server out of warranty on an unsupported OS is a scheduled outage, not a saving.

We also look at the network: firewall, switches, Wi-Fi access points, internet link and any backup link. A network device whose password nobody remembers, or whose firmware has never been updated, is another weak point. The goal is not to replace everything, but to know what is reaching end of life and plan for it before it fails.

5. What does it really cost you?

We add up contracts, licences, hardware and internal time spent “patching things up”. The result often surprises: structured managed services rarely cost more than the current disorder, they just cost visibly.

The most common hidden costs are licences paid for users who no longer exist, duplicate subscriptions, working hours lost at every outage, and the time an employee spends fixing colleagues’ problems instead of doing their own job. To compare this budget with a contract, see our managed IT pricing ranges in Morocco.

How we prioritise findings

An audit always produces more findings than can be handled at once. We rank them by business impact and by the effort needed to fix them:

Typical finding	Impact if nothing is done	Priority	Typical action
Restore never tested or failing	Permanent data loss	Immediate	Fix the backup, add an off-site copy, test
Email and remote access without MFA	Hijacked account, fraud, ransomware	Immediate	Enable MFA, close exposed access
Former accounts still active	Uncontrolled access to data	Quick	Disable them, review administrator rights
Server out of warranty, OS not updated	Long outage, unpatched vulnerability	Planned	Budget the replacement or migration
No documentation or inventory	Dependence on a single person	Planned	Document the network, access and procedures
Unused or duplicate licences	Wasted spending	Opportunistic	Adjust at the next renewal

This ranking becomes the action plan: immediate priorities are handled first, the others are spread over the twelve months of the plan according to budget.

Common mistakes

• Confusing an audit with an inventory: listing machines does not tell you whether the company can restart after an incident.
• Relying on the backup report: only a restore test proves that a backup works.
• Having the installer audit their own work: an outside view more easily spots what was left aside.
• Aiming for completeness: a report that is too long never gets read. Better three clearly identified risks and a realistic plan.
• Filing the report in a drawer: an audit is only worth something if the priority actions are launched.

Checklist: five checks to run right now

• Restore a random file from the backup and time the operation.
• Check that at least one backup copy is off site and out of reach of a compromised administrator.
• List active accounts and disable those of people who have left.
• Confirm that MFA is enabled on email and on all remote access.
• Note the age and warranty end date of each server and of the firewall.

What you receive

A five-page document: current state, the three major risks, a prioritised twelve-month action plan and a cost estimate. Do what you like with it, including handing it to someone else.

After the audit

The action plan can be carried out by your in-house team, by your current provider or by us. If you entrust it to us, it becomes the basis of a managed IT services contract whose scope and price are set from what the audit actually found. Request your free audit.