IT audit for a small business: a one-day checklist

What is an IT audit and how does it differ from a penetration test?

An IT audit assesses the state of a company’s IT: hardware, software, access, backups, suppliers and working rules. The name covers several different services, though, and it helps to know which one you need before you ask anyone for a quote.

A small company without an IT department should almost always start with the first row. A penetration test of a system where half the team logs in with a shared password will find problems a review would have found for free.

When should a company do an IT audit?

On a fixed plan that matches the risk: a full review at least once a year, and backups and former staff accounts more often, say every quarter. On top of that, whenever something changes that touches data and access. In my experience these are the most common triggers:

• the person who “looked after the computers” is leaving and nobody knows which passwords only they had;
• a large client sends a security questionnaire and you can’t answer half of it;
• you are planning a new system, a move to Google Workspace or Microsoft 365, or an AI rollout;
• subscriptions keep growing and nobody can say who uses them;
• something has already happened: a lost laptop, a hijacked mailbox, a deleted folder.

There is a legal reason too. Article 32(1)(d) of the GDPR requires a process for regularly testing, assessing and evaluating the effectiveness of measures that protect personal data. An article in the UODO Bulletin from September 2026, published by the Polish data protection authority, explains that the provision sets neither methods nor frequency. Regularity does mean planned, documented checks rather than ad hoc ones. It also notes that adopting a yearly cycle from the top does not automatically guarantee compliance; the frequency should match the risk. An organisational rule, such as a ban on private USB sticks, counts only if people actually follow it. Correct as of 24 October 2026. This is not legal advice. If your sector has its own cybersecurity rules, check them separately.

A one-day IT audit checklist

This plan assumes a company of up to a few dozen people that works mostly in the browser and on laptops. You need one person who knows the business, admin access to the main accounts and a spreadsheet with six tabs.

How to rate the findings in that last hour is described below.

1. Software and subscriptions

List every tool the company pays for or keeps data in: email, file storage, accounting, CRM, invoicing, chat, the website. For each one, write down:

• which email address the main account belongs to (a company one or a personal one?);
• who pays, and from which card;
• how many people use it and how many licences are paid for;
• whether you can export the data, and in what format.

A main account registered to a former employee’s personal email is one of the most common findings. If you change vendor or end up in a dispute, the company then has no way into its own data. I cover what to ask a vendor before buying in custom system or off-the-shelf tool.

2. Accounts and access

For each tool on the list, write down who has access and with what permissions. Mark in red:

• accounts of people who no longer work for you;
• shared accounts, such as “office@” with a password the whole team knows;
• administrators who don’t need to be administrators;
• access held by outside firms you no longer work with.

Everyone gets the permissions their work needs and not a bit more.

3. Two-factor sign-in and passwords

Check in the admin console of your email and file storage who has two-factor authentication (2FA) switched on, meaning a code from an app or a hardware key on top of the password. Start with the accounts that open everything else: email, administrators, banking, the domain. Also note where the team keeps passwords. A notebook, an Excel file or sticky notes under the monitor go on the fix list; the answer is a company password manager with folders by role.

4. Backups

This is the most important block of the day. Find out what is backed up, where, how often and who checks that the backup ran. Then do what almost no small company does: restore one real file or one mailbox from the backup and check that it is usable.

In its backup recommendations Poland’s e-Health Centre (Centrum e-Zdrowia) describes the 3-2-1 strategy: at least three copies, at least two on different media, and at least one isolated from the others and from the local network. The same recommendations say backups should not be mounted as a network drive and that restoring systems should be tested on a regular cycle. For a small company the practical questions are:

• does data from cloud tools (email, file storage) have a copy outside that same provider;
• is the backup hidden from the network, or does it show up as an ordinary drive that ransomware will encrypt along with everything else;
• when did someone last restore data from it, and how long did it take.

5. Devices

List the laptops and phones that hold company data, including personal phones with company email. For each one check: is the disk encrypted, does the screen lock with a password, is the system up to date, and can you wipe company data remotely if it goes missing. An unencrypted laptop left in a car is a personal data incident waiting to happen.

6. Domain, email and suppliers

The company domain is the key to your email and website. Find out who it is registered with, in whose name and who has the login. Check that your email has SPF, DKIM and DMARC records set up, which make it harder to spoof your domain (every email provider has instructions for checking them). Finally, gather your contracts with IT suppliers: scope, response time for outages, who holds access, and what happens to the data when the contract ends.

What to do when someone leaves

A departure is the moment when it is easiest to leave a door open. So turn the review into a standing one-page procedure straight away:

1. The day before the last working day: a list of the person’s tools and accounts (from block 2 of the audit).
2. On the last day: lock their email and file storage accounts and forward their mail to their manager.
3. Change the passwords of any shared accounts they knew.
4. Move ownership of their files and folders to someone else before the account is deleted.
5. Collect the laptop and phone, and sign them out remotely from personal devices.
6. Remove them from groups, chat, the password manager and supplier portals.
7. Log it in the spreadsheet: date, who did it, what is left.

The list only works if someone ticks it off every single time. It helps to link it to the HR process so that news of a departure reaches whoever handles IT automatically.

How to rate the findings and plan the month

After several hours of listing, the list usually runs to a few dozen items and you won’t fix them all at once, so give each one two scores from 1 to 3: how likely it is that something goes wrong, and how much it would hurt. Multiply them to get the order.

A worked example (made up, to show the method)

A service company with 25 people, cloud email and file storage, an invoicing tool and a CRM. After a day of review the owner has, among others, these findings:

The first three items are a day or two of work at most, and they remove the biggest risk. You repeat the review on schedule with the same spreadsheet and compare what changed, and you check the restore test and former staff accounts more often than once a year. Each review with a date, scope and the fixes made is evidence of the regularity the GDPR asks about. How often to repeat it depends on the risk.

How I keep this in check at Reefa

At Reefa, my cleaning company, I run our own company operating system, so I ask myself the same questions with every change. A few of the rules I keep in that system:

• Permissions live in one catalogue and roles have ready-made access templates, from coordinator to view-only. What each person can see is enforced by the database, not just the screen.
• Since 23 July 2026 the main administrators can only sign in with a second factor (2FA).
• Since 16 September 2026 a coordinator sees only their own sites and people, and I test permission changes by simulating different roles.
• Client files sit in private storage, and the client portal reaches them only through a server-side function that checks who owns the file.
• The AI agents that work on my websites every day have their rules locked with a checksum. Changing the rules needs my approval again.

I describe that system in more detail in the case study an operating system for a service company. If you are planning AI, you carry the same questions about access and data over to the new tool. The minimum I insist on is in AI in small and medium businesses.

When a self-review is not enough

The checklist in this article catches the most common problems of a small company, but it has limits. You need an outside specialist when:

• the company runs its own servers, a network across several sites or computer-controlled production;
• you have your own app, shop or portal that customers log into. Then you need a penetration test;
• your sector has its own cybersecurity rules, or a client requires an information security certificate;
• something has already happened and you need to establish exactly what leaked and whom to report it to.

Nor is it worth doing a review just to have done one. If nobody leaves the day with tasks and deadlines, a year from now you will find the same things.

Where to start

Block one day in the calendar, take the checklist from this article and start with backups and the accounts of former staff. If you would rather have someone from outside run the review and then keep the fix plan on track, see IT rollouts and fractional CTO: ongoing support costs from PLN 12,000/month excl. VAT and starts with an IT review. You can also book a 30-⁠minute call and go through the results of your review with me. And if you also want to see which processes in your company are ready for AI, take the AI readiness assessment.