Managed IT · IT audit
You don’t need to understand firewalls to audit IT. You need plain questions, written answers, and proof you can look at.
Ask for documents, not reassurance
The test restore date matters most
Resistance to the audit is a finding
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time on the calendar below. Or call 954-539-5678.
You don’t need to know how a firewall works to audit your IT department. You need to ask ten plain questions of whoever runs it (an employee, an outside provider, the office manager’s very helpful nephew) and ask to see the proof rather than hear about it. Where is the documentation kept? When was a backup last restored, and what was restored? Who has admin rights, and why? If the answers come back within a week with documents attached, you are in decent shape. If they come back as “don’t worry, it’s all handled”, you have found your problem.
In my experience running JLB for more than 15 years, the technical findings of an owner’s audit matter less than the reaction to being audited. A good IT person is rather pleased to be asked, because they have been waiting for someone to care. A person who gets defensive, stalls, or tells you it is too complicated to explain is the finding, whatever the rest of the answers say.
The premise of any audit is simple: you compare what should be true with what is true. The catch is that most owners do it as a conversation, and conversation is where things go to become vague. So send the questions in writing, allow a week, and ask that every answer come with something you can look at: a screenshot, an exported report, a spreadsheet, a date. You are not grading the technology. You are checking whether someone could take over tomorrow if the person who runs it all were hit by the proverbial bus.
A fair warning about what this is not. It is not a penetration test, and it will not find a clever attacker already sitting in your network. It is the owner’s version of checking that the fire extinguishers are charged. If you want a yardstick to compare against afterwards, CISA’s Cyber Essentials was written for small organizations and is a decent read, and NIST keeps a small business cybersecurity corner with plain-language guides.
The order is deliberate. Questions two and three are the ones I would not let slide. Untested backups and too many admins are behind a large share of the bad days I have seen businesses have.
Good answers are boring. “Here’s the spreadsheet, last updated in August.” “We restored the accounting server to a spare machine in June, it took about four hours, here’s the ticket.” “Three admins: me, the backup account in the safe, and the owner.” Boring is exactly what you want from IT.
Bad answers have a pattern too. There is vague time (“a while ago”), the passive voice (“backups are being handled”), the appeal to complexity (“it’s hard to explain”), and the one that blames the last person. Be that as it may, the previous IT guy is not the one running it now.
In fairness, there is an exception. A lone in-house IT person who also fixes the printers, orders laptops and fields every “quick question” may simply never have had the time to write anything down. That is a resourcing problem, and the fix is to give them the hours (or the help) to document. What you are really testing is willingness. “I don’t have that, but you’ll have it by Friday”, followed by it arriving on Friday, is a perfectly good answer. Someone who resists showing you at all is not.
Score each answer one of four ways: controlled, needs attention, significant exposure, or unknown. (It is the same scale we use in our own assessment reports.) Unknown deserves a category of its own because it is the most common result and the most dangerous one. If nobody can tell you when the last restore happened, assume it never did.
Worked example. Picture a 30-person firm that runs the ten questions. The documentation exists but is two years old: needs attention. Backups run every night, but nobody can name a restore date: unknown, which I would treat as significant exposure. Four people are global admins in Microsoft 365, including the office manager and a contractor who finished a project last spring: significant exposure. MFA is on for everyone except two admin accounts, switched off “because it was annoying”: significant exposure. The other six answers come back fine.
That firm has four things to fix, and the order writes itself. Remove the contractor and the spare admins this week, and turn MFA back on for the admin accounts the same day. Schedule and witness a test restore this month. Update the documentation next. None of it is expensive. Most of it is a few hours of someone’s time, which is the point: an audit usually finds neglect, not a need for new equipment.
Would you rather someone else asked the questions? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report rating your IT operations, cybersecurity, applications, integration, automation, AI opportunities, technology spending and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation, and it works just as well if you have an IT person you like and want to keep. Book your assessment.
Write the results down, send them back to whoever runs IT, and agree dates for each fix. Then repeat the exercise in six months, because documentation drifts and admin lists have a way of growing on their own. For the second round, our IT assessment checklist goes deeper, and our guide to the user access review process handles question three properly.
And if the audit tells you the job has outgrown one person, that is not a failure on their part. Plenty of businesses keep their in-house person and add a provider behind them for the help desk, security and backups; we do exactly that as co-managed IT. The best IT people I know welcome that sort of backup. It is usually the ones with something to hide who don’t.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Yes, and in writing. A surprise audit tells you less, not more, and it sours the relationship for no good reason. Explain that you want to know what you would need if they were unavailable for a month. Any reasonable IT person will see the sense in that.
Once a year properly, with a quick check of the admin list and the last restore date every six months. Those two drift faster than anything else.
Yes, the same ten questions apply. Your agreement should also say that the documentation and passwords belong to you and are handed over if you leave. If it doesn’t, ask for that to be added before you renew.
Don’t fire anyone the same afternoon. First make sure you personally hold an admin login to email, the domain registrar and the backups, so nobody can lock you out. Then fix the worst items in order and decide about people once you can see clearly.
