Summary: Most IT problems don’t appear out of nowhere. Backups quietly stop running, updates sit unfinished for weeks, and old staff accounts stay switched on for months. A short check once a month catches these while they’re still cheap to fix. This post covers the six things to look at.
Most owners only look at their IT when something’s already gone wrong. A file won’t open, a laptop won’t start, or an invoice gets paid into a scammer’s account. Fixing it at that point always costs more than preventing it would have.
Here’s the thing — almost none of it happens without warning. The backup that fails when you finally need it had been failing quietly for weeks. The account a scammer used belonged to someone who left last year. Thirty minutes a month is usually enough to catch that kind of thing before it becomes a story you tell with a wince.
Why a Monthly Look Is Worth the Time
Verizon’s 2026 Data Breach Investigations Report found that 31% of breaches started with attackers exploiting software that hadn’t been patched. That makes unpatched software the most common way in — ahead of stolen passwords, ahead of phishing, ahead of everything. The same report found the median time to fully fix a known problem has risen to 43 days.
Most attacks use a problem that was already known, with a fix already available. Nobody had installed it yet. That’s the whole story, really.
The Check
1. Updates
Check whether Windows updates are installing on your computers, or sitting at “restart required” week after week. Do the same for phones and for the software you use most, like your browser and your accounting app. If people keep clicking “remind me later,” that’s something to fix.
2. Backups
Open your backup tool and look at the last few runs. You want recent successful backups, not a list of errors. Then check when anyone last restored a file from it. If it’s never been tested, you don’t actually know whether it works — you’re just hoping.
3. Who Has Access
Pull up the list of user accounts in Microsoft 365 or Google Workspace and read through it. Every name should be someone who still works for you. Look for people who left, contractors who finished months ago, and shared logins like “office” or “admin” that several people use. Switch off anything you don’t need.
4. Multi-Factor Authentication
Check that MFA is switched on, and that it’s on for everyone, not just the people who set it up first. Pay closest attention to admin accounts and anyone who handles money. Microsoft’s research shows MFA blocks more than 99.2% of account compromise attacks — which is a fairly compelling reason to double-check this one.
5. Devices
Look at what’s connected to your systems. If there’s a laptop or phone you don’t recognise, find out whose it is. While you’re there, check that laptops are encrypted and that any phone with company email on it has a passcode or fingerprint lock.
6. Subscriptions and Licences
Open your billing page and read what you’re actually paying for. Businesses regularly pay for licences belonging to people who left, or for two tools that do the same job. It’s also how you find software somebody signed up for without telling anyone.
Make It a Routine
Put it in the calendar on a fixed day, like the first Monday of the month, and give it to the same person each time. That’s you or whoever handles the admin side.
Keep a running note of what you checked and what you found. After a few months you’ll see whether the same problem keeps coming back. If it does, it needs fixing properly instead of clearing it each time and moving on.
Thirty minutes only works if you don’t stop to fix things along the way. Write down what you find and deal with it afterward.
Who Fixes What
Most of it is small — a laptop that needs restarting, a licence to cancel, an account to switch off. Handle those yourself.
Send the rest to your IT Support provider: backups that keep failing, MFA that won’t turn on for someone, a device nobody recognises, or updates that fail on the same machine every month. Those usually mean there’s a bigger problem sitting behind them.
What This Check Doesn’t Do
It isn’t monitoring. A good Managed IT provider has tools watching your systems all day and flagging things you’d never spot from a monthly glance.
The check covers what those tools can’t know. You know who left, which subscriptions you approved, and whose laptop is whose. That’s information no monitoring tool has, and it’s exactly the gap this thirty-minute habit closes.
Frequently Asked Questions
How Often Should a Small Business Check Its IT?
Once a month is enough for this list. Backups are worth a quick look more often if losing a day’s work would seriously hurt, since that’s the item most likely to fail quietly.
Who Should Do It?
You or whoever runs the admin side of the business. Most of the list needs no technical skill, just someone who knows who works there and what the business pays for.
What if I Don’t Know Where to Find Any of This?
Ask your IT provider to walk you through it once and write down where each thing lives. Many will also send you a monthly summary covering most of it.
Isn’t This My IT Provider’s Job?
They handle the monitoring, the patching, and the fixing. The check is the part that depends on knowing your business — like who left last month or which subscription nobody approved.
If I Only Have Ten Minutes, What Matters Most?
Backups and updates. Without working backups you can lose everything you’ve stored, and unpatched software is now the most common way attackers get in.
Does This Apply if Everything We Use Is in the Cloud?
Yes. Cloud tools still need updated devices, working backups, MFA switched on, and access lists that match who actually works for you.
Sources and Further Reading
Verizon 2026 Data Breach Investigations Report — the finding that 31% of breaches start with exploitation of unpatched software, and that the median time to fully fix a known problem is 43 days.
Microsoft: Plan for mandatory Microsoft Entra multifactor authentication — Microsoft’s research that MFA blocks more than 99.2% of account compromise attacks.
Whether you’re running a small team in Mackay or a growing operation across Brisbane, thirty minutes a month is a genuinely small price for catching the kind of problem that otherwise turns into a very expensive afternoon.
If you’d like a hand setting this up, or a proper look at where your gaps might be, check out our cybersecurity services, or get in touch with us and we’ll help you sort it out.
—
