The risk is what nobody owns
In businesses without an IT function, IT tasks belong to whoever is most technical, alongside their actual job. The result is not incompetence — it is that everything gets done eventually and nothing gets done consistently.
Automation matters here more than in larger organisations, because it substitutes for a discipline nobody has time to maintain.
1. Joiners and leavers
Account creation across your systems when someone joins, and removal when they leave. The leaver half is the one with real risk and the one most often neglected.
Run this check today: list everyone who left in the last year and confirm every account is closed. In most businesses without automated offboarding, something is still open.
2. Backups you have restored
An untested backup is a hope. Automate the backup, then automate a periodic test restore, then alert if either fails.
- Everything critical covered, including cloud services people assume are backed up
- A restore actually performed at least annually
- Retention long enough to survive a problem discovered late
- At least one copy somewhere separate from the primary system
3. Updates on a schedule
Operating systems, browsers, servers and dependencies. Automate what can be automated safely and schedule the rest, because unpatched software is the most common route into a small business.
Where automatic updates carry risk to a critical system, schedule a monthly window instead — the point is that it happens on a date rather than when someone remembers.
4. Monitoring that reaches a person
Uptime for anything customer-facing, disk space, certificate expiry, backup success, and failed logins. Alerts should reach a human who will act, not a shared mailbox.
Certificate expiry deserves a specific mention: it is entirely predictable, entirely preventable, and still takes sites down regularly.