Know who owns your IT, where the risks are and what to fix first

The IT Risk and Ownership Review is a fixed-price IT health check for professional services firms: £295 + VAT for up to 25 users, and quoted to size above that. Within 10 working days you get the evidence, your top risks and a 90-day plan.

Who it is for

For partners who are uneasy about IT but cannot say what is wrong

Many firms do not have obviously bad IT. They have IT that nobody can vouch for. The provider says everything is fine, the insurer’s questionnaire asks questions nobody can answer with confidence, and no one in the firm owns the decisions.

The Review is for partners and directors of professional services firms on Microsoft 365, usually with up to 25 users. Larger firms get a Review quoted to their size. Firms usually ask for it when:

an insurer questionnaire, audit or Cyber Essentials deadline is coming
a phishing email got through, or nearly did
the provider or the in-house IT person is leaving
a merger or a new partner is asking questions about IT

It is not a sales pitch. You get the evidence and one recommendation, and that may be to leave things as they are.

What we check

Seven areas, scored against evidence

Every Review checks the same seven areas. Each is scored red, amber or green against evidence from your Microsoft 365 or your documents, not opinion. Where we cannot verify a control, we mark it unverified, not green, and tell you what evidence would close the gap.

IT ownership and accountability

Who makes IT decisions, what your provider is contracted to do, and whether your firm owns its own admin accounts.

Security posture

Multi-factor sign-in for every user, old sign-in methods blocked, protection on every device and email filtering.

Accounts and documentation

Admin accounts, leavers’ accounts, shared logins, password management and whether your systems are written down.

Microsoft 365 configuration

Email forwarding, file sharing links, audit logging, and the features you pay for but do not use.

Devices

Supported operating systems, encryption, central management and patching on every laptop.

Backup and recovery

Whether your Microsoft 365 data is backed up, and when anyone last proved a restore works.

Compliance readiness

Cyber Essentials controls, your insurer questionnaire answers against reality, and what your regulator expects.

What the Review does not cover

It changes nothing in your systems and includes no penetration testing or on-site network survey. Your report states these limits plainly.

What you get

A decision, not just a report

Within 10 working days of payment and access, you know who owns your IT, where the real risks sit and what to do first.

A plain answer

Is your current IT arrangement managing risk? Yes or no, with the evidence.

Your top risks, ranked

Ranked by business impact and written in business language, not jargon.

A 90-day plan

What to fix first and what can safely wait. Act on it with us, your current provider or anyone else.

A call on every risk

Fix, defer, monitor or leave unchanged, so nothing is left as a vague concern.

A one-page partner summary

The verdict, a red, amber or green rating for all seven areas with any evidence gaps marked, and the top three risks.

A findings meeting

Sixty minutes with the decision-maker: the evidence, the risks, the plan and one recommendation.

How it works

From call to decision in 10 working days

The same steps every time, so you know what happens and when.

1. Apply and book

Pick a time for your kick-off below, answer a few questions about your firm and pay £295 + VAT securely online.

2. Read-only access

Your admin invites us as a guest with the Global Reader role. It takes a few minutes, and we cannot change anything.

3. The Review

We collect the evidence, score the seven areas and write your report.

4. The findings meeting

Sixty minutes with the decision-maker: what we found, what it means and what to do first.

5. Access removed

At the findings meeting, your admin removes our guest access while we are on the call. We confirm it in writing the same day.

6. Your decision

Act on the plan with us, your current provider or anyone else. If you choose managed or co-managed IT within 30 days of the findings meeting, the Review fee comes off your first month.

Who carries out the Review

Alan does every Review himself

Alan McBurney founded INNOSEC after more than 25 years designing and securing IT for large organisations.

He collects the evidence, scores the seven areas, writes your report and runs your findings meeting. You deal with one person from kick-off to the final decision.

Apply for the Review

£295 + VAT (£354 in total) for firms of up to 25 users, paid when you book. Credited in full against your first month of managed or co-managed IT if you go ahead within 30 days of the findings meeting. Firms with more than 25 users get a Review quoted to their size: book a free 15-minute call first.

Pick a time for your kick-off below, answer a few short questions about your firm and pay securely online.

Not sure yet? Book a free 15-minute call first.

Questions about the Review

Straight answers

Why charge for it?

A paid Review is taken seriously by both sides. The Review fee comes off your first month if you move to managed or co-managed IT within 30 days of the findings meeting.

How long does it take?

You get your findings within 10 working days of payment and access.

What access do you need?

Guest access with the Global Reader role in Microsoft 365. Your admin sets it up in a few minutes. We can see your settings but cannot change anything, and your admin removes the access at the findings meeting.

Will you change anything?

No. The Review only looks and reports.

Is it a sales pitch?

No. You get the evidence and one recommendation, and that may be to leave things as they are.

Who owns the report?

You do. Act on it with us, your current provider or anyone else.

What if we have more than 25 users?

Book a free 15-minute call and we will quote a Review scoped to your size. The fee is credited in the same way if you go ahead with managed or co-managed IT.

Is it right for every firm?

It suits firms on Microsoft 365. Up to 25 users it is £295 + VAT; above that we quote to your size. If you are dealing with an active incident, call us now instead: that needs a response, not a Review.

Next step

Apply for the Review.

Book your kick-off and pay online. You get your findings within 10 working days.

Not sure yet? Book a free 15-minute call or take the 3-minute self-assessment.