What an IT health check should tell a managing partner

Most IT audits end the same way. A long PDF arrives, full of findings ranked by a scanning tool. Nobody owns it. Six months later it is still sitting in someone’s inbox.

The problem isn’t the audit. It’s who the audit was written for. A technical report answers technical questions. A managing partner needs different answers: where do we actually stand, what could hurt us, what do we fix first, and what will it cost.

A good IT health check answers those questions. Here is what it should tell you, and how to tell a useful one from an expensive document.

Why most IT audits don’t help the person paying for them

Automated tools are good at finding things. They are poor at judging which things matter to your firm. A missing patch on a reception PC and an old provider who still has admin access to your email both show up as “findings”. Only one of them could end up in front of your insurer.

That judgement is the whole job. Without it, you get a list. With it, you get a decision.

The six questions a health check should answer

1. Who actually controls your systems?

This is the question most firms can’t answer, and it matters most. Who holds the admin accounts for Microsoft 365? Whose name is the domain registered in? Who can change your DNS? Does a former employee or a previous IT provider still have access?

Control is ownership. If you can’t say who holds the keys, you don’t fully own your IT. Someone else does, and they may not be around when you need them. We’ve written about this in What happens to your firm’s IT when a key person leaves.

2. Could you recover from a bad day?

Not “do you have backups”, but could you get your email and files back after a ransomware attack, an accidental deletion or a compromised account, and how long would it take?

Many firms assume Microsoft 365 backs everything up. It doesn’t, in the way most people mean. Microsoft keeps the service running and holds deleted items for a limited period. Restoring a whole mailbox, or a client folder from three months ago, is a different matter. A health check should say whether you have a real backup, whether a restore has ever been tested, and what you would lose.

3. Is Microsoft 365 set up securely, or just switched on?

Most firms pay for security features they never turn on. Business Premium includes device management, conditional access and advanced threat protection. Plenty of tenants still run with the defaults.

The check should cover the basics a partner can follow. Is multi-factor authentication enforced for everyone, including admin accounts? Are sign-ins from unexpected places blocked or challenged? Is your Microsoft Secure Score, Microsoft’s own measure of how many of its recommended security actions you’ve taken, moving up or standing still?

4. Are your laptops managed, patched and encrypted?

A lost laptop is an inconvenience if it’s encrypted and managed. If it isn’t, it’s a data breach. The check should confirm that every device is known, that updates are actually being applied rather than just scheduled, and that disks are encrypted.

5. Who would know if something went wrong?

Attacks rarely announce themselves. A mailbox rule quietly forwarding email to an outside address can sit unnoticed for weeks. The check should tell you whether anyone is watching for that kind of activity, including at night and at weekends, or whether you would find out when a client calls.

6. What would a client questionnaire or a cyber insurer find?

Clients and insurers increasingly ask the same questions a health check asks. The difference is that they ask when something is at stake: a new instruction, a renewal, a claim. We’ve covered this in What a client security questionnaire actually reveals about your firm. A good health check lets you answer those questions honestly before someone else asks them.

What good output looks like

You should be able to read the summary in ten minutes and know what to do next. In practice that means:

• Plain English. Every finding explained in terms of what it means for the firm, not just what the setting is called.
• Ranked by business risk. The few things that could cause real harm come first. Housekeeping comes last.
• Owned and costed. Each item says who should fix it, roughly how much effort it takes and what it’s likely to cost.
• Short. A one-page summary for the partners, with the detail behind it for whoever does the work.
• Honest about what’s fine. A check that finds nothing right is as unreliable as one that finds nothing wrong.

What it shouldn’t be

A health check shouldn’t be a pitch to replace everything. Most firms need a handful of targeted fixes, not a new platform.

It shouldn’t be a tool report with a logo on it. If no one has applied judgement to the findings, you’ve bought a scan.

And it shouldn’t be about blame. Most gaps exist because nobody was ever asked to own them, not because someone failed.

How we run it

Our version is the IT Risk and Ownership Review. It costs £295 + VAT for professional firms of up to 25 users; larger firms are quoted to size.

We use temporary read-only access to your Microsoft 365 tenant, a set of standard scripts and a short questionnaire. Nothing is changed during the review. You get the six questions above answered for your firm, with the fixes ranked.

If you then move to managed or co-managed IT with us, the Review fee is credited against your first month if you go ahead within 30 days of the findings meeting. If you don’t, you keep the findings and can act on them with whoever you choose.

Related: IT leadership for professional firms