10 Warning Signs Your Business IT Isn't Being Managed
No business decides to stop managing its IT. It drifts, one busy week at a time, until the systems are simply whatever they've grown into — something we see in Edinburgh and across the Lothians in firms that are otherwise running well. The useful question isn't whether you have a strategy, it's whether the day-to-day symptoms say your IT is managed or merely reacted to. Here are ten warning signs you can score your business against.
How to use this checklist
Give yourself a point for every sign that's true right now, not the one you mean to fix. This is a symptoms list rather than a maturity model: our companion piece on the signs a business has outgrown DIY IT covers when to change your support model, while this one is about what you can see in the office this week.
Signs in the day-to-day running
- 1. The same faults keep coming back. A printer that drops off the network monthly, a machine that needs a weekly reboot, a shared drive that vanishes. Recurrence usually means the cause was never found, only the symptom cleared. Managed IT is largely the discipline of asking why twice.
- 2. Staff wait on IT rather than working. If people routinely lose half an hour to a login, a slow laptop or a file they can't reach, that's payroll spent on waiting, and it never appears on an invoice, so it goes unmeasured.
- 3. Kit is running well past its useful life. Machines kept until they die tend to die at the worst moment, and a machine's final year is often the one that costs most in lost time. A planned replacement cycle beats a dramatic one — our guide on when to replace a PC covers the trade-offs.
Signs in what's written down
- 4. Nobody can show you a patch record. Not "we think updates are on" — an actual answer to which machines are current and which aren't. Unpatched software is one of the most ordinary ways a business gets compromised.
- 5. There's no documentation. If a stand-in couldn't find out how the network is laid out, what's licensed, where things are backed up or who the suppliers are, your IT knowledge lives in someone's head and travels with them.
- 6. One person holds all the passwords. Shared admin logins, credentials in a spreadsheet, or one member of staff who is the only route into critical systems. That's a security problem and a continuity one: holidays, illness and resignations all become incidents.
Signs in how you'd recover
- 7. Nobody has tested a restore. Backups that have never been restored are a belief, not a control. A backup strategy is proven only when you pull a real file back and open it.
- 8. Security incidents get brushed off. A phishing email someone clicked, a laptop left on a train, a login "that was probably nothing". With no process for reporting these, small events don't surface until they're big ones.
Signs in who has access to what
- 9. Shadow IT has taken root. Teams quietly using their own file-sharing accounts, personal devices or apps nobody approved. Staff do this because the official tools are in their way, so treat it as feedback rather than misbehaviour — but company data now sits somewhere you can't see or protect.
- 10. There's no offboarding process. When someone leaves, is there a checklist that disables their accounts, recovers the hardware and changes anything they had shared access to? Live accounts for people who left are among the easiest weaknesses to fix and the most commonly missed.
Scoring yourself honestly
Nought to two is normal, and worth tidying in a quiet week. Three to five means your IT runs on individual goodwill: it works because particular people remember things, which holds until one of them is away. Six or more and you're carrying real risk — not because anything has gone wrong, but because you'd have no way of knowing if it had.
What to do with a high score
Don't try to fix ten things at once. Take the two that would hurt most if they failed tomorrow — usually the untested restore and the single password holder — and close those first. Then write down what you have: devices, accounts, suppliers, licences. Almost every later improvement depends on that list. If a framework would help you prioritise, Cyber Essentials is a sensible thing to work towards, though it's worth taking proper advice on what certification would mean for your sector.
Talk it through with someone local
We're based in Wishaw and work with businesses across Edinburgh, Livingston and the Lothians. If your score came out higher than you'd like, we can help you work out what's worth doing first — as one-off business IT support or ongoing managed IT services, with a clear quote before any work.