Bring the business picture. Leave the passwords out.

01 / In practice

You do not need to audit everything yourself.

The purpose of an initial review is to replace assumptions with a useful picture of the business. You can help by describing what people do, which systems they depend on and what keeps causing difficulty.

A rough inventory is useful; perfection is not required. If something is unknown, say so. Discovering that nobody knows who owns a domain or how a backup works is itself a useful finding.

02 / In practice

Prepare a short, non-sensitive outline.

Start with information you can reasonably share before any technical access has been agreed.

• What the business does and how many people need IT.
• Approximate devices, mailboxes and working locations.
• Important applications, shared information and suppliers.
• Existing support arrangements and relevant renewal dates.
• Recurring problems, planned changes and business priorities.

03 / In practice

Describe impact rather than only symptoms.

“The computer is slow” is a starting point. It becomes more useful when you explain which task is affected, when the problem occurs and what happens to the business as a result. A delayed invoice and an interrupted customer appointment may need different priorities.

Likewise, identify the information you could not easily recreate and the systems you would need first after a disruption. That helps shape security and recovery discussions around the actual working day.

04 / In practice

Keep access controlled.

Do not send passwords, recovery codes, customer databases or full configuration exports with an initial enquiry. If technical discovery is needed, the access, authorisation and method of sharing evidence should be agreed first.

You may need cooperation from an existing provider or software supplier. Establish who can authorise that contact and what contractual boundaries apply. There is no need to cancel existing services before understanding their role.

05 / In practice

Expect a prioritised result.

A useful review should distinguish immediate concerns, planned improvements and matters that need more investigation. Recommendations should explain why they matter and what decision is needed. Not every finding requires replacement equipment or a new subscription.

Agree the review’s scope, cost and expected findings before it begins. Those findings can then support a project, ongoing care or a decision to keep an arrangement that already works well. A useful result explains the priority and reason for each recommendation.