The Pre-Weekend IT MOT: Twelve Free Checks for UK Small Businesses
Photo: office manager checklist laptop Friday afternoon small business UK, via weallwantsomeone.org
Friday afternoon is not usually peak productivity. The inbox is quiet, the kettle is busy, and half the office is already thinking about the weekend. It is also the best time to catch the basic IT risks that quietly pile up during the week. You do not need a consultant or a new licence to run this audit. You need an hour, a laptop and a bit of honesty.
Here are twelve free checks every UK small business can run before Monday. They will not make you bulletproof, but they will close the gaps that cause most of the messy incidents we see.
1. Do an MFA gap check
Log into your Microsoft 365 or Google Workspace admin centre and look at who is not using multi-factor authentication. In 2026 there is no good reason for a business account to rely on a password alone. Pay particular attention to shared mailboxes, finance accounts and anyone who handles payroll. If MFA is enabled but people are still using SMS, consider pushing them towards an authenticator app or passkey.
2. Roll call the admin accounts
List every account with global admin or equivalent rights. If the list is longer than the number of people who genuinely need it, trim it. Admin accounts should be separate from day-to-day email accounts, and they should have strong MFA. A compromised admin account is a very bad Friday.
3. Test a restore, not just a backup
Open your backup console and restore one file and one mailbox item to a test folder. Do not overwrite live data. Time how long it takes. If you cannot remember the last time a restore was tested, that is the check to do first. A backup you have never restored is a rumour.
4. Check patching on the obvious devices
Look at Windows Update or your device management tool. Are the office laptops and the server up to date? Check the devices that matter most: finance, HR and anyone with access to client data. You are not aiming for perfection; you are looking for machines that have been ignoring updates for weeks.
5. Review the phishing reporting habit
Ask two or three staff members how they would report a suspicious email. If the answer is “I’d forward it to Dave”, that is a single point of failure. Set up a simple reporting button or a dedicated mailbox, and remind people that reporting is always better than deleting and hoping.
6. Walk through the leaver process
Pick the last person who left the business. Were their accounts disabled on the day they left? Was their mailbox forwarded or backed up? Did they hand back devices? Did anyone check their OneDrive? If the answer to any of those is “not sure”, your offboarding process needs a written checklist.
7. Check DNS and domain renewals
Log into your domain registrar and check the renewal date for your primary domain. Then check the DNS records. Is the MX record pointing where it should? Is there an SPF record, and does it include the services you actually use? A lapsed domain or a broken DNS record can take email down for a whole weekend.
8. Confirm broadband failover
If your main broadband goes down, what happens? If the answer is “we tether a phone”, that is a workaround, not a plan. Check whether you have a second line, a 4G or 5G router, or at least a documented process for switching. Test it if you can. The Friday before a busy Monday is a good time to find out the dongle has no credit.
9. Look at your ICO basics
If you handle personal data, you should understand your obligations to the Information Commissioner’s Office. Check whether you need to pay the data protection fee, and make sure you know who would lead a breach response. You do not need a legal review to confirm that you have a named person and a basic procedure. If you do not, write one page before you leave.
10. Run a Cyber Essentials self-check
You do not need to certify this afternoon, but you can use the Cyber Essentials questions as a free health check. Are firewalls enabled? Is software patched? Are admin accounts controlled? Is malware protection in place? The scheme is designed for UK businesses, and the self-assessment questions are a useful way to spot the obvious.
11. Check device encryption and screen locks
Pick up a laptop and press the power button. Does it ask for a password or PIN? Is the disk encrypted with BitLocker or FileVault? If a device is lost on the train, encryption is the difference between an inconvenience and a data breach. Check the shared office machines too.
12. Audit forwarding rules and shared mailboxes
Go into the mail admin centre and look for automatic forwarding rules. Attackers love to set up a hidden forward to an external address. Check shared mailboxes for odd rules and confirm that leavers’ mailboxes are not still forwarding to personal accounts. This is a five-minute check that catches a surprising number of problems.
Before you switch off
Write down what you found. Not a formal report, just a list: three things to fix next week, one thing to ask your IT provider about, and one thing to tell the team on Monday morning. The point of a Friday audit is not to become an IT department. It is to catch the basics before they become a Monday morning fire.
If you get through all twelve and nothing is on fire, congratulations. You have earned your weekend.
