The Friend-of-a-Friend Fix Is Costing You More Than You Think

Every small business has a version of the someone's nephew story. Maybe he is genuinely good with computers. Maybe she set up the Wi-Fi three years ago and has been the unofficial IT department ever since. It starts as a favour, becomes a habit, and eventually turns into a single point of failure that nobody has written down.

That is not a criticism of the nephew. Most informal helpers are decent people doing their best with limited time, no budget and no formal remit. The problem is that a business cannot run on goodwill alone. When something goes wrong, goodwill does not answer the phone at 8am on a Monday, does not restore a backup it never tested, and does not explain to your insurer why the accounts server was running an operating system from 2015.

The invoice you never see

Cheap IT support is not really cheap. It just moves the cost somewhere less visible. The obvious saving is the monthly support fee you are not paying. The hidden costs show up later: staff sitting idle while a laptop misbehaves, sales enquiries going unanswered because email is down, quotes delayed because the shared drive has vanished, and the owner spending their evening Googling error codes instead of running the business.

Then there is the security bill. Unpatched machines, reused passwords, admin accounts used for everyday email, and backups that exist only in theory are exactly the conditions ransomware and account takeovers thrive on. For a UK small business, a serious incident is not just an IT problem. It can mean lost customer data, a breach notification headache under UK GDPR, awkward conversations with clients, and an insurance claim that depends on whether you can show you took reasonable steps.

The worst part is the uncertainty. With informal support, you often cannot answer basic questions: Where are the backups? When were they last tested? Who has admin access? Are updates actually being installed? If the answer is a shrug, you are not running IT support. You are running a hope-based system.

The warning signs worth taking seriously

Informal support has usually become a liability when the business depends on one person's mobile number and memory. You might recognise a few of these:

• Nobody can list the devices, software and online accounts the business relies on.
• Backups are described as 'probably running' rather than tested and documented.
• Updates are done manually, occasionally, or only after something breaks.
• Passwords are shared in WhatsApp, stored in a notebook, or known by whoever was around at the time.
• The person helping you has no agreed response time and no process for emergencies.
• Fixes are quick but temporary, and the same problem keeps coming back.
• Business accounts, domains or software licences are registered in someone's personal name or personal email address.

None of these are unusual in a young or very small company. They are still risks. A business can survive a messy setup for a while, but it cannot scale on one.

What accountable support actually looks like

Accountable IT support does not have to mean a huge contract or a call centre. It means someone has accepted responsibility for the basics and can prove it. At minimum, you want a named contact, a clear way to raise issues, agreed response expectations, and a written record of what is being looked after.

The practical foundations are not glamorous. They are an asset list, a patching routine, tested backups, multi-factor authentication, separate admin accounts, endpoint protection and a simple plan for what happens when a device is lost or a staff member leaves. You also want a regular review so you know what is working and what needs attention.

If your nephew has been holding things together, you do not need to sack him with a formal letter. Frame the change around growth and resilience. Ask him to help with a handover. Pay him for the time if that feels fair. The goal is to move from a favour to a documented arrangement where the business is protected even when one person is on holiday.

A sensible handover checklist

1. List every device, cloud account, domain, software licence and shared mailbox.
2. Find out where backups live, when they run, and when they were last restored successfully.
3. Turn on automatic updates and multi-factor authentication wherever possible.
4. Separate daily user accounts from admin accounts.
5. Change shared passwords and store them in a proper password manager.
6. Agree who owns each account, using business email addresses rather than personal ones.
7. Write down what happens in an emergency, including who to call and in what order.
8. Ask your insurer or broker whether they expect Cyber Essentials or any specific controls.

The bottom line

A tech-savvy relative can be a brilliant short-term fix. The trouble starts when a short-term fix becomes the whole strategy. Your business needs support that is documented, accountable and available when things go wrong. That is not about being ungrateful. It is about recognising that the most expensive IT support is the kind you cannot rely on when it matters.

Core IT's advice for UK small businesses is simple: keep the goodwill, lose the guesswork. Get the basics written down, tested and owned by someone who is answerable for them.