Most small businesses in London do not suffer a single dramatic IT failure. They accumulate small, avoidable gaps that surface at the worst possible moment, such as a ransomware notice on a Monday morning or a former employee who still holds access to client records. This article sets out the IT mistakes SME London owners most often underestimate. Each illustrative scenario is drawn from patterns common in small business support, and each is followed by the control that prevents it.
Table of Contents
- Quick Takeaways
- Backups That Were Never Tested
- Shared Logins and Missing Multi-Factor Authentication
- Verbal Agreements and Unclear Supplier Contracts
- Former Staff Accounts Left Active
- Growth Without an IT Plan or Budget
- Comparing Ways to Cover IT Support
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Test backups by restoring files | A backup that has never been restored is an assumption, not a recovery plan. Schedule a restore test each quarter. |
| Enforce multi-factor authentication on email and admin accounts | Shared logins remove accountability and make a compromised account difficult to trace. |
| Put every supplier and contractor agreement in writing | Verbal terms create disputes over scope, response times and ownership of data. |
| Run a leaver checklist for every departure | Accounts left active after a member of staff leaves are a common route into business systems. |
| Keep a written IT budget and asset register | Unplanned purchases and unknown devices make growth more expensive and less secure. |
| Review IT arrangements every quarter | A structured review identifies configuration drift and ageing equipment before they cause an outage. |
Backups That Were Never Tested
Consider an illustrative case of a three-person accountancy practice in London that believed its files were backed up every night. When a staff laptop was infected with ransomware, the team discovered that the backup job had been failing without any alert for several months. The practice had monitored the presence of backup files but had never checked whether those files could be restored.
Why a successful backup log is not enough
A backup log records that a job ran. It does not confirm that the data is complete, readable or recoverable within an acceptable time. A tested restore is the only reliable evidence that recovery will work when it is needed.
In practice, a restore test should select a sample of files from a shared drive, a mailbox and a line-of-business application, then time how long recovery takes. The results should be recorded and compared with the business’s tolerance for downtime.
Pro tip: Record the date, the files restored and the time taken for each test. This record becomes the evidence you need when a client, insurer or auditor asks how recovery is assured.
Shared Logins and Missing Multi-Factor Authentication
Shared accounts are common in small offices. A single login may be used for a booking system, a supplier portal or a general shared mailbox, with the password written on a whiteboard or passed between staff. This arrangement works until an account is compromised, at which point no one can establish who accessed what, or when.
Shared accounts remove accountability
Each person who accesses a system should have a named account with permissions suited to their role. Named accounts allow administrators to review activity, revoke access precisely and meet the record-keeping expectations of clients and regulators. Shared credentials make all three tasks considerably harder.
Multi-factor authentication as a baseline control
Multi-factor authentication requires a second form of verification, such as an app approval or a one-time code, in addition to a password. For email, file storage and administrative consoles, it should be treated as a baseline rather than an optional extra. Where a service cannot support it, the business should document the risk and review whether that service remains appropriate.
Verbal Agreements and Unclear Supplier Contracts
Many London SMEs buy IT services on the strength of a conversation. A supplier agrees to “look after” the network, a contractor is asked to “set up” a new office, and the terms are never recorded. When a dispute arises, each party tends to recall the agreement differently.
The Hartford’s guidance on small business mistakes identifies reliance on verbal or handshake agreements as a predictable source of legal problems. Its advice is to put arrangements with employers, vendors and investors into clear, professionally written contracts. The same principle applies directly to IT.
What a written IT agreement should cover
A proportionate IT agreement should set out the services provided, the response times for urgent and routine issues, the hours of cover, the process for escalation and the ownership of data and credentials. It should also state how the arrangement can be ended and how records would be returned. Ownership of administrator credentials is frequently overlooked and can leave a business unable to change its own systems.
A verbal IT arrangement is only as reliable as the recollection of the people who agreed it, and recollections tend to diverge at the point when the business needs support most.
Former Staff Accounts Left Active
Access control is often reviewed when someone joins a business but rarely when they leave. Accounts for former employees, contractors and interns can remain active for months, with access to email, cloud storage and finance tools. Such accounts are a frequent route into business systems because nobody is monitoring them.
A leaver checklist that covers more than email
A departure checklist should list every system the individual used, including cloud applications, shared mailboxes, accounting software, door access and company phones. The checklist should be completed on the last working day, and the person responsible should confirm each step in writing. Mail forwarding and data transfer should be handled before the account is disabled, not after.
Growth Without an IT Plan or Budget
A business that doubles its headcount within a year often adds laptops, licences and software without a plan for how they will be managed. The result is a mixed estate of devices, unknown software subscriptions and accounts with inconsistent security settings. The cost is rarely visible until a renewal invoice arrives or an incident occurs.
Building an asset register
An asset register records each device, licence and cloud subscription, along with its owner, renewal date and support status. Without this record, a business cannot answer basic questions about what needs patching, what is out of warranty or what it is paying for. Maintaining the register is a modest task that prevents considerable confusion during a crisis.
Budgeting for IT as a planned line
The Hartford’s guidance notes that operating without a budget often leads to overspending and wasted time. For IT, a planned annual budget should include support, licensing, hardware replacement and security services. Treating these costs as a predictable line allows owners to compare them with the cost of an unplanned outage.
Comparing Ways to Cover IT Support
Owners generally choose between three arrangements for IT support. Each can work, but each carries different risks around response time, accountability and consistency. The table below summarises the trade-offs for a typical London SME with between 10 and 100 staff.
| Approach | Strengths | Risks |
|---|---|---|
| Ad hoc, break-fix support | Low fixed cost and no contract to manage | No proactive monitoring, unclear response times and no one accountable for the overall estate |
| Full-time in-house IT hire | Dedicated knowledge of the business and direct access | Single point of failure during leave or illness, and limited coverage of specialist areas such as cloud security |
| Outsourced managed IT department | Defined service levels, monitoring, quarterly reviews and access to a wider team | Requires clear scoping and a written agreement to deliver its value |
A managed IT provider such as iTO.London operates as an outsourced IT department, which allows an SME to receive structured support without recruiting a full team. The critical factor is not the model alone but whether the agreement defines responsibilities in writing.
Pro tip: Ask any prospective provider to show the service levels, escalation path and reporting pack before signing. Vague answers at this stage usually predict vague support later.
Frequently Asked Questions
What are the most common IT mistakes made by small businesses in London?
The most common mistakes include untested backups, shared logins without multi-factor authentication, verbal supplier agreements, active accounts for former staff and IT spending without a written plan or budget. Each is inexpensive to prevent and costly to resolve.
How often should a business test its backups?
A restore test should be carried out at least quarterly, with a sample of files and one critical application included. The results should be recorded, and any failures should be investigated before the next scheduled test.
Is multi-factor authentication necessary for a small team?
Yes. Email and administrative accounts are the most frequent targets of unauthorised access, and a small team has no less exposure than a large one. Enabling multi-factor authentication is a low-cost control with a high return.
Does a small business need a written contract with its IT supplier?
A written agreement is advisable for any ongoing IT service. It should define services, response times, data ownership, administrator credentials and how the arrangement can be ended.
When does outsourcing IT support make sense for an SME?
Outsourcing is usually suitable when a business needs consistent cover, proactive monitoring and defined service levels but does not require a full-time internal team. It is most effective when responsibilities are documented and reviewed regularly.
Which of these mistakes have you encountered in your own organisation, and how did you resolve them? We welcome your experience and feedback.