Many London SMEs review their IT only when something fails. A missed backup, a lost mailbox or an unexpected licence renewal can absorb days of management time and create costs that a planned review would have identified. An IT health check for a London SME is a structured assessment of systems, security, costs and service performance, carried out at regular intervals. A quarterly technology review applies that discipline on a fixed cycle, so that decisions about IT rest on current evidence rather than on the most recent incident. This article sets out what that review should cover and how to act on its findings.
Table of Contents
- Quick Takeaways
- Why Quarterly Reviews Matter for London SMEs
- Systems Inventory and Licensing
- Security, Access and Backups
- Spend, Contracts and Service Levels
- Comparing Review Approaches
- Agreeing the Quarterly Agenda
- Turning Findings into Action
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Scope the review to every system in use | Include email, cloud file storage, line-of-business applications, devices and network equipment, not only servers. |
| Reconcile licences against active users each quarter | Unassigned licences and former staff accounts add cost every month, and the check takes little time once scheduled. |
| Test restores, not only backup jobs | A backup reporting success has not been proven recoverable until data has been restored from it. |
| Review administrator accounts and multi-factor authentication | Privileged accounts carry the widest access if compromised, so they should be reviewed first. |
| Compare resolution times with agreed service levels | Response and resolution data show whether the support arrangement delivers the outcomes the business pays for. |
| Assign an owner and a due date to every finding | A list of findings without ownership rarely changes the position by the following quarter. |
Why Quarterly Reviews Matter for London SMEs
A quarterly technology review is a scheduled meeting between business leaders and those responsible for IT, supported by a written assessment of the environment. Its purpose is to confirm that technology still supports current priorities, that risks are known and that spending remains justified. Octet’s business health check guidance lists technology among the core areas to review alongside finances, operations and people, which reflects how closely IT now sits within daily trading. Quarterly business reviews are also widely used to measure performance against agreed metrics, as NetSuite’s overview of business reviews explains.
For a small firm without a full-time IT manager, the review provides the oversight that an internal role would otherwise supply. At iTO.London, the quarterly review forms part of the outsourced IT department service, so findings feed directly into the monitoring and support already in place.
Systems Inventory and Licensing
Building an accurate asset register
The review begins with a current record of devices, users, applications and cloud services. Many SMEs cannot confirm which laptops remain in use, which former staff still hold access, or which subscriptions are paid without an active owner. A register maintained as a standing document turns these questions into a routine check.
Microsoft 365 and cloud licence reconciliation
Microsoft 365 and other cloud platforms are typically billed per user or per capacity, so unassigned licences add cost every month. The reconciliation compares licences purchased with licences assigned and confirms that each active account belongs to a current employee. Consumption charges, such as storage or compute, should be reviewed for the same period because they often change without a visible decision.
Pro tip: Reconcile licences in the same week each quarter and record the result in the review pack. A repeated process makes leavers and unused seats visible before renewal dates rather than after.
Security, Access and Backups
Privileged accounts and multi-factor authentication
The review should confirm which accounts hold administrative rights, whether each is still required, and whether multi-factor authentication applies to all users, with stronger controls for administrators. Shared logins and accounts belonging to former staff are common findings and are straightforward to remove once identified. The National Cyber Security Centre publishes practical guidance on these controls for organisations of every size.
Restore testing and recovery time
A backup job reporting success confirms only that data was copied. The review should include a sample restore of a file, a mailbox and, where relevant, a line-of-business system, with the time taken recorded. Recovery time is the figure leadership needs most, and it is rarely measured before an incident occurs.
A backup that has never been restored is an assumption, not a control.
Spend, Contracts and Service Levels
Comparing spend with the previous quarter
Octet’s guidance asks whether cost structures should be re-evaluated as part of a financial review, and the same question applies to IT. Compare recurring costs by category with the previous quarter and record an explanation for each variance. Unexplained increases in subscriptions often point to overlapping tools that staff have adopted independently.
Service level performance
Where a managed service has agreed response and resolution targets, the review should report performance against them. This includes the number of tickets, the proportion resolved within target and the recurring issues behind them. Repeat faults indicate a root cause to fix rather than a user to retrain.
Comparing Review Approaches
SMEs typically rely on one of three approaches to IT oversight. Each serves a different purpose, and the differences affect how quickly problems are found and how well spending decisions are supported.
| Approach | Typical Focus | Best Suited To |
|---|---|---|
| Reactive review after incidents | Restoring service and explaining the cause of an outage | Organisations accepting the cost of waiting for a fault before acting |
| Annual external audit | Formal assessment of controls at a single point in time | Organisations preparing for certification or formal due diligence |
| Quarterly technology review | Trends across licences, security, spend and service levels | SMEs that need ongoing decisions and a standing record of IT changes |
The quarterly approach does not replace incident management. It reduces the number of incidents that reach the agenda and creates a continuous record that a single annual audit cannot provide.
Agreeing the Quarterly Agenda
In practice, a focused session of 60 to 90 minutes is sufficient for most SMEs when the written pack is circulated beforehand. The agenda should follow a fixed order: security exceptions, licences and spend, service performance, planned changes and business changes. Keeping the order constant allows leaders to compare one quarter with the next.
Planned changes include software approaching end of support and hardware due for replacement. Business changes include hiring plans, new premises and new client requirements. Both affect the technology roadmap and should be raised before the meeting, not during a project.
Pro tip: Ask for planned business changes at least two weeks before the review. Early notice allows technology decisions to be scheduled rather than made under pressure.
Turning Findings into Action
Each finding should have an owner, a due date and a status. The Mitti business health check template describes tracking corrective actions and monitoring progress over time, and scheduling recurring evaluations to support ongoing compliance. The same principle applies to a technology review. Outstanding actions should open the next session so that progress remains visible.
A one-page summary for the leadership team, with a detailed appendix for technical staff, keeps the review useful to both audiences. Leadership reads the decisions required, while the appendix records the evidence behind them.
Frequently Asked Questions
How long should a quarterly technology review take for a small business?
A focused session of 60 to 90 minutes is usually enough when the review pack, including the asset register, licence reconciliation and service report, is circulated in advance. Preparation generally takes longer than the meeting itself, so the data collection should be scheduled before the session.
Who should attend the review?
The business owner or a director should attend, together with the person responsible for IT or the managed service provider’s account lead. Finance representation adds value when spend and contracts are on the agenda.
How does a quarterly review differ from day-to-day IT support?
Day-to-day support resolves individual faults as they arise. The quarterly review examines patterns across the period, decides on investment and changes, and checks whether the support arrangement is meeting its agreed targets.
Is a quarterly review necessary if the business has no in-house IT team?
It becomes more important in that case, because no internal function is maintaining the asset register, tracking licences or reporting on risk. An outsourced IT department can provide that function under a defined agenda and a consistent reporting format.
What should a business do first if it has never run an IT health check?
Start with an inventory of systems, users and licences, then test a restore and review administrator accounts. These three steps identify the most urgent gaps and establish a baseline against which later reviews can be measured.
We welcome your feedback on how your organisation currently reviews its technology, and we would be glad to hear which parts of this checklist have proved most useful in practice.
We would love your feedback and any insights you would share with others. What perspective would you add?