You can get a useful read on the health of your business technology in an afternoon, without being technical, by asking 12 questions and being honest about the answers. It will not replace a proper review, and it will tell you whether you need one. Score each question yes, partly or no. More than four no answers and something is costing you money or carrying risk you cannot see.
Below each question is why it matters and what a bad answer usually means, so you can act on the result rather than just record it.
Before you start
Do this with two or three people, not alone. The founder, whoever runs operations, and whoever is closest to the technology day to day. Founders score themselves generously on the questions that matter most. The operations lead usually knows where the bodies are buried. The combination gives you an honest picture.
Set aside two hours. Write the answers down, with the date. You will want to compare in six months.
The 12 questions
1. Could the business keep trading if the main system went down for a day?
If the answer involves someone’s laptop and a lot of hope, that is a no. What it means. You have no continuity plan, and the first real outage will be the day you discover how dependent you are. The fix is usually a written plan, a tested fallback, and a conversation with the supplier about their recovery commitments.
2. When did you last restore from a backup, not just take one?
A backup nobody has restored is a theory. What it means. You may have no backup at all, or one that cannot be used. The fix takes an afternoon and is the single most valuable thing on this list. Restore something. Time it. Write down what happened.
3. Does anyone outside the technical team know how the technology actually fits together?
If one person holds it all in their head, you have a key-person risk, not a system. What it means. When that person is ill, on holiday or hands in their notice, the business is exposed. The fix is a one-page diagram and a walkthrough with a second person, repeated when things change.
4. Do your main systems share data, or do people re-key it?
Re-keying is a symptom. It means the systems were bought separately and never joined up, and it is where errors and hours go. What it means. You are paying people to be a slow, error-prone integration. Count the hours a week. It is usually more than anyone expects, and connecting the two worst offenders is often cheap.
5. Can you say what you spend on technology each month, by supplier, and why?
If licences, cloud and agencies are a single line nobody reads, there is money leaking. What it means. Somewhere between 10 and 20% of the spend is for things nobody uses, in most businesses I have looked at. The fix is one afternoon with the invoices and a cancellation list.
6. Has a release or change broken something customers noticed in the last three months?
Once is bad luck. Twice is a process problem. What it means. There is no test step, no review, or no way to roll back. Customers are finding your bugs. The fix is a release process, and it is less work than the firefighting it replaces.
7. Who can access what, and when did you last remove a leaver’s access?
Old accounts are the most common way in for an attacker. What it means. If the answer is ‘I think IT does that’, nobody does. The fix is a leavers’ checklist and a quarterly access review, half a day each.
8. Could you answer a customer’s security questionnaire today without panicking?
This is the question that stalls deals. What it means. If you have never been asked, you will be. If you have been asked and struggled, you know. The fix is Cyber Essentials and a one-page security summary you can send without thinking.
9. Is the technology roadmap written down, and does it match what the business is trying to do this year?
Technology that is busy but pointed at the wrong thing is the expensive kind. What it means. The team is choosing its own priorities, or taking them from whoever shouts loudest. The fix is a page, agreed by the leadership team, with owners and reasons.
10. Does anyone senior own technology decisions, or do they default to the loudest supplier?
Decisions by default are decisions nonetheless. What it means. Your agency, your IT provider or your most confident developer is setting your technology strategy, and they all have an interest. The fix is a named owner with the standing to say no.
11. Do you know which of your suppliers you could not easily leave?
Lock-in is fine if you chose it. It is a problem if you discovered it. What it means. One of your suppliers has more power over your business than you have over them. The fix is knowing which, what it would cost to move, and whether the contract gives you any protection.
12. Is the technology holding growth back?
If sales or operations have stopped asking for things because they know the answer is no, it already is. What it means. The business has quietly started working around its own systems, and growth is being capped by a constraint nobody has named. Our piece on the signs technology is capping growth goes into the detail.
How to read your score
Mostly yes. Things are in decent shape. Keep an eye on the partlys and re-run this in six months.
A handful of no answers, especially on backups, access or cost. Fix those now. They are cheap to resolve and expensive to be caught by, and none of them needs outside help.
More than four no answers, or any no on questions 1, 2 or 7. You have reached the point where an independent look is worth the money. The problems compound and the people inside the business usually cannot see them, because they have been living with them.
What a proper review adds
This check tells you something is wrong. A review tells you what, how bad, what it costs to fix, and in what order. It reads the code, tests the claims and gives you a plan you can hold people to. It also answers the questions this check cannot, whether the platform will scale, whether the code is sound, whether the agency is delivering value, whether the security is real or assumed.
Our explainer on what a technology review covers sets out the scope, and the technology review page covers how we run one. If you are preparing for investment, the technical due diligence checklist is the investor’s version of these questions.
What to do with the answers
Pick the three worst. Fix the ones you can fix yourself this month, the backup restore, the leavers’ access, the cost review. Put a date on the ones that need help. Re-run the check in six months and compare.
The businesses that get the most from this are the ones that treat it as a habit rather than an event. Twice a year, two hours, written down. It is the cheapest technology governance there is.
The honest caveat
Self-assessment is only as good as the honesty of the person doing it. Founders tend to score themselves generously on the questions that matter most. If you want the real answer, have someone with no stake in it ask the questions, and listen to the operations lead when they disagree with you.
Frequently asked questions
How do I check if my business technology is healthy?
Ask 12 plain questions about resilience, backups, data flow, cost, security, ownership and whether technology is holding the business back. Be honest. More than four no answers means it is time for an independent review.
What is the most important question?
When you last restored from a backup. Most businesses have never tested one, and discovering that during a failure is the costliest way to find out.
Can I fix the problems myself?
Several of them, yes. A backup restore, a leavers’ access review and a cost audit need no outside help. Scalability, code quality and security assurance usually do.
How often should I do a technology health check?
Twice a year as a self-check, with an independent review when the business changes materially, such as rapid growth, a raise, an acquisition or a security scare.
Who should be in the room?
The founder, the operations lead and whoever is closest to the technology. Three perspectives give an honest picture. One gives an optimistic one.
When do I need a proper technology review?
When the self-check fails on resilience, access or cost, or when an investor, a bank or a large customer is about to ask questions you cannot confidently answer.