A backup strategy an owner can actually audit

July 6, 2026 · 4 min read · Josh Dargie · Markdown

Every owner I meet believes their business is backed up. Very few can tell me what is backed up, where the copies live, or when a restore was last proven to work. Those are different things, and the gap between "we have backups" and "we can recover" is where businesses get hurt.

You do not need technical knowledge to audit this. You need three questions and the patience to insist on plain answers.

Question one: what exactly is backed up?

Ask for a list. Not "everything", a list. The server, fine, which server? The accounting data? The shared drive? The website and its database? The email? The files on the owner's own laptop, which in a small business are often the most important and least protected data in the company?

The answer that should worry you is a confident "everything is covered". In twenty years I have almost never found that to be literally true. There is always a system someone set up later that nobody added to the backup job: the new point-of-sale, the CRM you moved to last year, the one spreadsheet that runs payroll.

Write the list down. It becomes the first page of your audit.

Question two: where do the copies go?

You want at least one copy that is off-site and one copy that yesterday's mistake or attack cannot reach. A backup drive plugged into the same machine it protects will burn in the same fire and be encrypted by the same ransomware. A sync service like Dropbox or OneDrive is not a backup on its own; it will faithfully sync a deletion or a corrupted file everywhere within seconds.

The plain-language test: "if this building burned down tonight, and someone had also deliberately deleted our files yesterday, what would we still have, and how old would it be?" Whoever manages your IT should be able to answer that in two sentences. If the answer involves a lot of qualifiers, keep asking.

Off-site today usually means a cloud service, and the cost for a small business is modest, typically tens of dollars a month, not hundreds. Cost is rarely the real obstacle. Nobody owning the question is the real obstacle.

Question three: when was a restore last tested?

This is the question that separates backup from backup theatre. A backup that has never been restored is a hope, not a plan. Backup jobs fail quietly: they run out of space, a password changes, a folder gets renamed, and the software keeps reporting green because it successfully backed up nothing.

Ask: "when did we last actually restore a file, and who did it?" Then ask the harder version: "if the main server died Friday afternoon, how long until we are working again, and has anyone ever timed it?" The first restore anyone attempts should not be during a crisis. I have watched migrations and recoveries fall apart for exactly this reason; the patterns in why migrations go wrong apply just as well to restores.

A reasonable standard for a small business: one test restore of a few files monthly, and one full rehearsal of the "server is gone" scenario once or twice a year. An hour or two of someone's time, scheduled like any other maintenance.

The owner's checklist

Put a recurring hour in your calendar each quarter and go through this:

1. Get the current list of what is backed up. Compare it to the systems you actually run. Anything new since last quarter?
2. Confirm at least one copy is off-site and at least one copy cannot be altered or deleted from inside your network.
3. Ask for the date and result of the last test restore. "We are sure it works" is not a date.
4. Ask how long a full recovery would take, and decide as a business whether you can live with that number.
5. Check who gets alerted when a backup job fails, and confirm that alert goes to a mailbox someone reads.

Notice that none of these require you to understand the software. They require ownership, which is the part that cannot be delegated. Your IT provider runs the backups; you own the question of whether the business can recover. If the answers you get are vague, that is a finding in itself, and worth checking against what your support contract actually promises, something I covered in warranty and support fine print.

If you would rather have an independent set of eyes run this audit once and leave you with the checklist filled in, that is a small fixed-fee engagement for me and a common one. Details are on my assessment page. I sell no backup products, so the answer you get is just the answer.

← All posts