Seven Signs Your Business Has Outgrown Do-It-Yourself IT

Every small business starts with do-it-yourself IT, and that is the correct choice. At three people, a shared drive, a password manager, and whoever is least afraid of settings menus will genuinely carry you. The problem is that nothing announces the moment it stops working. There is no error message for “your IT arrangement is now the risk.” There are only tells.

Here are the seven we see most often. None of them means anything on its own. Three or more means the informal arrangement is quietly costing you more than a formal one would.

1. The person who “does computers” has another full-time job

The accidental IT admin — the office manager, the co-founder, the one employee who once set up the printer — is a fixture of small business, and usually a competent one. The tell is not their skill. It is that IT tasks lose every priority contest with their actual job, so updates wait, the weird laptop noise waits, and the account cleanup waits until the day none of it can wait.

2. Setting up a new hire takes days, not an hour

If a new laptop means an afternoon of manual installs, personal judgment calls about settings, and “I’ll add you to the shared folders when I get a minute,” each hire is inheriting a slightly different setup — and nobody could describe what a correct setup is. Configured properly, a new machine enrols itself: encryption, software, and access arrive by policy, the same way every time.

3. Nobody can say when a backup was last restored

Most businesses this size have backups. Almost none have watched one restore. Those are different things — a backup that has never been restored is a hope, not a plan. If the honest answer to “when did we last test it?” is “never” or “what do you mean, test,” this is the single most urgent item on the list, because it is the one you cannot fix after you need it.

4. Offboarding means “we’ll get the laptop back eventually”

Someone leaves. Their account keeps working for a while, because turning it off is on somebody’s list. Their laptop comes back next month, or does not. Whatever they could see, they can still see. This is the gap that turns a routine departure into a security incident, and it is the clearest sign the accounts-and-devices layer needs an owner whose job it is.

5. Everyone is an administrator

On the file share, in the accounting software, on their own laptops — because granting full access once was easier than deciding who needs what. It works until a single phished password, or one wrong click, has the run of everything. A baseline where people have the access their role needs is not bureaucracy; it is the cheapest insurance in IT.

6. Nobody knows what you are paying for

Licences bought by whoever needed them, on whichever card was handy. Renewals that surprise you. Two tools doing the same job because nobody knew the first one existed. Software sprawl is a money leak, but the deeper cost is that no one can answer “what do we run, and where?” — which is the first question in every security, insurance, and due-diligence conversation you will ever have.

7. IT decisions only happen after something breaks

DIY IT is reactive by nature: the arrangement has no time or mandate for prevention, so every decision is made during an outage, at maximum stress and minimum leverage. If the last three IT decisions your business made were all triggered by something failing, the arrangement is choosing for you — and it always chooses the expensive week.

What the step up actually looks like

Not a big-company IT department, and not a body in a polo shirt at reception. For most businesses under fifty people it looks like managed device and Microsoft 365 practice: every laptop enrolled, encrypted, and patched by policy; accounts created and — more importantly — disabled the day they should be; backups that someone tests; a helpdesk that answers; and a monthly report that proves it all happened. The honest cost picture, with real CAD ranges, is in our managed IT cost guide.

And if you are at three people with simple needs — keep doing it yourself, genuinely. Turn on multi-factor authentication everywhere, use a password manager, test one restore, and revisit this list at your next growth spurt.

Not sure which side of the line you are on? Our two-minute tech checkup covers several of these gaps and scores where you stand — no email required. Or send us two paragraphs about your setup and we will reply in writing within one business day, including an honest “you don’t need us yet” if that is the answer.