What Is an IT Health Check? A Practical Checklist for Melbourne Businesses

An IT health check is a structured review of the systems a business relies on, the risks already visible and the gaps that could make support or recovery harder. It should examine people and access, devices, networks, cloud services, backups, suppliers, documentation and planned business changes. The result should be a prioritised set of findings, not a long list of products to buy.

For a Melbourne business, the most useful time to complete one is before a provider change, an office move, a major cloud project, an insurance renewal, or a growth phase. It can also establish a clean baseline when nobody is certain who owns licences, administrator accounts or recovery.

This checklist explains what a credible review should cover and what the business should receive at the end.

What an IT health check is not

It is not a vulnerability scan by itself, although technical scans may support part of the review. It is not a sales meeting renamed as an audit. It is not proof of regulatory compliance or a promise that systems cannot fail.

A proper assessment connects technical observations with business impact. An old switch may be low priority if it supports a non-critical room and a replacement is already scheduled. One untested backup may be urgent if it contains the only copy of the accounting database.

The scope, access and limitations should be agreed before the work begins.

Business priorities and critical systems

The reviewer first needs to understand how the business operates. Identify the systems used for sales, customer service, finance, payroll, production and communication. Record the effect if each is unavailable for an hour, a day or longer.

Ask management about planned hires, new locations, acquisitions, application changes and contractual obligations. A healthy environment for today’s business may not support next year’s headcount or service model.

This step prevents the assessment from treating every device equally. It also guides business continuity and recovery decisions.

User accounts and access

Create an inventory of active users, guests, contractors, shared accounts and administrators. Compare it with current staff and roles.

Look for:

• Accounts belonging to former staff;
• Shared passwords;
• Unnecessary administrative access;
• Users without multi-factor authentication;
• Old guest access;
• Inconsistent licence assignment;
• Service accounts without owners; and
• No scheduled access review.

The business should know who approves access and how it is removed. A documented staff onboarding and offboarding process helps prevent the same gaps from returning after the review.

Devices and operating systems

Record laptops, desktops, phones, tablets and relevant shared equipment. Note assigned user, age, warranty, operating system, encryption, management status and security software.

Unsupported software and unmanaged devices deserve attention, but replacement should be prioritised. A lifecycle plan is more useful than declaring every older device an emergency.

Check whether lost equipment can be locked or wiped, whether local administrator rights are controlled and whether updates are monitored. Remote and personally owned devices need an explicit policy.

Businesses with inconsistent procurement may consider Device as a Service or a direct-purchase lifecycle, depending on cost and control preferences.

Microsoft 365 and cloud applications

Review tenant administration, licences, identity settings, sharing, mail flow, retention and third-party application access. Confirm that the business controls domains and global administrator accounts.

Cloud software reduces local infrastructure, but configuration remains the customer’s responsibility in many areas. Check for public links, automatic forwarding, abandoned applications and apps granted broad permissions.

The review should distinguish what is included in the platform, what is configured and what is separately backed up. Telco ICT’s Office 365 services provide context for ongoing tenant administration.

Network and internet

Map internet connections, routers, firewalls, switches, wireless access points, VPNs and links between sites. Record the provider, contract, public addressing, administrator access and warranty status.

Check:

• Whether guest Wi-Fi is separated from business systems;
• Whether network equipment is supported and updated;
• Whether remote access is restricted and logged;
• Whether configuration is backed up;
• Whether internet capacity suits peak use;
• Whether monitoring identifies outages; and
• Whether a backup connection is genuinely independent and tested.

For businesses with several locations, SD-WAN may be relevant, but only after requirements and connectivity are understood.

Backups and recovery

List the information that must be recoverable, where it lives and who protects it. This may include servers, Microsoft 365, application databases, cloud storage, websites and network configuration.

For each backup, record frequency, retention, isolation, encryption, monitoring and restore testing. A successful backup job does not prove that the complete system can be restored within the required time.

Ask management to define acceptable data loss and downtime. Those answers shape recovery design. The disaster recovery versus business continuity distinction is important: restoring data is only one part of keeping the business operating.

Security controls

Security should be reviewed as part of the environment, not sold as one appliance. Examine identity protection, patching, endpoint controls, email, firewall rules, remote access, administrator practices, logging and staff reporting.

Look for controls that exist only on paper or licences purchased but never configured. Confirm who receives alerts and what happens next.

An IT health check is not a penetration test and should not be described as certification. Where specialised testing or legal advice is needed, the report should say so.

Business phone and communication systems

Record business numbers, SIP services, phone-system hosting, handsets, call routes, licences and carrier contracts. Confirm who owns the numbers and how they can be ported.

Check call flow, after-hours routing, voicemail ownership, remote users and continuity. If the phone system relies on internet, test what happens when the primary connection fails.

The business phone systems page outlines the wider options, while the health check should focus on the organisation’s actual configuration.

Suppliers, licences and contracts

Build a register of internet, cloud, software, hardware, phone and support suppliers. Record account numbers, renewal dates, owners and cancellation terms.

Businesses often discover duplicate licences, personal credit cards, departed account owners or services that nobody uses. Removing waste can be valuable, but do not cancel anything until dependencies and retention are understood.

Review whether the current IT agreement clearly defines support hours, projects, after-hours work, data ownership and exit assistance.

Documentation and administrator access

The business should have current network diagrams, device records, application owners, suppliers, call flows and recovery procedures. Documentation needs controlled access and a review process.

Confirm that critical administrator access is recoverable by the business. One external contractor or employee should not be the only route to domains, cloud tenants or backups.

Good documentation shortens incidents and makes a provider transition safer. Telco ICT’s first 90 days with a new MSP shows how the same information establishes a clean baseline.

Support performance and recurring problems

Review repeated tickets, unresolved faults, response patterns and user experience. A high volume of password resets may point to identity or training issues. Repeated wireless complaints may indicate design rather than individual devices.

Look beyond the number of closed tickets. Check reopenings, recurring incidents, time waiting for users or suppliers, and whether root causes are addressed.

Ask staff which problems they have stopped reporting. Workarounds can hide operational inefficiency from support data.

Growth and project readiness

Compare current capacity with the next 12 to 24 months. Consider user growth, office changes, new applications, compliance needs, acquisitions and customer requirements.

Projects often fail because basic identity, data ownership or connectivity was never settled. The health check should identify prerequisites and sensible sequencing.

A technology roadmap should show decision points, owners and estimated timing. Unverified cost figures should remain separate from the initial findings.

What should the final report contain?

A useful report includes:

• Agreed scope and limitations;
• An executive summary in plain language;
• Asset and service observations;
• Risks ranked by likelihood and business impact;
• Quick corrections distinguished from projects;
• Items requiring specialist investigation;
• Responsible owner for each action;
• Recommended timing; and
• Assumptions needing confirmation.

It should also say what is working. A review that labels every item a critical risk is difficult to trust and impossible to action.

How priorities should be set

Use business impact, likelihood, exposure and effort. A practical structure is:

Act now: active compromise, failed critical backup, unsupported exposed system or loss of administrator control.

Plan next: lifecycle, network, recovery or process gaps that are not immediate incidents but create material risk.

Improve later: efficiency, standardisation and user-experience opportunities.

Monitor: accepted conditions with an owner and review date.

The organisation decides what risk it accepts. The provider supplies evidence and options.

When should a business arrange an IT health check?

Useful triggers include:

• Before changing IT providers;
• Before an office move;
• After rapid hiring;
• Before a cloud migration;
• When support has become reactive;
• When nobody can explain backups or administrator ownership;
• After an incident;
• Before a cyber-insurance renewal; or
• During annual planning.

It can also be a sensible first step for a business that has never had structured IT management.

Questions to ask the reviewer

1. What is included and excluded?
2. Which access do you require?
3. Will any testing affect production systems?
4. How will sensitive information be protected?
5. Are findings tied to business impact?
6. Will we receive our documentation and evidence?
7. Are product recommendations vendor-neutral?
8. Which statements require further testing?
9. Who can help implement approved actions?
10. Is the check genuinely free, and what conditions apply?

Establish a clean baseline

An IT health check should leave management knowing what it owns, what needs attention and what can wait. That clarity is useful whether the business keeps its current support, hires internally or considers a managed service provider.

Telco ICT can review a Victorian business’s users, devices, cloud services, connectivity and recovery position. Call 1300 414 214 or use the contact page to ask about the current health-check scope and terms.

Frequently asked questions

How long does an IT health check take?

It depends on users, sites, systems, access and depth. A small office review differs from a multi-site environment with servers and specialist applications. The provider should define discovery, technical review and reporting time before starting.

Is an IT health check the same as a security audit?

No. It may review security controls, but it is broader and usually less specialised. It should not be presented as penetration testing, regulatory certification or legal compliance advice.

Will it interrupt the business?

Most discovery is read-only, but scans, configuration tests or failover exercises may affect systems. Any potentially disruptive work should be approved and scheduled.

Do we have to change providers afterwards?

That depends on the offer terms. A credible assessment should state any commitment clearly. The business should receive findings it can understand regardless of who implements them.

Can the check identify unnecessary costs?

It may find duplicate licences, unused services or contracts that no longer fit. Savings should be verified against dependencies, cancellation terms and future needs before anything is removed.

What should we do first after receiving the report?

Confirm urgent findings, assign owners and agree on sequencing. Do not begin several interdependent changes without a rollback and communication plan.