A Complete Backup Audit Checklist for Home and Business

This is the audit that tells you whether everything else in this category is actually working. Run it once thoroughly, then annually.

Set aside ninety minutes for the full version. There's a fifteen-minute version at the end if that's what you have.

Part 1: Coverage — is everything included?

The most common failure isn't a broken backup. It's a working backup pointed at the wrong things.

  • List every location your files live. Internal drive, external drives, cloud folders, phone, tablet, network storage, work machine.
  • Compare that list against what's actually backed up. Open your backup software and read the included folders.
  • Check for local-only material — photo library packages, video projects, application databases, virtual machines, anything outside the standard user folders.
  • Check the second drive, if your machine has one. Frequently excluded by default.
  • Phone backed up, with a verified recent success date.
  • Email — is there a copy outside the provider? Annual export.
  • Cloud-only files — anything created in a browser tool and never downloaded.
  • Password manager vault — exported or covered by emergency access.
  • Authenticator recovery codes stored somewhere off the phone.
  • Software licences and product keys recorded.
  • Browser bookmarks and saved data.
  • Application settings you'd hate to rebuild.

The test question: if every device you own were destroyed tonight, list what you'd need on day one. Then check each item against your backup.

Part 2: The 3-2-1 test

  • Three copies exist? Working copy plus two backups.
  • Two different media or systems? Not two drives in the same enclosure, not two folders in one cloud account.
  • One copy off-site? In a different building.
  • One copy offline or immutable? A drive that's unplugged, or storage with retention that can't be overwritten.
  • How current is the off-site copy? If it's a rotated drive, when was the last swap?

Write the answers down rather than assuming. The off-site currency question in particular tends to produce an uncomfortable number.

Part 3: Verification — does it work?

  • Restore one file and open it. Not check the interface — restore it.
  • Check the last successful backup date for every system.
  • Restore a whole folder and compare file counts and total size against the original.
  • Open the oldest thing you can find in the backup. Format rot and encryption problems show up here.
  • Verify the off-site drive reads correctly.
  • Test-restore your website to staging, if you have one.
  • Check backup error logs for silently skipped files.

Log the result in a file with the date. Next year's audit starts from this.

Part 4: Security of the backups themselves

A backup drive is a complete copy of your life. It deserves the same protection as the original.

  • Backup drives encrypted, with keys stored in your password manager.
  • Recovery keys for encrypted backups printed and stored physically.
  • Cloud backup account has two-factor enabled.
  • Off-site drive is encrypted — it's in a location you don't fully control.
  • Backup drives aren't permanently connected, or you have a separate offline copy.
  • Someone you trust can access the keys if something happens to you.

That last one is the item people skip and the one that makes the difference between a backup and an inaccessible archive.

Part 5: Hardware condition

  • Drive ages recorded. Anything over three to five years, plan to replace.
  • Drive health checked with your system's disk utility.
  • No unusual noises, no slow transfers, no intermittent disconnections.
  • Backup drive capacity — at least twice your data, with room for history.
  • Cables and enclosures in good condition. These fail more often than drives.
  • Drives labelled with contents and purchase date.

Part 6: Business additions

Skip if this is personal only.

  • Website — files and database, backed up off the host, with multiple restore points.
  • Shop and e-commerce data exported: products, orders, customers.
  • Email list exported.
  • Payment processor and accounting exported.
  • Digital product source files in your own storage.
  • Domain — auto-renew on, registrar lock on, two-factor on, contact email not at the domain.
  • Client work covered, including any retention obligations.
  • Personal data in backups is encrypted and covered by your retention policy.
  • A second administrator exists on every critical platform.
  • Documented recovery procedure someone other than you could follow.
  • Recovery time estimated. How long to be operational again? Is that acceptable?

That last pair is the difference between a business with backups and a business that could actually survive. A backup only you can restore, with no written procedure, is a single point of failure wearing a disguise.

Part 7: The gaps list

Write down everything that failed the audit, in priority order:


BACKUP AUDIT — 2025-04-08

CRITICAL
- Video projects folder not in backup at all — fix this week
- Off-site drive last swapped September (7 months) — swap now

IMPORTANT
- Authenticator recovery codes only on phone — print
- Backup drive is 5 years old — replace
- Website backup never tested — test to staging

WHEN CONVENIENT
- Photo library export to external drive — annual
- Email export — never done

VERIFIED WORKING
- Local backup running daily, restore tested OK
- Cloud backup current, restore tested OK
- Phone backup last success 2025-04-07

The "verified working" section matters as much as the gaps. Knowing what's confirmed good is what stops next year's audit starting from zero.

Part 8: The maintenance schedule

Set these in the calendar now:

Monthly

  • Check backup status and last success date
  • Swap the off-site drive
  • Empty the _TO DELETE staging folder

Quarterly

  • Restore one file and open it
  • Check folder sizes on important directories
  • Export shop and email list data, if you run a business

Annually

  • Full audit — this document
  • Restore a whole folder and compare
  • Export email, cloud accounts, and social platforms
  • Review drive ages
  • Test the website restore
  • Update the digital estate document

The monthly status check is the one that catches most problems, because the most common failure is simply that the backup stopped and nobody noticed.

The fifteen-minute version

If ninety minutes isn't happening, do these five. They cover most of the risk:

  1. Restore one file from your backup and open it. This catches the silent failures.
  2. Check the last successful backup date on every system, including your phone.
  3. Confirm one copy is off-site, and check how old it is.
  4. Confirm one copy is offline — a drive that's currently unplugged.
  5. Check your irreplaceable pile — photos, documents, financial records — is genuinely in all of the above.

Five items, fifteen minutes, once a year. That's the floor.

The one thing to take from this whole category

Every article here comes down to the same structure:

A copy that isn't the original, that keeps history, that's somewhere else, that isn't always connected, and that you've actually tested.

Everything else is implementation detail. If your setup has those five properties, you'll survive a dead drive, a mistaken deletion, a ransomware infection, a house fire, and a locked account. If it's missing any one of them, there's a specific disaster that gets through.

Run the audit. Find which one you're missing.