A Quarterly Business File Audit Checklist

A Quarterly Business File Audit Checklist

File systems don't decay gradually. They decay through events — a rushed launch, a contractor onboarded in a hurry, a month where nobody filed anything. The damage from any one event is small. The damage from twelve unnoticed events is a system nobody trusts.

A quarterly audit catches drift while it's still cheap to fix. Sixty minutes, four times a year, and it prevents the weekend-long rebuild that otherwise arrives every few years.

Put it on the calendar now, for a date about a month after each quarter ends, so the quarter's records have settled.

1. Access review (10 minutes)

Open your access register beside each platform's member list.

  • Anyone with access whose work ended? Remove, date the register.
  • Anyone in a platform who isn't in the register? Find out how they got there.
  • Any public or link-based sharing still live? Most drive platforms can report on this. Expire anything from a finished project.
  • Any shared credential that should have been rotated after someone left?

What this catches: the contractor from eight months ago who still has edit access to your client folder, and the "anyone with the link" share created for a one-off handoff in 2023.

2. Contract register review (10 minutes)

  • Anything renewing in the next 120 days?
  • Any notice deadline approaching? Notice periods are usually 30–60 days before renewal, so a quarterly check needs a 120-day lookahead to be safe.
  • Any contract signed this quarter that isn't in the register?
  • Any vendor you're paying for and no longer using?

What this catches: the auto-renewal you meant to cancel, which is the single most reliably expensive miss in a small business, and the subscription that's been billing for a tool nobody has opened since March.

3. Money in and money out (10 minutes)

  • Unpaid invoices past terms — chase each one today, not "soon."
  • Receipts folder for the quarter — complete? Any month conspicuously thin?
  • Bank and card statements downloaded for all three months?
  • Any expense you can't identify? Resolve it now, while the vendor's records still go back that far.

What this catches: the invoice that was never chased because it left the inbox, and the three weeks of receipts that were never captured because you were travelling.

4. Structure drift (5 minutes)

  • New top-level folders that shouldn't exist? Merge or move them.
  • Two folders that mean the same thing? Marketing and Marketing Assets both exist by now, in some form.
  • Anything filed in 06 Archive that's actually active, or in 03 Clients that's actually dead?
  • Any client or project folder that doesn't match the template?

What this catches: the slow proliferation that makes a drive unnavigable. Structural drift is invisible day to day and obvious the moment you look for it deliberately.

5. Empty the inboxes (5 minutes)

  • The 00 Inbox folders — anyone's been full for more than a month?
  • Your desktop and downloads folder — anything living there that belongs in the system?
  • Email: anything in Waiting that's gone cold?

What this catches: the staging areas that were supposed to be temporary. An inbox folder that's been full for three months isn't an inbox, it's a second filing system.

6. Active vs. archived (10 minutes)

  • Every project finished more than 60 days ago — close it out and move it.
  • Every closed project has a manifest?
  • Anything in the archive that's aged past your retention policy?

What this catches: the active folders getting longer every quarter until finding a live client takes scrolling.

7. Backup verification (5 minutes)

  • Is the last successful backup recent? Check the actual date, don't assume.
  • Restore one file from backup. An actual file, actually restored. This is the only test that means anything.
  • Is anything important excluded from backup — a local-only folder, a drive that's not syncing, an archive that got skipped because it's large?
  • Does one copy exist somewhere physically separate?

What this catches: the backup that stopped running in February and never said so. Backups fail silently and the failure is discovered at the worst possible time. This five minutes is the highest-value item on the entire list.

8. Documentation currency (5 minutes)

  • Open the SOP index, sort by last-reviewed. Anything overdue gets updated or archived.
  • Any process that changed this quarter and isn't reflected in its SOP?
  • Any new recurring task that has no SOP at all?

What this catches: procedures that quietly became wrong. A stale SOP is worse than no SOP, because someone will follow it.

9. The small permanent pile (5 minutes)

  • Formation documents, licences, insurance, registrations, IP — all present, all current?
  • Anything expiring in the next six months? Licences, insurance policies, domain registrations, certificates.
  • Is this pile backed up separately, in at least two places, one of them off-site?

What this catches: the lapsed licence and the expired domain. Domain expiry in particular takes down a business's email and website simultaneously, and the recovery window is short.

Once a year, add these

Alongside the Q4 or post-tax-filing audit:

Retention sweep. Work down your retention policy. Delete what's aged out, especially personal data collected for completed purposes.

Export from every platform. Email archive, accounting export, shop data, website backup. Every account you depend on should have an export sitting in your own storage. Platforms suspend accounts, change terms, and go out of business.

The orphan check. Files owned by individual accounts rather than the organization. Documents floating in personal drive space that should be shared. This is the sweep that prevents a departure from taking records with it.

Storage and cost review. What are you paying for storage across all services? Usually there are two services doing the same job because one was adopted and the other never cancelled.

Update the orientation document. If your structure changed this year, the document a new hire reads is now wrong.

Keep an audit log

One file, 01 Admin/File Audit Log.md. Four lines per quarter:


## 2025 Q1 — audited 2025-04-08 by Dana
Fixed: removed 3 stale contractor accesses, cancelled unused design tool
Found: backup had not run since Feb 11 — reconfigured, verified restore
Deferred: legacy folder cleanup, again

Two reasons this earns its place. It shows you what keeps recurring — the item you defer four quarters running is either genuinely unimportant or genuinely needs someone assigned. And it's evidence of routine practice, which matters if anyone ever asks how you manage records.

If you only have fifteen minutes

Do these four, in this order:

  1. Verify a backup by restoring a file.
  2. Check contract renewals in the next 120 days.
  3. Chase overdue invoices.
  4. Remove access for anyone who's finished.

That's the risk-weighted core. Everything else on the list is about keeping the system pleasant to use; these four are about not losing money or data.