Inherited IT? What to Do First

Short answer

You don't need to become technical. You need visibility. In your first two weeks, find out who holds admin access to email, your domain and key systems, list your accounts, licenses and vendors, confirm backups and multi-factor sign-in (MFA) are working, and settle who to call when something breaks. Once you can see the whole picture, decide what stays in-house and what goes to a partner.

Why does IT land on finance and operations leaders?

IT lands on whoever is left holding the keys. The in-house IT person resigns. The long-time employee who "handled the computers" retires. A business sale takes the IT team with it. Suddenly the CFO, the head of HR or the operations lead owns something they never signed up for.

If your first reaction is "this isn't my expertise," that's fair. Your job right now isn't to fix servers. It's to find out what you have, who controls it, and who you call when it breaks. That's a management problem, and you already know how to solve those.

Who has admin access to our systems?

Start here. Admin access is the master key: the accounts that can add users, reset passwords, change email settings and delete data. If you don't know who holds them, you don't fully control your own systems.

Make a short list of who has admin rights to each of these:

Email and files: the administrator accounts for Microsoft 365 or Google Workspace.
Your domain name: the registrar account where your web address is registered, and its DNS settings (the directory that tells the internet where your email and website live).
Your website and hosting.
Your network: the firewall, Wi-Fi and internet service accounts.
Money-adjacent systems: accounting, payroll and anything that can add users or change payment details.
The systems that run the work: your CRM, project or practice management tools, ERP.

If the answer for any of these is "the person who just left" or "a shared login everyone knows," move it to the top of your list. The goal is ownership by accounts your company controls, with at least two named administrators so no single person is a point of failure.

If someone left on difficult terms, closing their access comes first, the same day. Remove their admin rights and change any shared passwords they knew before you work through the rest of this list.

Where are the passwords?

The honest answer is often "a few places": a password manager, a spreadsheet, a notebook in a desk drawer, or a former employee's browser. Each tells you something about how much cleanup is ahead.

Wherever they are now, the goal is the same. Move them into a business password manager your company owns, limit access to the people who need it, and change anything that was stored somewhere it shouldn't have been.

While you're looking, gather whatever documentation exists: network notes, vendor contacts, setup instructions. It may be thin. That's normal, and rebuilding it is part of the work.

What are we actually paying for?

Pull the last few months of card statements and bills, and list every technology charge: software subscriptions, licenses, internet, phone service, domain renewals and support contracts. For each one, note what it is, who uses it, when it renews and whose name is on the account.

This list does two jobs. It shows where you may be paying for licenses nobody uses, and it surfaces renewals and contract deadlines before they surprise you. If a support contract has terms you're unsure about, have your attorney read it before you make changes.

Are our backups and security basics working?

You don't need to judge the technical details. You do need clear yes-or-no answers to a few questions:

Is our email and file data backed up separately from Microsoft 365 or Google Workspace, and when was a restore last tested?
Is MFA turned on for every account, especially admin accounts?
Do our computers install security updates automatically?
Does a person review security alerts from our antivirus or endpoint protection, or do they go to an inbox nobody reads?

If any answer is "I don't know," that isn't a failure. It's your next phone call. A capable IT partner can answer all four within days.

Turning on MFA or tightening security settings can lock people out if it's rushed. Plan the change, test it with a small group first, and validate it with your IT provider before rolling it out to everyone.

Which devices do we have, and who has them?

List the laptops, desktops, phones, tablets and printers, plus who has each one, roughly how old it is and whether the company owns it. Ask whether laptops are encrypted, so a lost device doesn't mean lost data.

Pay special attention to devices still held by people who have left. Getting those back, and wiping them properly, closes a gap most teams forget about until it matters.

Who do we call when something breaks?

Before the end of week one, answer the question your team will ask you on Monday: "Who do I call?" If there's an existing provider, confirm what they cover, their hours and how to reach them. If there isn't one, line someone up for urgent issues now, even temporarily, so a locked account or a dead laptop doesn't land on your desk.

Then tell everyone. One short email with the support contact saves you a dozen interruptions.

Your first two weeks: a checklist

Remove access for anyone who has left, starting with admin accounts.
List who holds admin access to email, domain, website, network and financial systems.
Make sure at least two named people at your company can reach every admin account.
Find where passwords live and plan the move to a company-owned password manager.
List every technology vendor, license and contract, with renewal dates.
Get yes-or-no answers on backups, restore testing, MFA, updates and alert monitoring.
List devices and who has them; recover devices from former employees.
Confirm who your team calls for help, and tell them.

Should we hire a replacement or hand IT to a partner?

Once you can see the picture, this decision gets much easier. Most businesses land on one of three options:

Option	Works well when	Watch for
Hire a replacement in-house	You need someone on-site daily and have steady work for a full-time role	One person can't cover every skill, every hour or every vacation
Hand IT to a managed IT partner	You want help desk, security and planning covered without building a team	Clear scope, so you know what's included and what's a project
Combine the two	You have, or want, an internal person who knows the business	A written split of who owns what, so nothing falls between you

If you're weighing the third option, we wrote about managed IT alongside an internal IT person. If a partner makes sense, here's how our managed IT service works: onboarding follows our LIFT Framework (Learn, Integrate, Fortify, Transform), and most clients are fully onboarded within 30 days.

Whichever path you choose, don't let IT rest on one person again. Shared admin access, current documentation and a written plan are what keep the next transition calm. When you're ready to look further ahead, our first-year IT plan lays out what to fix in what order.

Where to start

You don't need to become an IT expert. You need to see what you have and have a partner you trust. Take the free 5-minute IT Snapshot to see where you stand, or book a 15-minute call and we'll walk through your first two weeks with you.

You Just Inherited IT. Here's What to Do First.