7 min read
The join between your two systems is logged in as somebody. Ask who
Most small-firm integrations run on one employee's login, so they break when that password does. What to write down, and which joins deserve better.
Insights
Notes on systems, and the businesses that run on them.
Occasional writing from the practice — what we see going wrong, what we would do about it, and the reasoning behind it. No listicles.
7 min readYour comments box is exempt from the Online Safety Act. Your members' area might not be
Comments and reviews on your own content are exempt by name. What puts a small firm in scope is users talking to each other, and that is easy to check.
6 min readThe new website went live on Thursday. So did the email outage
A website and an email system share one thing, the domain's DNS. What gets lost when the nameservers move, and the question to ask before anyone does it.
6 min readThe automation still runs every Monday, and nobody left knows what it does
Most firms have something running that nobody can explain. How to find the unowned automations, what to write down, and why switching one off is the test.
5 min readBefore you buy more enquiries, measure how long the last twenty waited
Enquiries that go nowhere are usually not a marketing problem. How to measure your real first-reply time, and what an automatic acknowledgement can fix.
6 min readYou have the signed PDF. The evidence is somewhere else
The completed file is the output, not the proof. What an e-signature audit trail actually contains, and whether you could still get hold of yours.
6 min readDo I need to register with the ICO? Almost certainly, and it costs £52
Most owner-managed firms are registrable and plenty are not registered. The fee is £52. The useful part is the questions you have to answer to pay it.
6 min readYour IT contract promises a one-hour response. Nobody has ever checked
The response clock in a support contract has at least five settings, and your provider chose all of them. How to audit yours from your own sent mail.
7 min readYour biggest customer's portal means you now run two systems
Orders go into their portal and again into yours. What goes wrong when a job lives in two places, and the three ways out, in the order to consider them.
6 min readSwitching accounting software is a migration, not a subscription swap
The monthly price is the smallest number in the decision. What actually has to move when you change ledger, what gets left behind, and when the sum says go.
7 min readYour rota is about to become evidence, and nobody can tell you exactly when
Guaranteed hours and shift-notice rights are coming under the Employment Rights Act. No date is fixed and the numbers are not written. What to record now.
6 min readMost of what you want automated is not worth automating
The jobs people most want automated are rarely the ones worth building. The arithmetic that decides it, and the step that comes before any software.
6 min readSix in ten requests to a website are automated, and your analytics will not show you most of them
What the bot figures actually measure, why your analytics disagrees with your server, and the number a small firm should be judging the work on instead.
6 min readThe broadband goes down at ten past nine. What is still working?
Most small offices have never established what an outage actually stops. A deliberate fifteen-minute test, and the two fixes worth arranging in advance.
5 min readYou have a backup. When did anyone last put one back?
Most firms have never watched a restore, which makes the backup a belief rather than a fact. How to test one in half a day, and what the test tells you.
7 min readFrom January an employee can claim unfair dismissal at six months. The file has to exist before then
The qualifying period for ordinary unfair dismissal drops to six months on 1 January 2027. At two years a paper trail builds itself. At six months it does not.
6 min readThe text-message code you log in with stops working in February
Microsoft retires SMS and voice codes for work accounts on 1 February 2027. There is no opt-out, and the awkward cases are worth finding now.
6 min readYour IT provider probably is not being regulated. The ones that are will owe you a phone call
The Cyber Security and Resilience Bill covers around 1,500 of the UK's 11,000 IT providers. How to tell which one yours is, and what changes if it is.
6 min readYour website's certificate stopped lasting a year in March, and the next cut is already booked
Certificate lifetimes fell to 200 days in March and halve again in 2027. Renewing is easy. Knowing who receives the expiry warning is the hard part.
6 min readThe login three people share is about to stop working
HMRC switches multi-factor authentication on for every remaining agent account between 28 September and 15 October. Shared logins are what breaks first.
6 min readThis month Google Ads starts writing its own targeting, and nobody has to click yes
From 1 September, Search campaigns using automatically created assets or campaign-level broad match are upgraded to AI Max. No approval required.
5 min readYour IT provider is about to be regulated. Here is what to ask them
The Cyber Security and Resilience Bill will regulate managed IT providers for the first time. Four questions tell you how yours would fare, law or no law.
6 min readYou had multi-factor authentication on. They got in anyway
The attack built to beat MFA wants neither your password nor your code. It takes the session your own successful login produced.
5 min readIn December the office copier stops emailing scans, and nothing will tell you why
At the end of December Microsoft blocks the password sign-in that copiers and apps use to send email through Microsoft 365. The failure is silent.
4 min readThe government built you a free security check. Run it before you pay anyone
The NCSC's free tools give small firms a tailored security fix list in minutes. What they catch, what they cannot see, and when paying makes sense.
5 min readOutlook changed by itself this year. Before you toggle back, count what broke
Microsoft is switching Business plans to new Outlook automatically, but classic is supported until at least 2029. What to check before picking a side.
5 min readYour best client relationship lives on someone's personal WhatsApp
The thread works until the phone goes on holiday or its owner resigns. Who actually holds a client conversation, and three fixes in ascending order of cost.
5 min readSomebody's AI notetaker sat in on that meeting. Whose record is it?
Notetaker bots now join client calls uninvited, and a US lawsuit says one recorded people who never knew. The questions to ask, and the Teams settings.
6 min readFrom October an employment dispute can arrive six months late. Would your records survive the wait?
From 1 October 2026 most tribunal claims can be brought six months after the event. The records that decide them are on shorter timers than that.
4 min readThe .uk transfer system is being retired. Find out who holds your domain before it is
From 9 February 2027 a .uk domain transfers by auth code, like a .com. If yours sits with an ex web designer, the months before that are the time to act.
5 min readSince 2 August, your chatbot may be legally required to admit it is a bot
New EU transparency rules for chatbots took effect on 2 August. Whether they reach your firm depends on who you serve. Disclose anyway, and here is how.
5 min readIn 2029 a PDF stops being an invoice, and the decisions that matter happen this year
From April 2029, most UK invoices between businesses must be structured e-invoices, not PDFs. Nothing to buy yet, but some decisions age badly.
6 min readThe most expensive email your business will receive says a supplier's bank details have changed
Payment diversion fraud now arrives mid-thread, from the supplier's real address. The fix is a rule about process, not sharper eyes.
6 min readAsking for Google reviews is now regulated, and three habits that feel harmless are on the banned list
A discount code for reviews, a form that filters out the unhappy, a quiet word with staff. All three now sit under a law with fines of up to 10% of turnover.
6 min readCyber Essentials got stricter in April, and last year's pass is not this year's
Three questions can now fail your whole assessment on their own. If you passed comfortably last year, that tells you less than it used to.
6 min readThe MTD deadline is the scammers' deadline too
HMRC does send texts and does put QR codes in letters, so "HMRC would never contact you" is bad advice. Here is what it actually never does.
5 min readYour web designer owns your domain, and you find out at the worst moment
The commonest website emergency is not a hack, it is a handover. A five-minute audit tells you who really controls your domain while asking is still easy.
6 min readAI has not eaten local search, and the panic is pointed at the wrong thing
The statistics people quote at you disagree by a factor of three. What wins the searches that bring customers in has barely changed, and it is duller.
6 min readThe spreadsheet that became a system
Most businesses have one file nobody dares touch. How to tell when a spreadsheet has quietly become a system, and what the cheapest exit looks like.
5 min readYour quote went to their junk folder, and it is your domain's fault
The big mailbox providers now reject email they cannot verify. Most small business domains were set up before the rules, and it shows in the junk folder.
5 min readWhen to replace a system rather than integrate it
Integration is usually the cheaper answer, and sometimes the wrong one. The test is whether the old system still describes how your business works.
6 min readThe cookie banner on your website is probably blocking the wrong thing
The UK rules changed in February. Most small business banners now hold back the analytics you rely on and wave the advertising tags straight through.
3 min readWhat an IT consultant should tell you in the first hour
Most first meetings are a sales call wearing a discovery hat. Here is what a useful one covers instead, and the three answers worth listening for.