They Spent Millions Building a Business. They Didn't Have a System.

The company looked like it had everything figured out. Team of thirty-plus people. An office. Marketing budget. Active sales pipeline. Revenue in the millions.

Then I did the first IT audit.

What the Audit Found

Behind the professional exterior, the infrastructure was held together with hope and habit:

• The main domain was registered under an ex-marketing manager's personal account. She'd left the company eight months ago. Nobody had transferred it. If she decided to let it lapse — or just forgot to renew — the company's web presence would vanish overnight.
• Hosting was on a personal account of a contractor who "promised everything is fine." The company was paying through his account. He had full control. The company had no direct access.
• No backups. At all. Or more precisely — backups existed, but they were stored on the same server as the production data. If the server failed, both the live data and the backups would go with it.
• Eight people were doing work that could be automated in a week. Manual data entry, manual report generation, manual order processing. The team was exhausted and the processes were error-prone, but nobody had stepped back to ask whether any of it needed to be done by a human.
• No documentation. If the developer who built the system got hit by a bus, nobody else could maintain it. If the accountant who "knew how everything connected" left, the financial processes would collapse.

The company had spent millions building the business. They hadn't spent a week building the system that holds it together.

How This Happens

This isn't a story about incompetence. I've seen this pattern at companies run by smart, experienced operators. Here's how it develops:

In the early days, speed beats structure. When you're starting out, you register the domain under whoever has the credit card handy. You put hosting on the developer's account because it's faster. You don't write documentation because there are three people and everyone knows everything. These are reasonable decisions at the time.

But they become liabilities at scale. The decisions that made sense with 5 people become risks with 30. The shortcuts that saved a week in year one cost months in year three. And nobody goes back to fix them because they're invisible — until the audit.

"It works" masks "it's fragile." Everything was working fine. Revenue was coming in. The team was delivering. The fact that the entire operation was one contractor's account, one domain renewal, or one server failure away from catastrophe — that wasn't visible in any dashboard.

Why Franchise Networks Are Even More Exposed

If a single-location business has these risks, a franchise network has them multiplied — and distributed in ways that are harder to detect.

Every franchisee's local infrastructure is a potential liability for the brand. If a franchisee's local data is lost, if their POS system is on a personal account, if their local marketing tools are registered under an employee who left — that's a risk to the location, and by extension, to the brand.

HQ can't audit what it can't see. Most franchise agreements cover brand standards and operational compliance. Very few cover IT infrastructure hygiene. HQ might audit whether the franchisee's storefront meets brand guidelines, but nobody checks whether their digital accounts are properly secured, their data is backed up, or their admin access is distributed.

The risks compound across the network. One franchisee losing their data is a bad day. Ten franchisees getting locked out of systems because they were all on one contractor's account is a crisis. The probability of something going wrong across 50 or 100 independent operators is very high — even if the probability at any single location is low.

The Audit Checklist

Based on doing these audits repeatedly, here's what I check — and what any franchise HQ should verify across the network:

Ownership: Who owns the domains, hosting accounts, and cloud services? Are they registered to the company (not personal accounts)? Can the company access them independently?

Backups: Do they exist? Are they stored in a separate location from the production data? Has anyone actually tested restoring from a backup in the last six months?

Access: Who has admin access to critical systems? Is there a documented list? Are former employees still in the system?

Automation: What processes are being done manually that should be automated? Where is the team spending time on repetitive tasks that a system could handle?

Documentation: If the person who manages the technology left tomorrow, could someone else take over? Is there a written record of how things work, or is it all in someone's head?

The Lesson

Spending money on a business doesn't mean you've built a system. A system is what survives when any individual person leaves, when any individual server fails, when any individual account gets locked.

In franchise networks, the gap between "we have a business" and "we have a system" is multiplied at every location. The audit isn't expensive. The cleanup isn't glamorous. But the alternative — discovering the fragility during a crisis — always costs more.