Infrastructure and Security: Get the Foundation Right
Before you take on anything new, make sure the basics of your IT are solid. IBM research puts the average cost of a data breach in 2024 at $4.88 million, 10% more than the year before. Prevention is cheaper than crisis management. Gartner also reports that organisations that audit their technology regularly have 34% fewer unplanned outages during the year.
1. User Access Rights and Permissions Audit
Start by checking who has access to what. Companies change all year: people leave, switch roles, join. Their permissions often stay exactly as they were.
Check whether former employees still have active accounts. Check whether current users really need everything they have been given. By the principle of least privilege, everyone should reach only what their job requires. This simple review can close dozens of potential gaps.
2. Software and Operating System Updates
It sounds basic, but missing updates are still among the most common ways in for attackers. The Ponemon Institute reports that 60% of security breaches come from vulnerabilities for which a fix had been available for months.
List all operating systems, business applications and network device firmware, and mark what needs updating. Book maintenance windows for the coming weeks, preferably at quiet hours. Flag systems the vendor no longer supports too. Old Windows Server versions and outdated PHP installations are ticking time bombs.
3. Backup Policy Review and Recovery Testing
Having backups is one thing. Being able to restore from them is another. According to Veeam, 58% of data recovery attempts fail or only partly succeed.
This January, run a full recovery test of your critical systems. Time how long restoring really takes. Check that backups cover all essential data, including systems deployed last year. Confirm you follow the 3-2-1 rule: three copies, on two different media, one of them offsite.
4. Network Security and Firewall Assessment
A firewall configuration set two years ago probably doesn't match today's needs. New applications, cloud services and partner integrations all change your environment, and the security rules should follow.
Go through the active firewall rules and remove outdated ones. Look through the logs for unusual traffic over the last few months. If you haven't yet, consider a next-generation firewall. Companies with advanced threat detection spot incidents 74 days faster on average than those relying on traditional tools.
Business Systems: CRM, ERP and Integrations
CRM and ERP are the operational backbone of most companies. But even the best software loses value if nobody maintains it or develops it along with the business. Forrester Research reports that companies actively optimising their CRM achieve an average ROI of 245% over three years.
5. CRM Feature Utilization Audit
How much of your CRM does your sales team actually use? Studies show the average company uses only 40 to 60% of its CRM's capabilities. The rest is dead weight: paid for, with no value in return.
Talk to the people who use it. Find the features they skip. Maybe they need better training, maybe the features are simply not needed. Just as important, ask what is missing. Often the function already exists and nobody knows. Or there is a real gap that a custom solution could fill.
6. Data Integrity Verification
Duplicate contacts, old addresses, products in the wrong category: dirty data quietly eats efficiency. McKinsey estimates that employees spend around 20% of their time dealing with poor data quality.
January is a good time to tidy up. Run reports to find duplicate customer records. Check that categories and tags are used consistently. See when key customer contact details were last updated. Consider validation rules at the point of entry. It is an investment that pays back again and again.
7. System Integration Review
The average modern business uses 110 different SaaS applications, and they have to talk to each other. An integration that worked perfectly last year may now throw errors after an update to any connected system.
List every active integration: CRM with marketing automation, ERP with the online shop, HR with accounting. Read the error logs from recent months. Find integrations that depend on deprecated APIs or need manual intervention. Every unstable integration is a possible source of operational problems and of decisions made on incomplete data.
8. ERP Performance and Scalability Assessment
An ERP that coped with 50 employees and 1,000 orders a month may struggle with 150 employees and 5,000 orders. A delay of a few seconds per operation adds up to hours of lost work every month.
Measure response times for key ERP operations and compare them with a year ago. Check whether the architecture can scale, both vertically (more users and transactions) and horizontally (new modules and integrations). If your ERP is ten years old, it may be time for a serious talk about modernisation or migration.
Automation and AI: Are You Getting the Most Out of Them?
2025 was a breakthrough year for AI in business. Still, between the enthusiasm and the real benefits there is often a gap. According to Accenture, companies that implement automation and AI effectively raise productivity by 40% and cut operating costs by 25%.
9. Automated Process Inventory
Do you know how many processes in your organisation are automated, and how well they work? RPA bots and integration scripts set up years ago often run on little more than duct tape and produce silent errors.
Map all your automations: from simple Excel macros, through Zapier or Make integrations, to advanced workflows in dedicated systems. Rate each one for reliability, whether it is up to date and what it is worth to the business. Then list the processes still done by hand that could be automated. That list is your roadmap for 2026.
10. AI Tools Utilization Assessment
Is your team using AI tools, and doing it well and safely? Generative AI is now mainstream, but uncontrolled use carries risks, from leaks of confidential data to bad decisions based on model "hallucinations".
Run a review. Which AI tools are used across the company? Are there rules for using them? Is sensitive data (customer, financial, strategic) protected from being pasted into external models by accident? At the same time, find areas where AI could help but isn't used yet. Customer support, document analysis and sales forecasting are just a few.
11. Process Improvement Analysis
Not every process needs advanced AI. Sometimes simple automation or a better-designed workflow is enough. The point is to find the bottlenecks and the repetitive tasks that eat up people's time.
Ask each head of department to name three processes that take their team disproportionate time. Work out which are repetitive and structured enough to automate. According to Deloitte, well-executed business process automation saves an average of 20 to 35% of time in the first year.
Data, Analytics and Compliance: Legal and Information Housekeeping
Data is the currency of modern business, but its value depends on quality, accessibility and compliance with the rules. GDPR has been in force for years, yet many companies still have gaps, and penalties can reach 4% of global turnover.
12. GDPR and Industry Regulation Compliance Audit
Is your register of processing activities up to date? Do the consent clauses on your website and in contracts match what you really do? Do you know exactly where customer and employee personal data is stored?
You should be able to answer these questions. January is a good time to go through GDPR documentation and procedures. Check that systems deployed in 2025 are covered by your data protection policies. Check data processing agreements with cloud providers. For companies in regulated industries (finance, healthcare, energy), reviewing sector-specific requirements matters just as much.
13. Analytics and Reporting Tools Evaluation
Do the reports you rely on show a true picture? Is the data consistent across systems, or does every department have its own version of the truth? According to Gartner, organisations with a mature analytics culture make decisions 23% faster and get better financial results.
Go through the key dashboards and reports used in the company. Check that data sources are current and complete. Note metrics that should be measured but aren't. Ask whether your analytics tools keep up with your needs. Perhaps it is time for a modern BI tool connected to your CRM and ERP.
14. Data Retention Policy Verification
Keeping data "just in case"? That can get expensive and legally risky. GDPR allows personal data to be kept only as long as needed for the purposes it was collected for.
Review your retention policy. Check whether it is applied in practice. Find data that should be deleted or anonymised. Less data means easier compliance, a smaller risk if there is a breach and lower storage costs.
IT Strategy and the 2026 Budget: Plan with a Purpose
The last item on the list, and perhaps the most important. Technology should support business goals, not live in isolation. Companies that treat IT as a strategic partner rather than a cost centre achieve roughly 20% higher revenue growth.
15. IT Strategy and Budget Allocation Review
Does your 2026 IT budget reflect business priorities? Do technology plans match the company strategy? Is it clear which IT investments are essential, which are desirable and which can wait?
Hold a meeting that brings business and technology people together. Go through the IT projects planned for 2026. For each, set the expected business benefit and how you will measure success. Include not only new implementations but also maintenance, reducing technical debt and developing the team's skills. Leave room in the budget for the unexpected, because technical surprises are the one certainty in IT.
Summary: Your Action Plan for January 2026
An IT review is not a one-off event. It should have a place in the calendar of every organisation that depends on technology. The 15 points above are a framework you can adapt to your own company.
What to take away:
Security and infrastructure need regular checks. Prevention costs a fraction of crisis management.
CRM and ERP pay off only when people actively use and develop them.
Automation and AI are already here, but they need conscious management.
Compliance and data quality are the basis of customer and partner trust.
IT strategy has to follow business goals.
You don't have to do it all in one weekend. Spread the audit across January and involve the right people from each area. The main thing is to start, and to treat the review as an investment in a smooth, productive 2026.
Want a system built around your company's processes? Get in touch. We help from auditing existing systems to CRM and ERP optimisation, automation and system integration, for businesses that want technology working for them, not against them.
