It’s not a problem until you try to get access to Meta and can’t. Or you need to update a Google business listing and nobody knows who controls it. Or you realise a former staff member still has access to client files because, somewhere along the way, everyone started using personal Gmail accounts.
I have yet to come across a business that doesn’t have some version of this. It can touch far more of the business than anyone expects, and it doesn’t only happen in businesses that are badly run.
Usually, people were getting on with the job. Someone needed to share a file, set up an advertising account or get the business onto Google. They used what was available, it worked, and there were plenty of other things to worry about. Nobody was sitting there thinking about how the arrangement would look five years and three staff changes later.
Then the business grows. A supplier sets up Google Ads. Files end up in Google Drive, while another part of the team is working in Microsoft 365, SharePoint or OneDrive. There might be an old Google Business Profile from a previous location, or a duplicate listing nobody remembers creating. Each has a history, and that history can include people who no longer work for the business.
The business may know it uses all these services without knowing how they are connected, who set them up or who still has access. Sometimes nobody even knows an account exists. Finding the person who might know about it becomes a job in itself.
I also think the tech giants deserve some of the blame here. In my experience, their account models have never been particularly clear, the documentation has often been more frustrating than helpful, and things keep changing. You can be trying to do the right thing and still struggle to work out what that is supposed to look like.
Want to understand what best practice is for setting up staff access to Meta accounts? Good luck.
That’s my frustration with the experience of dealing with these systems. The people running a business have other work to do. It’s hardly surprising that a setup which lets everyone get on with that work can stay in place long after anyone has thought about whether it still makes sense.
And while it works, there’s very little to draw attention to it. The ads run. The files open. The listing appears when someone searches for the business. Then a person leaves, a supplier changes or a login stops working, and suddenly the questions become urgent.
Who actually owns this? Who can administer it? Where does the recovery email go? The business might be paying the bill without being the party that can regain access. Those are different arrangements, even if they’ve all been treated as ‘our account’ until now.
This is why the ‘bus crash test’ needs to go further than asking who would cover someone’s job. If that person were suddenly unavailable, would the business know enough to keep operating? That’s difficult to answer when it doesn’t know which accounts exist, who controls them or who might have the missing information.
That’s the reason I think a business continuity audit is worth doing before something stops working. For the digital side of the business, it gives us a chance to understand what the business relies on and where its understanding of those arrangements is incomplete.
The work includes finding the accounts and services in scope, understanding what they support, and untangling ownership, administrative access and recovery arrangements. It also means looking at the people and suppliers involved, including those who have moved on. An answer we can’t establish matters too, because that uncertainty is part of the exposure.
The useful result is a clearer picture and recommendations the business can make decisions about. An audit won’t magically get an account back or fix years of accumulated setup. It can make the problem visible while there’s still an opportunity to deal with it without an interruption forcing the issue.
That’s the work we’re talking about when we offer a business continuity audit at Integral Media. The next article is about what happens after it: deciding what needs attention and turning the findings into work that actually gets done.
