How Small Businesses Can Check If Company Files Are Being Shared Too Widely

When small businesses move to Microsoft 365 or Google Workspace, file sharing usually gets easier very quickly. That is a good thing. Staff can send a link instead of an attachment, work from different locations, and collaborate without waiting for someone to email the latest version across.

The problem is that convenience can slowly create risk.

A file that was shared in a hurry six months ago may still be open to more people than anyone realises. A folder created for one short project may still include an external contact who no longer needs access. A link sent to "anyone with the link" might still work long after the job is finished.

For a busy SME, this kind of oversharing is common. It is usually not malicious. It is just the result of people trying to get work done quickly.

The good news is that this is one of the simplest checks a business can start making.

Why this matters to a small business

When company files are shared too widely, the risk is not only theoretical.

It can lead to:

• confidential quotes or contracts being visible to the wrong person
• HR or payroll information being exposed more widely than intended
• former suppliers, freelancers or employees still having access
• confusion over who should be able to edit, download or forward information
• a harder cleanup job during offboarding, audits or compliance reviews

For a small business in Bolton, Bury or the wider North West, one accidental exposure can mean lost trust, awkward client conversations, or time-consuming damage control.

This is especially relevant if your team relies heavily on shared drives, remote work, mobile access and cloud collaboration. The systems are useful, but they need a little governance around them.

Where oversharing usually starts

In most SMEs, the issue starts with good intentions.

Someone needs to send a file quickly, so they create a link with very open access settings. A manager wants an external bookkeeper or contractor to get what they need, so a folder is shared broadly to avoid back-and-forth. A team creates a shared project area and forgets to tidy it up when the work ends.

Over time, those small decisions add up.

In Microsoft 365, this can happen through OneDrive, SharePoint or Teams-connected files. In Google Workspace, it can happen through Drive folders, individual documents, or links shared outside the organisation.

The real issue is not that sharing exists. The issue is when nobody checks whether the sharing is still appropriate.

A simple file-sharing review checklist

You do not need a large IT department to make a sensible start. A straightforward review can already reduce a lot of unnecessary exposure.

Here are a few good questions to ask:

• Are any important files or folders shared using "anyone with the link" access?
• Are there external contacts who still have access but no longer need it?
• Are sensitive folders limited to the right people only?
• Do staff know when to share view-only links instead of edit access?
• Is there a clear difference between everyday collaboration files and confidential business information?

If you want to go one step further, pick a handful of high-risk areas first:

• finance folders
• HR or personnel files
• director documents
• commercial contracts
• client information

These are often the places where tighter sharing controls matter most.

What good practice looks like

For most small businesses, good file sharing is not about locking everything down so tightly that nobody can work. It is about making access sensible, deliberate and easy to review.

That usually means:

• sharing with named people where possible
• avoiding open-ended public links unless there is a clear reason
• giving view-only access when editing is not necessary
• removing guest access after a project or relationship ends
• reviewing sensitive shared areas on a regular basis

It also helps to decide what your default should be. For example, many businesses are better off with tighter default settings and then making exceptions only when they are genuinely needed.

That approach supports the same principle behind Managed IT Support's advice more broadly: your technology should help the business move quickly, but it should still be managed the right way.

A realistic SME example

Imagine a growing business with 15 staff using Microsoft 365. A director shares a folder with an external marketing freelancer. Later, the freelancer finishes the work, but the access is never removed. Months after that, the folder starts being used for broader internal planning, pricing notes and campaign discussions.

No hack has happened. No dramatic cyber incident has taken place. But someone outside the company may still be able to see information they no longer need.

Now imagine the same pattern repeated across finance, operations and HR.

This is why regular housekeeping matters. A simple monthly or quarterly review can catch issues before they become embarrassing or costly.

What to do next

If you are not sure where to begin, start small.

Choose one platform, such as OneDrive, SharePoint or Google Drive. Review one or two important folders. Look at who has access, how the links are set up, and whether that still makes sense today.

You do not need to fix everything in one afternoon. The aim is to build a simple habit:

1. identify high-value or sensitive folders
2. review who can access them
3. remove old or unnecessary sharing
4. agree better defaults going forward

That one habit can reduce risk, improve handovers, and make your cloud environment easier to manage over time.

If your business is not sure how widely files are being shared today, Managed IT Support can help you review the basics, tighten the risky areas, and make collaboration safer without making day-to-day work harder.