For many small businesses, shared files are simply part of how work gets done. Quotes are stored in the cloud, spreadsheets are passed between departments, and folders are shared with accountants, freelancers, suppliers or former staff during busy periods. It feels normal, and most of the time it...
For many small businesses, shared files are simply part of how work gets done. Quotes are stored in the cloud, spreadsheets are passed between departments, and folders are shared with accountants, freelancers, suppliers or former staff during busy periods. It feels normal, and most of the time it works well.
The problem is that file access often grows faster than anyone realises.
Over time, businesses end up with folders that were shared "just for now", old guest links that still work, or permissions that were never removed after a role change. In Microsoft 365 or Google Workspace, that can quietly create risk around sensitive data, pricing, payroll information, customer records or internal documents.
One of the simplest habits a business can build is this: review who still has access to key shared files and folders on a regular basis.
It is not about making collaboration difficult. It is about making sure the right people have the right access, and nobody else does.
Most access problems do not start with bad intentions. They usually start with convenience.
A director needs to send a folder to an outside bookkeeper. A team member shares a document with "anyone with the link" because they are in a rush. Someone changes job role but keeps access to everything they used to need. A member of staff leaves, but a few shared folders are missed during offboarding.
None of that feels dramatic in the moment. But over a year or two, the result can be a cloud storage setup that nobody fully understands.
That matters because shared files often contain exactly the sort of information a small business cannot afford to expose, such as:
If too many people can access those files, or if old sharing links are still active, the risk is not only cyber security. It can also affect privacy, compliance, reputation and day-to-day control.
Imagine a small business in Bolton with 18 staff using Microsoft 365 and SharePoint. Over time, folders have been shared with ex-employees, outside consultants and personal email addresses so people could "just get the job done". Nobody meant to create a problem.
Then one day, a manager realises that a sensitive pricing folder is still accessible through an old link sent months ago. At the same time, a former contractor still appears in the permissions list for a project folder nobody has reviewed since last year.
There may be no breach yet. But the business is now relying on luck rather than control.
That is exactly the sort of issue a short permissions review can catch before it becomes a genuine incident.
You do not need to check every single file in one sitting. Start with the areas that matter most.
Focus first on folders and systems that contain sensitive or business-critical information, such as:
Then review access with a few straightforward questions:
Look at named users, groups, guests and anyone with an external email address. If you see names nobody recognises, that is worth checking.
Access should reflect the job someone does today, not the role they had six months ago.
"Anyone with the link" settings can be useful in limited cases, but they are easy to forget about. For sensitive business information, tighter controls are usually the safer choice.
This is a common gap after staff changes or short-term projects. If the relationship has ended, access should normally end with it.
Not everything needs to be locked down heavily, but payroll, HR, finance and leadership material should not usually be open to everyone.
Whether your business uses OneDrive, SharePoint, Teams, Google Drive or Shared Drives, the principle is the same: keep sharing intentional.
Good practice usually includes:
This is where managed IT support can make a real difference. A technical review is useful, but so is helping the business create a repeatable process. Your Technology, Managed the Right Way means putting simple controls around everyday habits, not just responding when something goes wrong.
For most SMEs, a quarterly review is a sensible starting point, with extra checks after staffing changes, supplier changes or major projects.
It does not need to become a major admin task. Even a short scheduled review of the most sensitive folders can uncover problems early and keep your cloud environment cleaner over time.
If you are not sure who can access your shared files today, start small.
Pick one important folder this week and check:
That simple exercise often reveals more than expected.
And if your file sharing has grown organically over time, it may be worth having your wider Microsoft 365 or Google Workspace setup reviewed as well. A quick health check can help you tighten permissions, reduce risk and keep collaboration easy for the people who genuinely need access.
For small businesses across Bolton, Bury and the wider North West, that kind of tidy-up is often one of the most practical ways to improve security without disrupting the working day.
Book a free IT review and we'll show you exactly where your current setup is costing you money, leaving you exposed, or slowing your team down. No obligation, no hard sell.
