FICTIONAL EXAMPLE / SMALL BUSINESS

Sample Consulting Report

A useful report shows what was checked, what remains unknown and what to do next.

Fictional example, not a customer case study. All scenario details, observations and statements below are invented to demonstrate report structure. No customer work, security result or testimonial is claimed.

Read the example findings

The illustrative brief

An illustrative five-person business uses cloud email, shared files and a public AI writing tool. Its owner wants to understand account access, AI data boundaries and recovery arrangements before adding more automation.

Example scope

  • Discussion with one authorised owner and an illustrative review of two account settings
  • One AI writing workflow and the permissions requested by one proposed connected app
  • A discussion of shared-file backups and the available restore procedure

Outside this example

  • No penetration test, intrusive scan, private message review or compliance certification
  • No review of every staff account, supplier, device, domain or business application
  • No restore exercise, network testing or live settings changes in this example

Findings, with their limits

Priorities below are illustrative decisions, not measured risk scores. None of these examples is evidence about your business.

FINDING 01Address first

One reviewed account has no second sign-in step

Illustrative observation
In this invented scenario, the owner's screen shows no second sign-in step configured for one of the two accounts reviewed.
What this does not establish
Other accounts, enforcement policies and recovery routes were not reviewed. This observation says nothing about whether an account has been compromised.
Why it matters
A stolen password could be enough to access this account, depending on other controls not assessed here.
Suggested next step
Ask the authorised account administrator to review the available multi-factor options, agree a recovery route and enable an appropriate second step without locking out the owner.
Action owner
Account administrator
How to verify progress
With the owner present, check the configured method and an agreed sign-in/recovery path. Record the exact account and result, not a claim about all staff.
FINDING 02Decide before connecting

AI data rules and connected-app approval are unclear

Illustrative customer statement
The fictional owner says staff use a public writing tool, but there is no agreed data rule. A proposed app requests access to shared files; approval has not been given.
What this does not establish
No prompts, customer files or provider contract were inspected. This is an unresolved permission decision, not evidence of a data leak.
Why it matters
Staff could expose business information or grant wider access than intended if the permitted use and approval route remain unclear.
Suggested next step
Name an approval owner, define allowed data and output checks, and review the actual supplier terms and requested permissions before connecting the app.
Action owner
Business owner
How to verify progress
Record the approved tool/account, permitted workflow, data boundaries, permission decision and review date. Do not test the workflow with real confidential data.
FINDING 03Plan a recovery check

File recovery has not been demonstrated

Not tested
The fictional owner reports that files sync to cloud storage. No separate backup inventory or completed restore record is available in this example.
What this does not establish
No restore was attempted. The report cannot conclude that recovery will succeed, fail or meet a particular recovery time.
Why it matters
The business does not yet have demonstrated recovery evidence for the files it depends on.
Suggested next step
Identify important data and available recovery options, then agree a non-destructive restore exercise with the responsible provider using a suitable test file.
Action owner
Business owner and IT provider
How to verify progress
Record the source, restored test file, destination, date, integrity check and limitations. A successful sample restore would not prove recovery of every file or service.

A short action plan

  1. Address first

  2. Decide before connecting

  3. Plan a recovery check

    File recovery has not been demonstrated

    Owner: Business owner and IT provider

In a paid review, the written report covers the scope agreed in your quote and is delivered within 5 working days of the review. The included follow-up call works through priorities; it is not ongoing monitoring or automatic implementation.

Choose the right review

This example shows the format, not a universal checklist. Home reviews cover everyday technology; family reviews include a family safety plan; small-business reviews focus on agreed tools, access and recovery. Start with a scoping call before agreeing paid work.