Everyone backs up. Almost nobody tests a restore. Pick one critical financial file today and actually try to pull it back from your backup. If you can't open it, you don't have a backup, you have a false sense of security.
Most SME owners assume that because they run Xero or Sage, their financial data is untouchable. Those platforms are genuinely secure, but human error, ransomware and integration failures are real, and none of them care how good your software is. If a staff member overwrites a pricing model or deletes a payroll file, an automated backup will often quietly save the corrupted version too. The backup exists. It's just useless.
A backup and restore SOP for your South African business only earns its name once someone has actually pulled a file back and confirmed it opens, matches, and works. The restore is the only step that proves anything.
The damage isn't abstract. When a system goes down, someone has to stop generating revenue and start manually rebuilding lost invoices, and every hour spent on that is an hour eaten out of your margin. It also exposes the gap between paper profit and real cash: your management accounts might look healthy, but if your billing system is corrupted and you can't issue statements, collections stop immediately. Your debtors book is an asset too, and if the data behind it disappears, so does your ability to prove what's owed to you.
Start by naming your genuinely critical files: payroll data, your debtors ledger, signed contracts, pricing models. Anything that would stop the business cold if it vanished tomorrow belongs on the list. Back these up across more than one location, ideally a cloud backup plus an offline or off-site copy, since a single point of failure defeats the purpose.
Then write down who is responsible for the restore, what credentials or encryption keys they'll need, and how often the test happens. Quarterly is a reasonable minimum. Track your recovery time too: if it takes three days to get operational systems back up and your business runs on roughly R10,000 of daily operating profit, that's R30,000 gone before you've fixed anything.
List your critical files. Payroll, debtors, contracts, pricing, and anything else that would stop trading if it disappeared.
Set up layered backups. Cloud accounting backup plus at least one independent copy, cloud or physical, stored separately.
Assign the restore. One named person owns the quarterly test restore, with documented access to whatever passwords or keys are required.
Time it. Measure how long a full restore actually takes, and treat that number as a KPI you're trying to shrink.
Yes, but automatic backups protect against server failure, not against a user overwriting or deleting the wrong file. A tested restore process protects against both.
Quarterly is a sensible minimum for most SMEs, with an additional test after any major system change or migration.
It matters more the smaller you are, since a small business rarely has the spare capacity to absorb days of lost operational data without real cash flow damage.
A backup nobody has tested is a guess dressed up as a safety net. Build the SOP, assign the restore, and time it, so the day you actually need it, it works. For more on protecting your financial systems, see our blog.
Need expert tax and accounting support? The Compliance Clinic helps South African businesses stay compliant, reduce tax liabilities, and grow with confidence. Contact us today | View our services
A brief from the lead partner — what changed at SARS this month, one practice note, one decision-trigger to watch. Unsubscribe in one click.
