An annual security audit catches gradual security drift — accounts without 2FA, outdated software, or expired subscriptions — before they become real vulnerabilities.
Key Audit Areas
Security doesn’t fail all at once. It erodes one skipped update, one forgotten 2FA prompt, one “I’ll do it later” at a time. An annual audit is the checkpoint that catches that drift before a client asks why an old contractor account still has access to your Google Drive.
Here’s what actually needs checking, and why each one matters more than it looks. None of these require new tools or a subscription — every check below runs on something you already have.
- Password manager — Run the built-in audit that Bitwarden, 1Password, and Dashlane all include. Look specifically for passwords reused across more than one account and anything flagged weak. A single reused password on a low-stakes account — an old forum login or a trial SaaS tool you forgot about — is the entry point attackers use to pivot into your email or bank login.
- 2FA coverage — Check every account that touches money or client data: email, bank, invoicing tool, cloud storage, domain registrar. New accounts get created faster than 2FA gets enabled. This is the check item that drifts the most over a busy year.
- VPN subscription — Confirm it’s active, not expired, and still connecting from the region you expect. A lapsed subscription silently reverting to no protection is common enough that it’s worth a two-minute check.
- Backup verification — Don’t just confirm a backup ran. Restore an actual file from it. An untested backup is a hope, not a backup. This is the single most skipped step because it takes ten extra minutes nobody wants to spend.
- Software updates — OS, browser, and any security tools you run: password manager, VPN client, antivirus. Auto-update should handle most of this, but check it’s actually turned on rather than silently failing in the background.
- Old account access — Revoke access for former clients, past contractors, and any app you connected via OAuth and stopped using. Each one is a door you forgot was unlocked.
- Domain and DNS settings — Confirm your domain registrar account has 2FA enabled and that DNS records haven’t been altered. Domain hijacking is a real, targeted risk for freelancers whose entire business runs through one website and one inbox.
- Email forwarding and filter rules — Check your email settings for forwarding rules or filters you didn’t create. This is a favorite persistence technique: an attacker gets in once, sets up a silent rule that copies invoices or client emails to an external address, then leaves no other trace. Most people never check this because there’s no reason to look unless you’re specifically auditing.
- Third-party app permissions — Go into your Google, Microsoft, or Slack account settings and review every app with OAuth access. Freelancers accumulate these fast: a Zapier automation from two years ago, a scheduling tool you tried once, a browser extension that asked for full inbox access. Revoke anything you don’t actively use.
Simple Audit Template
Block 90 minutes on your calendar, once a year, tied to a date you won’t forget: your business anniversary, January 2nd, whatever sticks. Work through each item below, document what you find, and set a 30-day deadline for fixes rather than leaving them open indefinitely.
| Area | What to check | Time needed |
|---|---|---|
| Password manager | Run built-in audit, fix reused/weak passwords | 20 min |
| 2FA | Verify on email, bank, invoicing, cloud storage, domain registrar | 15 min |
| VPN | Confirm subscription active, test connection | 5 min |
| Backups | Restore one real file to confirm it works | 15 min |
| Software updates | Confirm OS, browser, security tools auto-update | 10 min |
| Old access | Revoke former clients/contractors/unused OAuth apps | 15 min |
| Domain/DNS | 2FA on registrar, verify DNS records unchanged | 10 min |
| Email rules | Check for forwarding/filter rules you didn’t create | 5 min |
| App permissions | Revoke unused OAuth apps (Google/Microsoft/Slack) | 10 min |
Most freelancers find two to four gaps on their first audit. That’s normal — the point isn’t a perfect scorecard, it’s catching drift before it becomes an incident.
FAQ
How long does a thorough audit take?
Typically 1-2 hours once a year for most freelancers with a moderate tool stack.
Should I test my backups regularly?
Yes, an untested backup is not a verified backup — actually restore a file periodically to confirm it works.
What’s the most commonly neglected area?
2FA coverage tends to drift the most, as new accounts get created without enabling it consistently.
What if I find something serious, like an account that was actually compromised?
Change the password immediately, enable 2FA, and check the account’s activity log for anything you didn’t do yourself. If it’s a financial or client-data account, notify the affected party the same day — waiting doesn’t reduce the damage, it just delays the response.
Do I need special tools to run this audit?
No. Everything here uses features already built into your password manager, VPN client, and cloud storage settings. The audit is a process, not a purchase.
Why annual, not monthly?
Monthly checks sound more thorough but rarely survive contact with a busy freelance schedule — they get skipped, then skipped again, until they stop happening at all. An annual audit paired with a recurring calendar reminder actually gets done, because it’s a single fixed appointment rather than a recurring chore competing with client deadlines. If you onboard a major new client or add a new payment processor mid-year, that’s worth a quick unscheduled check on just that account — but the full audit stays annual.
What This Actually Catches
The value of this audit isn’t theoretical. In practice, three findings show up more often than anything else, and each one is invisible until you go looking:
A forgotten client’s Trello or Notion workspace, still fully accessible months after the project ended. Nobody revokes access on their end, and you forget you still have it. It’s not usually malicious risk to you, but it’s a liability if that client ever asks who still has eyes on their internal docs.
A payment processor or invoicing tool with 2FA that quietly got disabled during a device migration. You set up 2FA once, switch phones eighteen months later, the authenticator app doesn’t transfer cleanly, and rather than fix it properly under time pressure, you disable 2FA “just for now.” Then never turn it back on.
A browser extension or automation tool with far more account access than it needs. Something installed for one specific task two years ago, still running, still connected, and you couldn’t say today exactly what data it can see.
None of these show up in a casual glance at your accounts. They show up when you deliberately set aside time to check systematically — which is the entire argument for doing this once a year rather than trusting that you’d “notice” if something were wrong.
Verdict
A simple annual audit prevents the gradual security drift that accumulates silently over a busy freelance year. Audit your tool stack →
