None of this breaks. All of it expires.
There is a category of problem that gives no signal at all before it happens, which is why it is almost never on anybody's list. The good news is that the list is short, and checking takes minutes.
Almost all of an operation's attention goes to what might break. That makes sense: breaking is loud, somebody complains, there is a cause and there is a fix.
But there is another whole family, and it is silent: the things that expire.
Breaking and expiring are different things
Breaking is an event — something worked and stopped working, for a reason.
Expiring is a date going by. There is no cause, no one to blame, and the system keeps working perfectly until the second it stops. The website certificate is the clearest example: it works perfectly on every day up to the last one, and fails on the next. Nothing along the way gets slow, odd or unstable to warn you.
That is why the routine that catches these things is not the one that catches the others. Looking harder does not help: you have to look earlier.
The list is short
In a small company, nearly everything that expires on its own fits on one page:
Digital certificates and domains. The classic:
a classic oversight that takes down the website, e-mail and invoicing; cheap to check, enormous damage.
Software licences. They expire, and an irregular licence stops being a technical problem and becomes a legal liability.
Supplier contracts. Whatever renews on its own is whatever nobody renegotiates.
Access for people who left. That one deserves its own section.
The access of whoever already left
The question is awkward to ask, which is why it almost never gets asked:
Access review — does whoever left still have access? Any orphaned accounts?
It is not about distrusting former colleagues, and that is worth saying out loud, because it is what stalls the conversation. It is that an active account belonging to somebody who no longer works there has no owner: nobody changes its password, nobody notices if it is used, and it shows up nowhere — precisely because it belongs to nobody.
Add the access your former supplier still has, and the system account created for a project that ended in 2023.
It is the cheapest check on the list: once a month, look at who has access to what, and cut what is left over.
And one that only costs money
This one takes nothing down, it just bleeds:
a subscription nobody uses is a leak.
The subscription taken out for a project, for a person who left, for a trial that went nowhere. Nobody cancels it because nobody owns it — and the card pays quietly, every month, for years.
Checking the actual invoice against what you think you are paying for usually covers the hour spent checking on the very first try.
The difference is routine, not attention
What changes all of this is not somebody paying more attention. It is having something that gets checked without anybody asking — in the source, the name for that is the maintenance of order.
A short list with a frequency next to it. What you look at monthly (access, invoices), what you look at quarterly (certificates, domains, contracts and licences expiring in the next ninety days). None of it requires a new tool, and nobody has to remember: the calendar remembers.
The sign that it is working
Two of them, and both are recognisable:
IT finds the problem before the user does; renewals never come as a surprise.
The first changes the company's relationship with whoever looks after technology — they stop being the person who shows up when something has gone wrong. The second changes the cash: a renewal that surprises you is always accepted, because there is no time to get quotes.
The test
Without asking anybody, answer three:
When does your domain expire? Who was the last person to leave the company, and do they still have access to anything? What was the last subscription you cancelled?
If all three answers are "I don't know", nothing is broken in your company. There are just things expiring, and nobody watching the calendar.