Ask a small business whether they have backups and the answer is usually yes. Ask when the backup was last restored and the answer is usually silence. Those are two different questions, and only the second one tells you anything. A backup is not a copy of your files; it is a claim that the files can be brought back in a usable state, and that claim stays unverified until somebody actually tries it.
The gap between the two is wider than it looks. Backups fail quietly in ways that leave every indicator green. The scheduled job runs, reports success and writes nothing, because the folder it was pointed at was renamed a year ago. The copy completes but captures the database while it was mid-write, so the file exists and is corrupt. The archive is intact but encrypted with a key nobody wrote down. In each case the dashboard says the same word - done - and the word is true about the job and false about the data.
What makes this specific to small businesses is that nobody owns the check. Larger organisations have someone whose job includes opening a backup and looking inside. In a business of four people the backup was set up once, by whoever was most technical, possibly by someone who has since left, and it has been reporting success ever since. Success reported for two years is not evidence of two years of working backups; it is evidence of two years of nobody looking.
The test is unglamorous and takes an afternoon. Pick one real file that you would genuinely miss, delete it from nowhere, and restore it from the backup into a separate folder. Open it. Check the contents are current rather than a version from months ago. Do the same for the thing you would need most in a disaster - usually the accounts, the customer list and whatever holds your quotes - and note how long each restore took, because in a real incident the question is not only whether the data comes back but whether it comes back today or next week.
Two other things fall out of that afternoon. You learn where the copy lives, which matters because a backup on the same machine as the original protects you from deletion and from nothing else. And you learn whether you can perform the restore yourself, or whether it depends on one person's access, one person's memory, or an account that is billed to a card that expired. A backup you cannot reach is the same as no backup, and it looks identical until you need it.