You are asking for a comprehensive list of security concerns that a company might face. This question is way too broad to be answerable because security is a huge and ever changing field. That said, I'll try to give an answer that at least introduces the size of the problem.
Just thinking about software for the moment - you should start your security review by listing every operating system (including version and patch number) that you're running in your company. Now list every piece of software that's running (Including version and patch number), now look up that entire list on https://cve.mitre.org or elsewhere for known vulnerabilities against those versions of those softwares. Now what about patching: do you have procedures in place to make sure your software stays up to date? What about configurations: have you introduced any vulnerabilities because of the way you've configured your software? (Active port scans and things can detect some of these problems, but not all). Anyway, the list goes on...
And that's just software. You should do similar things for hardware (ex. telephone and network routing equipment), physical access (ex. which rooms contain sensitive info? What are the door locks like? Who has access? Do you log or record who enters? etc), and people (ex. what security training do you provide your employees? Do you have checks-and-balances in place?).
Finally, I'll address your point that you're a small company. The only way the above differs for a small company compared to a Fortune 500 is in the amount risk: the amount of effort that you expect an attacker to spend on you, and the amount of the damage if there is a breach, and the complexity of an audit: bigger companies just have more machines, people, and data to secure