Google Apps was used at the last 3 companies I have been involved in. At one company, we had a bad problem with Google Apps. If this problem happens to you it could get you in big trouble. While doing some auditing and security work, I discovered a second bad problem with Google Apps.
Problem number 1: You need backups. Google's highly redundant self healing magical SaaS technology does not protect you from yourself, it only protects you from Google. If you or someone at your company accidentally or maliciously deletes a bunch of important business documents, they are gone. Google cannot help you get those documents back. If you think about this for a minute, it makes sense - if Google held onto confidential business data after you ordered them to delete it, nobody would want to use them. Nearly everyone I talk to who is using Google Apps overlooks the fact that they need backups, and are vulnerable to severe data loss. There are add-on services for Google apps that solve this problem, and provide you with auditing capability for the backups - I have used Backupify at two companies and it's worth every penny. Employees can then self-service restore their own data, and administrators can recover data as well.
Problem number 2: If you have more than 1 person enrolled in your Google Apps organization, it is impossible to audit how documents are shared. Sharing documents with Google Apps is very easy, but when you've been using it for a couple of years nobody will remember what they have shared and whether it that level of sharing is still appropriate. Discovering that confidential financial information or trade secrets are accidentally shared with the public could be a major security breach. Recently I started using another add-on called CloudLock. CloudLock will scan your organization and generate reports of what is being shared, as well as run a content policy engine to warn you if there are documents that contain sensitive information such as credit card numbers, social security numbers, or other information that needs to be carefully safeguarded. Often data misuse is accidental rather than malicious. Not performing audits is sloppy and can get you big fines and/or fired.
Setting up backups, audits, and content policy checking only takes about 30 minutes and dramatically changes your risk profile for using Google Apps. Do it today.