Key-Person Risk: When Your Business Depends on One Person
Here is a question worth asking in your next management meeting: if one person in the business went on leave for a month, starting tomorrow, what would stop?
In many small and mid-sized businesses the honest answer is "a lot". Payroll runs through one person. Supplier payments need one person's approval. The biggest client relationship sits with one person. The password to the main system is in one person's head. Nobody planned it that way. It happened because that person was capable, reliable and always there.
This is called key-person risk, and it is one of the most common hidden weaknesses in growing businesses. It rarely shows up until someone is ill, resigns, or simply takes a well-earned holiday.
Why it happens
Key-person dependency is not a sign of a bad employee. Usually it is the opposite. Good people take on more, solve problems quickly and build their own ways of working. Over time the knowledge lives with them rather than in the business.
Common causes include:
- Processes that were never written down because "it only takes five minutes"
- One login shared by nobody, or shared by everyone without control
- Client relationships managed through one person's phone and inbox
- Approvals that depend on a single signatory
- A founder who still does critical tasks personally
What it costs
The cost is not only the disruption when someone is away. Key-person risk also slows growth, because every new task has to queue behind the same person. It makes it harder to sell or raise investment, because buyers and investors discount businesses that depend on individuals. And it quietly increases the risk of errors and fraud, because nobody else understands the process well enough to spot a problem.
It also affects the person at the centre. People who cannot take a real holiday without being called burn out, and burned-out people leave.
Step 1: List every single-person task
Start with a simple spreadsheet. For each person, list the tasks that only they can do. Be specific: "run fortnightly payroll", "approve supplier payments over a set amount", "reconcile the main bank account", "renew the software licences". Ask each person to add to their own list, because they will know things you do not.
Then rate each task on two questions. How often does it happen? And what breaks if it does not happen on time? Payroll scores high on both. An annual licence renewal scores low on frequency but can be very disruptive if missed. This gives you a priority order.
Step 2: Write a one-page checklist for each task
You do not need a thick procedures manual. For each high-priority task, write one page in plain language:
- What the task is and why it matters
- When it needs to happen
- Which systems and files are used
- The steps, in order
- Common problems and what to do about them
- Who to contact if something looks wrong
A useful test: could a capable person who has never done this task follow the page and get it right? If not, it needs more detail. Screenshots and short screen recordings help a lot.
Step 3: Train a backup and let them do it for real
A written checklist is a start, but it is not proof. Pick a backup for every critical task and have them run it, for real, at least once a quarter while the main person watches. The first time will be slow and will expose gaps in the checklist. That is the point. Update the page after every run.
For the most critical processes, such as payroll and payments, consider rotating the task permanently so two people do it in alternate cycles. It keeps both people current and adds a natural second pair of eyes.
Step 4: Control access and passwords properly
Many businesses discover their dependency only when they cannot log in. Move business accounts into a shared, controlled password manager with role-based access. Make sure at least two people hold admin rights on critical systems such as banking, accounting software, email and your website. Use named user accounts rather than shared logins, so you can see who did what and remove access cleanly when someone leaves.
Keep an up-to-date list of every system the business uses, who the admins are and when subscriptions renew.
Do not forget relationships
Knowledge is not only about processes. If one person holds every conversation with your biggest client or supplier, introduce a second contact. Copy a colleague into key threads, hold joint review calls, and keep notes in a shared system rather than a personal inbox. Clients generally appreciate having a backup contact.
A simple test
Once a year, ask each key person to take two weeks fully offline. No calls, no email. Whatever breaks during those two weeks is your to-do list for the following quarter. It is far better to find the gaps on your own schedule than in an emergency.
Frequently asked questions
What is key-person risk?
The risk that a business cannot operate properly if one specific person is unavailable, because critical knowledge, access or relationships sit only with them.
How do you reduce key-person dependency?
List tasks only one person can do, document them in simple checklists, train a backup who runs each task regularly, and put system access in a shared, controlled password manager.
Does key-person risk affect business value?
Yes. Buyers and investors usually see heavy reliance on one person as a risk, which can reduce what they are willing to pay.
The bottom line
Key-person risk is not a people problem. It is a process problem. A business that cannot run without one person is not really a business yet. It is a job, and a fragile one. List the single-person tasks, write them down, train a backup and control access. None of it is complicated, and every step makes the business stronger, more valuable and easier to grow.