Key Person Dependency

A founder may be the only person trusted by major customers, and an engineer may alone know how to restart a core system, so in each case normal work depends on one person's availability. The person need not be senior, so identify dependency by the work that stops, not by job title.

An absence can be temporary or permanent, and leave, illness, departure and retirement all test the backup plan, so a business should not wait until the person resigns to learn what they do. Nationwide's risk guidance recommends identifying essential roles and planning for their absence, and it suggests documenting work, cross-training, possible outside support and continuity plans.

Those are practical controls, not guarantees that disruption disappears. List critical activities and ask who can perform each today, checking who holds customer context, system access, supplier relationships and decision rights.

If the answer is one name throughout, investigate the exposure. A fictional manufacturer has one technician who knows a custom machine, and although a replacement part is available, production stops when that person is away because nobody else can diagnose a fault, so stock alone does not solve the dependency.

Assess the impact and recovery time as well, since a task performed monthly may still be critical if missing its deadline stops payroll or reporting. Customer concentration and person dependency can overlap, since a business may rely on one salesperson for a large account while the account itself is a separate concentration risk, so record both rather than hiding them in one label.

A succession plan addresses who can take over a role, and the Australian government's business guidance also recommends documenting processes and preparing for sudden transitions. A named successor needs training, time and authority to act, and cross-training works best when tested by asking a backup to complete a task while the key person is available to coach.

Share relationship knowledge appropriately through joint customer meetings, a shared contact record and clear handovers, respecting confidentiality and the customer's expectations. Important credentials should not remain in one person's private notebook, so use an approved access and recovery process with controls that preserve security rather than widely sharing passwords.

An outside specialist can cover a niche skill if a second employee is not practical, but confirm the specialist's availability, permissions, service terms and access before an emergency, because an untested vendor name is not a backup plan. Continuity planning should describe who authorises payments, answers key customers and makes urgent technical decisions during an absence, and a short, tested chain of responsibility is more useful than a vague promise.

A fictional founder handles every large client complaint, and after a two-week absence delays responses the firm assigns an account lead and documents escalation thresholds, keeping the founder involved in major decisions but removing the single point of failure. Measure exposure with care, because the share of revenue tied to relationships controlled by one person is a useful estimate but not a universal risk formula, and insurance may help with some financial consequences of losing an insured key person but does not transfer knowledge, reassure a customer or operate a machine.