Key Person Risk: When One Person Is the Process
Ask a room of small-business owners what happens if their best person is unreachable for a month and you get nervous laughter. Ask what happens if the owner is unreachable for a month and the laughter stops. Key person risk — sometimes called the bus factor — is the most common and least addressed single point of failure in small business.
A process only one person can run is not a process. It is a dependency with a nice personality.
How to spot it
You are carrying key person risk anywhere you can tick one of these:
- Only one person knows the steps — payroll, quoting, the weird export the accountant needs.
- Only one person holds the access: passwords, admin rights, the bank token, the keys.
- Only one person holds the relationships — the supplier who answers their calls, the client who deals only with them.
- Work visibly stalls when a specific person takes leave.
- Nobody can say where a job is up to without asking a specific person.
The owner usually tops the list. Being irreplaceable feels good right up until you need a fortnight off.
Reducing it, in order of effort
- Write the runbook. For each critical task, a dated, step-by-step document with screenshots, stored where the team can find it. The test is brutal and simple: could a competent person who has never done the task complete it using only the document?
- Share the access properly. A business password manager with shared vaults beats a spreadsheet of passwords, and beats one person's memory by a country mile. The Australian Cyber Security Centre (cyber.gov.au) recommends password managers and multi-factor authentication as baseline small-business controls.
- Cross-train deliberately. Once a quarter, the backup person actually runs the task — payroll included — while the usual person watches and corrects the runbook.
- Split the relationships. Introduce a second contact to key suppliers and clients before you need one.
- Rehearse the absence. The real test is a planned holiday. Send the key person on leave and forbid the team from calling them. What breaks becomes your to-do list.
A simple coverage map
A coverage map makes the risk visible on one page. List critical tasks down the side, people across the top, and mark who can run each task today without help. The gaps jump out immediately.
| Task | Owner | Backup | Runbook? |
|---|---|---|---|
| Payroll | Sam | — | No |
| Quoting | Alex | Sam | Yes |
| Supplier orders | Alex | — | No |
| Banking | Owner | — | No |
Every row with a dash in the backup column is a business risk with a name. Two dashes in one row — no backup, no runbook — is where you start. Redo the map twice a year; it takes ten minutes and it keeps cross-training honest, because the goal is simply fewer dashes each time.
The owner's version
For owners, key person risk shades into succession territory: who can operate the bank account, pay wages and speak to the accountant if you are suddenly out of action? A short “if I am off the grid” note — where the runbooks live, who has authority for what, who to call — stored with your continuity one-pager, is one of the highest-value documents you will ever write. Your accountant and solicitor can advise on the formal side, including business powers of attorney.
FAQ
Is key person risk only about staff leaving?
No. Leave, illness, injury, burnout, jury duty and resignation all trigger it. The mitigation is identical for every version: documentation, shared access and cross-training.
What if the key person resists documenting?
Sometimes knowledge is held tightly because it feels like job security. Frame the runbook as promotion insurance — nobody can move up if nobody can take over their current job — and make documentation part of the role, not a favour.