Key-Person Risk

Key-person risk is what a business carries when something important depends on one individual. If they left, retired, or were ill for a month, the business would not simply be short-handed. It would be unable to do something.

In technology it usually shows up in two forms: the person who understands how a system works, and the person who holds the access to it.

Why it is different from being short-staffed

Short-staffed is a capacity problem, and capacity can be bought. Key-person risk is a knowledge problem, and knowledge cannot.

The test is not whether the work would pile up. It is how long a competent replacement would take to reach the same standard. If the honest answer is measured in months, that is structural rather than inconvenient.

Where it hides

The undocumented system. One person knows why it was built that way, which parts are fragile, and what the workaround is when it fails at month end.

The pricing logic. Not the price list. The reasoning: the real floor on each job type, which customers absorb more time than they pay for, when to walk away. This is usually the single most valuable undocumented thing in a business.

Exception handling. Every business has a standard process and a set of cases where it does not apply. The standard process is documented. The exceptions are not, because experienced people handle them without noticing they are exceptions.

The access. Domains, hosting accounts, admin credentials, the app store login. Frequently held by one person or one supplier, and discovered only when it is needed urgently.

How to price it

It is an exposure rather than an annual cost, and it belongs in a business case separately rather than buried in a running total.

A workable approach: estimate how many weeks the business would run at reduced effectiveness, then price those weeks against the gross profit they influence. Six weeks at 15 per cent reduced throughput, on a business doing £30,000 of monthly gross profit, is roughly £6,750 sitting on the balance sheet that nobody has written down.

Reducing it

Documentation helps less than people expect, because nobody writes the useful part. What works better is recording decisions rather than processes: for each judgement call only that person could make, capture the situation, the options, what they do, why, and what would change their mind.

That last field is the one that lets a successor handle a case the original person never saw. And the whole exercise is far easier when the person is five years from leaving than six months.