Key Person Risk: A Checklist to Find Single Points of Failure

More likely than most founders assume. The BLS reports median employee tenure of 46.8 months, about 3.9 years, for all wage and salary workers¹. In leisure and hospitality the median is only 25.2 months¹.

Those numbers cover people who leave for any reason, but they make a point: assuming everyone will stay indefinitely is not a plan. Even a loyal employee can become unavailable for a few weeks. Your goal isn't to distrust your team. It's to make sure nothing important lives in only one head.

Go through these five categories for every person in a critical role, including yourself:

• Knowledge. Do they know something that isn't written down, such as how to reconcile a report, what a vendor really agreed to, or why a system is configured a certain way?
• Access. Do they alone hold admin rights, passwords, or ownership of an account, domain or vendor portal?
• Relationships. Do customers, suppliers or partners deal only with them, and would those relationships survive without them?
• Decisions. Do people wait for them to approve routine choices that others could make?
• Skills. Is their skill rare or slow to hire for, so replacing it would take months?

Write each finding as a plain sentence, such as "Only Dana can run the month-end inventory count." Vague worries can't be fixed. Specific sentences can.

Give each finding two scores from 1 to 3. Impact asks what happens to customers or revenue if the person vanished tomorrow. Replaceability asks how long it would take someone else to do it competently. Multiply the two, and work down the list from the highest score.

In this example, say Dana alone runs the month-end inventory count. Impact is 3, because reports and purchasing depend on it, and replaceability is 2, since a trained colleague could learn it in a couple of weeks. The score is 6, and it goes near the top. A finding that scores 2 can wait.

Look at your own role first. Founders are often the biggest single point of failure, because they hold customer relationships, approvals and unwritten knowledge all at once. Getting that knowledge out of your head and into a written procedure is the first fix.

Match the fix to the size of the risk:

1. Write it down. Record the procedure as a short checklist or screen recording, and store it where others can find it.
2. Share access. Move accounts to shared or company-owned logins with a second admin and a password manager.
3. Name a backup. Assign a second person for each critical task, even if they handle it only occasionally.
4. Cross-train. Have the backup do the task under supervision once a quarter so the skill stays fresh.
5. Rotate ownership. Let the backup run the task for a month while the primary is on vacation, which doubles as a test.
6. Restructure or hire. If a role is too heavy for one person, split it or add capacity.

A useful test is the two-week vacation. If someone can go offline for two weeks and nothing important breaks, you've reduced the risk. If you get calls every day, the documentation isn't good enough yet.

Turn the list into a routine. Review it twice a year and after any departure, promotion or reorganization. Add a step to your onboarding and offboarding processes so that access and documentation are handled when people join or leave.

Tools help with the repeatable parts. A training tool such as Trainual keeps role playbooks and cross-training material in one place, and a checklist tool such as Process Street turns each written procedure into a runnable list with an owner and a due date. To compare them, read the guide on checklist and training tool comparison.

Tie the exercise into your other reviews. The operations audit checklist is a good home for a yearly key person review, the business continuity plan template covers what to do if a person and a system fail at the same time, and the vendor onboarding checklist helps you avoid vendor relationships that also run through one person.