In Brief: Key-person risk is the exposure a business carries when one individual holds knowledge, relationships or access that nobody else has. In most SMEs that person is the owner, but it is often a long-serving manager too. You reduce it by spreading knowledge, documenting work and putting cover in place before anyone leaves.
Every small business has someone it cannot do without. The person who knows how the pricing really works. The one the biggest customer always phones. The only person with the password to the accounts software. While they are there, it feels like strength. The day they are ill, resign or retire, it becomes the biggest risk the business has.
Key-person risk rarely shows up on a risk register because it does not feel like a risk. It feels like having a good team. That is exactly why it catches so many owners out.
This is part of our guide to reducing owner dependency.
What ‘key-person risk’ actually means
Key-person risk exists wherever losing one individual, suddenly or gradually, would materially damage the business. That damage usually comes in one of four forms:
- Lost knowledge: how things are done, why decisions were made, and where things are kept.
- Lost relationships: customers, suppliers or partners who deal with that person, not the company.
- Lost access: passwords, bank mandates, software admin rights, domain registrations.
- Lost capacity: work that simply stops because nobody else can do it.
The person does not have to be senior. A bookkeeper who has run the same system for fifteen years can be as critical as a sales director.
Why the owner is usually the biggest key person
In most SMEs, the owner is the single largest point of failure. They hold the important customer relationships, approve every significant decision and often carry the most knowledge about how the business works.
That matters for two reasons. First, if the owner is suddenly unable to work, the business can stall within weeks. Second, when the owner eventually wants to sell, a buyer will see the dependency and either lower the price or push more of it into an earn-out. We cover that in What Makes a Business Sellable?
How to spot key-person risk in your business
Work through these questions honestly. Each “yes” points to a dependency.
| Question | What a “yes” tells you |
|---|---|
| Is there a task only one person knows how to do? | Knowledge is concentrated. |
| Does a customer only ever speak to one person? | The relationship may leave with them. |
| Is any login, bank mandate or admin right held by one person alone? | Access could be lost overnight. |
| Would work stop if someone were off for a month? | Capacity has no cover. |
| Is anyone’s job description “they just handle it”? | The role has never been written down |
| Has someone said they could not take a proper holiday? | The business is relying on them not leaving. |
A simple way to map it is to list your top ten customers, your top ten processes and your critical systems, and write the name of whoever holds each one. Where the same name keeps appearing, you have found your risk.
Six ways to reduce key-person risk
1. Document what lives in people’s heads
Start with the processes that would cause the most damage if they stopped. A short written checklist, a screen recording or a flowchart is enough to begin with. Our guide to building an operations manual shows how to do this without it becoming a project nobody finishes.
2. Cross-train deliberately
Every critical task should have at least one other person who can do it, even if more slowly. Build this into the working week: the backup person shadows, then does the task while the expert watches, then does it alone. Holidays are the ideal time to test it.
3. Share the relationships
Introduce a second contact to every important customer and supplier. Copy them into emails, bring them to meetings and let them handle some routine contact. The aim is for the customer to feel they deal with the business, not with one person.
4. Lock down access
Make sure the company, not an individual, owns its domain names, software accounts and social media profiles. Every critical system should have at least two administrators. Keep a secure, up-to-date record of who has access to what, ideally in a password manager the business controls. The cybersecurity basics guide covers the practical side.
5. Delegate decisions, not just tasks
If every decision still comes back to one person, cross-training only goes so far. Agree on clear limits on what others can decide on their own, for example, spending up to a set amount or agreeing to a discount within a range. See Delegation Without Losing Control for a way to do this safely.
6. Put formal cover in place
Some risks cannot be removed, only protected against. Options include:
- Key person insurance: pays the business a sum if a named person dies or becomes seriously ill to cover lost profit or the cost of recruiting.
- Shareholder protection: helps the remaining owners buy the shares of a co-owner who dies or becomes critically ill, usually backed by a cross-option agreement.
- A business lasting power of attorney: lets someone you trust make decisions for your business if you cannot.
- Notice periods and restrictive covenants: sensible contract terms give you time to hand over work and protect customer relationships when someone leaves.
The tax treatment of key person insurance depends on how the policy is set up, so check it with your accountant before you buy.
Key-person risk is not just about people leaving
Most owners think of key-person risk as sudden loss: illness, an accident, or a resignation. In practice the slower version does more damage. A key person who is overloaded becomes a bottleneck. Work queues behind them, decisions wait, and the rest of the team learns to stop trying. The business grows only as fast as that one person can work.
Reducing the dependency therefore does more than protect you from bad luck. It frees capacity, speeds up decisions and gives your best people room to do higher-value work, including you.
A 30-day starting plan
- Map your top customers, processes and systems against the names who hold them.
- Pick the three dependencies that would hurt most and document one of them this month.
- Add a second administrator to every critical system and bank mandate.
- Introduce a second contact to your three largest customers.
- Review whether key person insurance or shareholder protection makes sense for you.
FAQ
What is key-person risk?
Key-person risk is the damage a business would suffer if one individual left or became unable to work, because they hold knowledge, relationships, access or capacity nobody else has.
Is key-person insurance worth it for a small business?
It can be, particularly where the business would struggle to survive the loss of a founder or senior figure. It does not fix the dependency, though. It buys time and money while you deal with the consequences.
How do I reduce my business’s dependence on me as the owner?
Document the work only you do, delegate decisions within clear limits, share customer relationships and build a second layer of people who can lead. Our guide to reducing owner dependency sets out the full approach.
Does key-person risk affect business value?
Yes. Buyers and investors see heavy reliance on one person as a threat to future profit, which usually means a lower price or more of the price deferred.
Not sure where your risks sit?
A business review gives you an evidence-based view of where your business depends on too few people and what to fix first. If day-to-day admin and staffing are the pressure points, our business administration support can help you build the routines that spread the load.
Want a quick starting point? Try our free 10-minute SME business health. Check or book a free consultation.
