How to reduce key-person risk in your firm

Key-person risk is bigger than “what if the owner is hit by a bus”

Ask a firm owner about key-person risk and most will talk about themselves — usually in the third person, usually with a slightly uneasy joke about being hit by a bus. That framing is not wrong, but it is too narrow, and it lets a firm feel it has thought about the problem when it has only thought about one version of it.

The owner is one key person. A firm of any size has several more, and they are often harder to spot because their absence does not stop the whole business — it stops one thing, quietly, until someone needs it. The senior manager who is the only person a difficult group-structure client will really deal with. The bookkeeper who set up the payroll software and is the only one who knows why three clients are configured the way they are. The one person with admin rights to the practice-management system. The sole nominated money laundering reporting officer, with no deputy named anywhere. None of these people think of themselves as a single point of failure. They are simply the person who did it first, got good at it, and was never asked to write it down.

The common thread is not seniority, it is documentation. A managing partner who has trained a deputy and written down their decision rules is lower risk than a junior administrator who is the only person who remembers the password to the online filing portal. Key-person risk is a property of what is undocumented and unshared, not a property of job titles — which is why a risk register built around roles, rather than around the owner alone, finds far more of it. It is closely related to the dependency problem covered in how to make your firm less founder-dependent, but it is not the same thing: a firm can reduce founder dependency significantly and still carry serious key-person risk two or three layers down, in the people the owner has come to rely on instead.

Build a key-person risk register

A risk register sounds like a compliance exercise. In practice it is one page, built in an afternoon, and it is the single most useful artefact most firms never make. List every role that carries concentrated knowledge or authority, not just people. Score each one honestly rather than optimistically — the point of the exercise is to find the gaps you have been quietly living with, not to confirm the firm is fine.

Five rows like this, honestly filled in, usually surface two or three risks a firm did not know it was carrying — the register above puts the MLRO gap and the system admin login on the same page as the owner, which is exactly the point. Rank the rows by impact, not by how uncomfortable each one is to look at, and work down the list. A single admin login with no documented recovery process is often cheaper to fix than the owner’s workload, and fixing the cheap ones first builds the habit of maintaining the register at all.

Two columns matter more than they look. “Who could cover tomorrow” is the test of whether documentation exists anywhere outside one person’s head — if the honest answer is a name with no training and no notes, that is not cover, it is a hope. And “impact if unavailable for a month” forces a genuine month rather than the more comfortable assumption of a two-day illness, because a month is roughly what a serious illness, a resignation with garden leave, or a family emergency actually takes.

Worked example: the real cost of one unplanned absence

The figures below are illustrative — an invented ten-person firm, not a client of ours — costed at £150 an hour for owner time and £60 an hour for staff time, consistent with the other worked examples on this site. A senior manager who is the sole point of contact for 40 clients is off sick, unexpectedly, for three working weeks in late January.

£4,530 for one absence is the visible number, and it understates the real difference. In the undocumented version, some of those 40 clients experience a genuine service gap — a query that goes unanswered for a week, a deadline that slips, a query handled by someone reading the file cold. That is goodwill risk rather than a line item, and it tends to surface months later as a client who quietly moves elsewhere, which no spreadsheet captures at the time. The documented version is not free — someone still has to cover the work — but the absence becomes an inconvenience rather than an incident.

How to reduce key-person risk, in order

Closing every gap on the register at once is not realistic and is not the aim. Work through it in the order below, because each step makes the next one cheaper.

• Write down what is only in someone’s head. Not a full manual — the specific, non-obvious knowledge that would take a replacement weeks to reconstruct: why a client’s payroll is configured a certain way, which supplier contact actually answers the phone, the three things a group-structure client always gets wrong. This is the same discipline as building SOPs in an accountancy practice, applied narrowly to the highest-risk rows on the register first rather than to the whole firm at once.
• Give every important client relationship a second name. Not a second lead — a second person the client has met, who has sat in on at least one meeting a year and would recognise the file. This alone closes most of the client-facing risk on the register, and it is cheap: an hour of shadowing a year per relationship.
• Name a deputy for every regulatory role. A sole money laundering reporting officer with no deputy is a compliance function that stops the day they are unreachable, not merely a service one. Nominate and train a deputy MLRO, and do the same for any other role — data protection, health and safety — that currently has exactly one name against it.
• Move passwords and access out of people’s heads. A shared, permissioned password vault for practice-management, HMRC agent services, banking and software admin removes the single most avoidable version of this risk, because it costs an afternoon to set up and typically has no owner-dependency at all once it exists.
• Consider key person insurance for the roles insurance can actually help with. It pays out on death or critical illness of a named individual and can fund the cost of recruiting and covering a genuine loss — useful for the owner or an irreplaceable technical specialist. It does nothing for a three-week absence, does nothing for resignation, and does nothing to stop the disruption itself; treat it as a financial backstop for the worst row on the register, not a substitute for documenting the rest of it. Get a quote from a broker against your specific register rather than a general one, since the right sum insured depends entirely on what that person’s absence would actually cost.

This is also where a firm’s wider structure matters. A practice with a genuine management layer — see how to build a management layer in your firm — spreads authority as a by-product of how it is organised, so key-person risk falls even when nobody is working on it directly as a project. A flat firm where everything routes through two or three people has to close these gaps deliberately, because nothing about its structure does it for them.

What to do this week

• Draft the register: one row per person who holds concentrated knowledge, authority or a client relationship. Ten rows is normal for a ten-person firm; do not stop at three because the rest feel uncomfortable to write down.
• Score each row on impact if that person were unavailable for a genuine month, not a two-day illness.
• Fix the cheapest, highest-impact gap first — it is very often the password vault or the deputy MLRO, and both can be done this week.
• Add one second name to your three largest client relationships, and put the first shadowing meeting in the diary.
• Put the register itself on your monthly agenda. It goes stale as fast as the firm changes, and reviewing it is the mechanism described in how to run an operating review, applied to the risk that is easiest to forget because nothing has gone wrong yet.

None of this removes the risk of someone being ill, leaving, or simply being unreachable for a fortnight — that is not something a firm can engineer away. What it removes is the multiplier: the difference between an absence that costs a few thousand pounds and an inconvenient week, and one that costs several times as much and damages a client relationship the firm spent years building. Building the register and closing its gaps in order is exactly the kind of structural work sequenced in the Optivo method and maintained month by month through the Optivo Monthly COO.