Key person risk in a small business, and how to measure it

What key person risk actually is

Key person risk is the chance that one person's absence stops something the business depends on. Lenders and insurers usually mean the owner or a star salesperson. In a firm of 5 to 50 people it is broader than that. It is the office manager who is the only one who can release payroll, the estimator whose spreadsheet nobody else understands, the admin who is the sole contact for the phone carrier.

The risk is not that these people are unreliable. It is that the business quietly routed critical work through a single person and never wrote down that it did. A resignation, a hospital stay, or a two-week vacation exposes all of it at once.

Why the org chart hides it

An org chart shows reporting lines. It says who approves whose time off. It does not say who actually does the work, who holds the logins, or which customers and vendors only ever talk to one person. A department of four can be one person and three helpers.

Titles make it worse. People take on duties over years without a title change, and the chart keeps describing the job as it was when they were hired. The dependency lives in habits, inboxes, and calendars, not in boxes and lines.

How to measure it in an afternoon

You do not need a consultant or a workshop. Block an afternoon, open a spreadsheet, and work through the steps below for every seat, including your own. Where you are unsure, check the Microsoft 365 admin center rather than asking around: it shows who owns groups and teams, who has permissions on each shared mailbox, and who holds admin roles.

• List every recurring process: payroll, billing, bank reconciliation, ordering, month-end, renewals.
• For each one, write the name of every person who has actually done it in the last six months.
• List every system and portal, and how many people can sign in to each.
• List your top twenty vendors and customers, and who each one contacts first.
• Count the rows with exactly one name. That count is your key person exposure.
• Mark the rows where you guessed. A guess is a gap, not coverage.

Insurance vs. redundancy

Key person insurance pays the business if a named person dies or becomes disabled. It can cover lost revenue or the cost of hiring. It does nothing for the far more common cases: a resignation, a long leave, a family emergency, or a quiet exit to a competitor. It also does not bring back the knowledge of how the work was done.

Redundancy is the other answer, and it is cheaper than it sounds. It does not mean hiring a second person for every job. It means a named backup for each single-name row, a second login or second owner where the system allows it, and one supervised run of each process with the backup doing the work. Most firms can move their worst rows from one name to two in a month.

If you carry key person insurance, keep it. Just do not mistake it for a continuity plan. Insurance pays for the damage; a backup prevents it.