5 Signs Your Business Is Running on One Person's Knowledge (And What to Do About It)

Most small businesses have a person who quietly holds everything together. They know how the systems work, where things are kept, and who to call when something breaks, usually because they set most of it up themselves. It runs smoothly, right up until the day that person is on holiday, off sick, or leaves, and the business discovers how much of it was living in a single head. This is called key person risk, and it is one of the most common and least recognised vulnerabilities in a smaller company, precisely because nothing feels wrong until the moment it does.

The reassuring part is that every version of this problem has a practical, undramatic fix. Below are five signs that a business is leaning too heavily on one person's knowledge, and what to do about each one, written for anyone who has had "we should really write that down" on the list for about two years.

Sign One: One Person Knows All the Passwords

If there is a single individual who holds the logins to your important systems in their head, or in a personal notebook or spreadsheet only they can see, the business has a serious dependency it may not have noticed. The day they are unreachable and something needs urgent access, you are locked out of your own systems. The day they leave on bad terms, the situation is worse still.

The fix is a shared password manager. Rather than passwords living in one person's memory or private list, they go into a secure, business-owned tool that the right people can access under proper controls. Credentials stop being a personal possession and become a company asset, which is where they belong. It also improves security, because a proper password manager encourages strong, unique passwords instead of the reused ones people rely on when they are trying to remember them all.

Sign Two: One Person Is the Only Admin on Your Microsoft 365 Tenant

This one catches a remarkable number of businesses out. If a single person holds the only top-level administrator account for your Microsoft 365, they alone can add and remove users, control access and change critical settings. If that account is lost, or that person leaves without a clean handover, regaining full control of your own environment can become genuinely difficult, and the risk we describe in our piece on avoiding hidden dependencies when switching IT providers is exactly this.

The fix is to separate and share administrative control properly. There should be at least two administrator accounts under the business's control, protected with multi-factor authentication and recorded somewhere safe, so no single person is a single point of failure. It is also good practice to keep everyday accounts separate from admin ones, so high-level access is used deliberately rather than sitting active all day. None of this requires the founder to become technical, only to insist that the keys to the kingdom are not held by one pair of hands.

Sign Three: One Person Set Up the Systems and Never Documented Them

If the way your technology is configured exists only in the memory of whoever built it, you have a knowledge store with no backup. The person who set up the network, the software, the workflows and the little fixes that keep things running knows how it all fits together, and nobody else does. When they are away, ordinary problems become emergencies because the knowledge to solve them is unavailable, and if they leave for good, some of it may be gone permanently.

The fix is documentation, unglamorous but genuinely protective. It does not need to be elaborate: a plain, shared record of how the key systems are set up, where things live, and how the common tasks are done is enough to turn one person's memory into something the whole business owns. The same principle underpins retiring old systems safely, which we cover in our guide on sunsetting legacy software, since undocumented systems are the hardest and most dangerous to change. Written down, that knowledge stops being a liability that can walk out of the door.

Sign Four: One Person's Laptop Holds Files Nobody Else Has

If important documents live only on a single person's computer, the business is one spilled coffee, one theft or one hardware failure away from losing them. Files saved to a local desktop rather than a shared, backed-up location are invisible to everyone else and protected by nothing. It is remarkably common, and it usually comes to light at the worst possible moment, when the person and their laptop are both unavailable and the file is urgently needed.

The fix is centralised, backed-up storage. Important files should live in a shared company location, whether cloud storage or a managed environment, where colleagues can reach them and where they are properly backed up. This is one of the quiet advantages of virtual desktops, where work is kept centrally rather than on the device in someone's bag, a point connected to our piece on why your data should not be scattered across laptops. Once files live somewhere shared, no single person's absence, or misfortune, takes your information with them.

Sign Five: One Person Holds All the Supplier and Account Relationships

Beyond systems and files, there is the web of relationships that keeps a business running: the IT provider, the software vendors, the account contacts, the knowledge of which supplier handles what and who to phone when. If all of that lives with one person, their absence leaves everyone else unsure who to even contact, let alone what was agreed. It is the least technical version of key person risk and one of the most disruptive.

The fix is simply to write the relationships down alongside the systems: a shared list of your key suppliers, what each provides, the account details, and the main contacts. Kept with your documentation, it means anyone who needs to can pick up a supplier relationship rather than starting from scratch. Combined with the fixes above, it turns a business that depends on one person knowing everything into one where the knowledge is held by the organisation itself.

Turning One Person's Knowledge Into the Company's

Read those five back and a pattern emerges: in each case, something essential lives with one individual rather than with the business, and the fix is always to move it into shared, company-owned hands. Passwords into a shared manager. Admin control split across more than one person. Configurations written down. Files stored centrally and backed up. Relationships recorded where others can find them. None of it is difficult or expensive, and none of it requires the founder to be technical. It just requires deciding that the knowledge keeping the business alive should belong to the business, not to a single person who might one day be unavailable. If tackling it feels daunting to do alone, a good managed IT partner handles much of this as a matter of course, and our managed IT service is built around exactly this kind of resilience.

The best time to fix key person risk is a quiet week when nothing is wrong, rather than the crisis that finally exposes it. If "we should write that down" has been lingering for two years, this is the nudge to spend an afternoon making a start, because the version of your business that has done this is far steadier than the one that has not.

Because teams and systems keep changing, it is worth revisiting these five signs every so often, since new single points of dependency have a habit of quietly forming.