Risk Strategy

Key Person Risk: Can Your Backup Meet the Deadline?

A succession chart names the next person. An operating test shows whether critical work can continue. Ask for evidence before calling the dependency covered.

By Eric Kennedy · Thu Oct 01 2026 · 9 min read

Key person risk exists when a critical obligation depends on one person's knowledge, access, authority or availability. A succession chart can identify the next person for a role. It cannot tell you whether Friday's work will get done if the incumbent is unavailable on Thursday.

For a CFO, the useful question is specific: Which obligation would miss its deadline, and who has demonstrated that they can complete it without the usual owner?

Start there before commissioning another talent matrix. The point is to protect the business while giving capable people room to take leave, change roles and stop being permanently on call.

Succession and immediate cover solve different problems

A future Controller may be ready to lead the team after a planned transition. That same person may have no approved access to the bank portal today. A senior engineer may understand a production process but lack the qualification or authority required to release a particular job.

Those are operating dependencies. They can sit several levels below the executive team, inside a shared service or with a specialist at an outside provider.

The distinction has a useful foundation. The U.S. Government Accountability Office's 2025 Green Book, paragraphs 4.06 through 4.08, separates succession planning for longer-term replacement from contingency planning for sudden personnel changes. It also calls for responsibilities to be assigned when an unplanned vacancy occurs, with the depth of the contingency plan reflecting the role's importance and impact.

That is federal internal-control guidance, not a requirement imposed here on private mid-market companies. The distinction is still worth borrowing: readiness to inherit a position and readiness to cover a time-sensitive task are different claims requiring different evidence.

For this review, treat “backup identified” as an open question until the critical work has been tested.

Look for the obligation behind the indispensable person

Do not begin with a list of your highest-paid employees. Begin with obligations that become expensive or difficult to recover when they stop.

Ask Finance and operating leaders to identify work with a hard deadline, a scarce qualification, a concentrated relationship or a decision only one person can make. Examples might include a payroll approval, a customer-specific product release, a cash forecast adjustment or a contractual notice. These are possible dependencies, not claims that every business has the same exposure.

Then ask what actually makes the person indispensable. Is the procedure missing? Is judgment concentrated? Does one person hold the only working access? Is the alternate already committed to equally urgent work?

A procedure may explain the normal case while leaving the exception unresolved. Knowing which supplier discrepancy can wait, which estimate needs challenge or who will accept an urgent escalation may matter more than knowing where the spreadsheet is stored.

The Office of Personnel Management's talent-management guidance recommends collecting and transferring knowledge throughout the work's life cycle, rather than waiting until a departure makes transfer urgent. It also treats the business's talent strategy as supported by HR, not owned solely by HR. That guidance addresses federal agencies. Here, the practical implication is that the operating leader must help define the work that needs cover.

Ask for evidence of four conditions

A backup needs more than a name. For each critical obligation, establish whether the alternate can:

• Know the work: complete the normal task and recognize an exception that needs escalation.
• Have approved access: reach the necessary systems and records through their own authorized access.
• Hold decision authority: act within an explicit delegation, with required reviews and approvals preserved.
• Have available capacity: complete the task before its deadline while accounting for competing duties.

Prove it on a real task before the deadline, using a controlled rehearsal where live execution would introduce risk. These are review questions, not a certification or a new maturity score.

A folder of instructions addresses only part of this test. So does an access approval that has never been exercised. If the alternate needs the absent person to answer the decisive question, the dependency remains.

Do not fix an access problem by sharing credentials. Arrange authorized access and the required segregation of duties. A person who can prepare a transaction does not automatically have authority to approve it. Emergency cover should preserve that distinction or use an explicitly approved alternative control.

Evidence to put in the operating review

Record the task, its deadline, the evidence date and the unresolved exception. A single overall green rating can conceal the one condition that prevents the work from finishing.

The calendar can defeat an otherwise qualified backup

Illustrative scenario: A mid-market company's payroll lead becomes unavailable on Thursday. Its payroll approval deadline is Friday noon. The named alternate knows the process and has approved access, but cannot take over until Monday because of another assignment. The separate approver is available.

The immediate problem is capacity. Another procedure document will not bring the alternate forward to Friday. Management must free qualified cover before the cutoff, arrange another approved route or escalate the unresolved obligation while there is still time to act.

The dates are constructed to expose the timing problem. They are not a statement about payroll-provider deadlines or a KRG client experience. Any real response must use the company's actual processing rules, authority and escalation arrangements.

In this scenario, management should first decide which assignment can move. If it frees the alternate, it must also check what becomes uncovered elsewhere. Moving the dependency to a second process is not the same as resolving it.

Apply the KRG Risk Chain to keep the discussion connected to the business: the trigger is the lead's absence; the transmission is the lost approval capability; the constraint is the Friday cutoff combined with the alternate's availability; the financial outcome could include additional processing costs or disruption from delayed payment. Those consequences are possibilities to investigate, not estimated losses.

Test the handoff without manufacturing a crisis

Start with one obligation where failure would matter and the test can be controlled. Define what completion means, who can stop the exercise and which live actions are outside its scope. Use a representative case, including an exception that requires judgment.

Have the alternate perform the work. Ask the incumbent to observe without coaching unless a safety or control boundary requires intervention. Record each intervention as evidence about the process, not as a failure of the person learning it.

For a payment workflow, a controlled rehearsal can verify preparation, access and approval routing without releasing funds. It does not prove that every production step will work. Record the untested release step and decide how to validate it safely under the company's normal controls.

NIST's contingency-planning guide, SP 800-34 Revision 1, section 3.5, distinguishes discussion-based tabletop exercises from functional exercises in which people perform duties in a simulated operating environment. It also calls for results and corrective actions to be documented. The publication concerns federal information systems; it is a useful testing reference, not a general standard for staffing a private company.

The executive lesson is narrower: a conversation about how someone would do the task provides different evidence from watching them do it.

Close the gap only when the missing condition has been addressed and checked. Revisit cover when the system, process, approval structure or personnel change. For a broader review of recovery arrangements, use the existing business continuity audit guide.

You cannot afford a duplicate for every specialist

That is the fair objection. Some expertise takes years to develop. Maintaining a fully interchangeable second person for every role may cost more than the exposure warrants.

Management has choices beyond duplication. It can simplify a process, move a deadline where permitted, retain qualified external support, separate a specialist's judgment from routine execution or accept a limited interruption. Each choice needs a clear scope. An outside provider who also relies on one specialist may simply relocate the dependency.

Prioritize obligations with short recovery windows and material consequences. Record what can wait and who has authority to accept that delay. Do not treat a difficult staffing decision as automatically unacceptable risk, but do not describe it as covered merely because recruiting is underway.

If leadership elects to carry a gap, document the remaining exposure, the interim response and the review trigger. The distinction between an open action and an accepted risk matters here; moving a mitigation deadline does not itself authorize the exposure.

What belongs in the executive discussion

Ask for the obligations that remain exposed, the last observed test and the decision needed. “Payroll backup needs capacity before Friday” gives a CFO something to resolve. “Succession planning is 80 percent complete” does not explain whether payroll can proceed. That percentage is illustrative, not a benchmark.

HR can support development and succession. Process owners must establish workable cover, with IT, security and authorized approvers involved where their controls matter. Internal audit can challenge the evidence without taking responsibility for operating the backup arrangement.

For board-level exposure, use the existing board-ready risk reporting resource to show the consequence and decision, not a directory of names. The objective is a credible account of what the business can still do when a person is unavailable.

If your risk reporting shows completed plans more clearly than unresolved operating dependencies, start with a broader view of the program. KRG's scorecard helps structure that review.

Take the ERM Scorecard