When Your Company's IT Knowledge Lives in One Person's Head 

Nearly every established business has this person. Sometimes it is an IT manager; often it is an office administrator, a long-serving bookkeeper, or the owner's most technical employee. They know the Wi-Fi password and the server password. They set up the email accounts. They are the contact on the domain registration, the software licences, and the account with the phone company. When anything technical goes wrong, everyone knows exactly who to ask. 

Owners tend to regard this person as an asset, and as a person, they are. As an arrangement, they are one of the largest unpriced risks in the business. The formal term is key-person risk, and in IT it is unusually acute, because the knowledge involved is invisible until the day it is unavailable. 

How the risk surfaces

The scenarios are ordinary. The person retires, resigns, falls seriously ill, or is simply on a plane during an outage. The business then discovers, in sequence, that nobody else knows the administrator password; that the domain, which all company email depends on, is registered to a personal address; that the backup system's status was something only they checked; and that the answer to "how is this configured?" was never written anywhere. 

There is also a harder version of the scenario. Departures are not always amicable, and a person who holds sole administrative control of a company's systems holds leverage no employee should hold, however trustworthy. Well-run businesses remove that situation not out of suspicion, but because good governance does not depend on goodwill. 

The owner's test 

A single question measures your exposure: if your most technical person became unreachable today, could the rest of the business gain administrative access to every system by tomorrow morning? If the answer involves the words "probably" or "I'd have to check," the following audit is worth an hour of your time. 

What must exist outside one head 

1. A password vault the business controls. Administrative credentials belong in a business-owned password manager with at least two authorized custodians, one of whom should be the owner or a director. Personal notebooks, spreadsheets, and memory do not qualify. 
2. Ownership of the accounts that own everything else. The domain registration, Microsoft 365 or Google Workspace tenancy, website hosting, and internet service should be registered to a company email address and paid on a company card, with recovery contacts that are not one individual's personal phone. 
3. Written documentation of the environment. What systems exist, how they connect, which vendors support them, and where the licences are. It does not need to be elegant; it needs to be findable and current. 
4. A second person on every critical system. Every system should have at least two people with administrative access, even if the second rarely uses it. Two is the minimum at which a departure is an inconvenience rather than an emergency. 
5. Verification by someone other than the operator. Backup results, security alerts, and renewal notices should reach two sets of eyes. This is the same principle owners already apply to bank reconciliations, extended to systems. 

Raising it without insulting anyone 

The person who holds this knowledge usually built the arrangement through years of diligence, and an audit can feel like an accusation. It should be framed as the opposite: documenting the environment protects them from being unable to take a vacation, and it is standard governance, the same as insurance and signing authorities. In our experience, the key person is often relieved; being the only one who knows is a burden as much as a distinction. 

Where a provider fits 

Some businesses resolve key-person risk internally. Many resolve it by engaging a managed IT provider, which distributes the knowledge across a team, maintains the documentation as a deliverable, and gives the internal key person a deep bench rather than a replacement. The correct structure depends on the business; the incorrect structure is the current one, in which continuity depends on one individual's availability. 

Superion documents client environments as a standard part of managed IT services, with credentials, configurations, and vendor details maintained in records your business owns. Contact us for an assessment of where your key-person risk sits today.