When One Person Knows Everything: Untangling Your Small Firm's Single Point of Failure

It always starts with a perfectly ordinary Tuesday

Picture a nine-person accountancy practice in Stockport. The broadband is fine. The printer is behaving. Then the office manager — the one who set up the shared drive in 2019 and knows which password unlocks the payroll export — rings in sick. By half past ten, two people can't get into the CRM, nobody knows the login for the domain registrar, and the new starter is sitting there with a laptop that has never been touched by human hands.

This is not a rare story. It is the default state of small business IT in the UK, and it is quietly one of the most expensive problems a firm can carry.

The bus factor, minus the grim imagery

You'll sometimes hear this described as the bus factor: how many people would have to be hit by one before the business grinds to a halt. In a team of forty, the answer is usually several. In a team of eight, it is often one, and everyone knows exactly who it is.

The reason isn't laziness. It's that small firms grow by accretion. Someone needed to set up the shared mailbox, so they did. Someone needed to find a workaround for the invoice system, so they built one, and then the workaround became the process. Knowledge piles up in one head because that head was the nearest available one at the time.

The trouble is that this single person is holding four different kinds of thing at once:

• Access — passwords, admin accounts, the phone system, the door fob software.
• Ownership — the Microsoft 365 tenant, the domain name, the website hosting, the licence renewals.
• Supplier relationships — the broadband provider, the print supplier, the payroll bureau, the person at the insurance broker who actually answers.
• Tribal knowledge — the reason the accounts file must be saved to the S drive and not the desktop, and what to do when the tills stop syncing.

Each of those is recoverable on its own. Together, they're a house of cards with a person-shaped gap underneath.

The afternoon plan

Good news: you do not need to buy anything to fix most of this. You need a shared document and two hours when nobody is on the phones.

1. The list of who can get in where

Start with a simple table: system, what it's for, who has admin rights, who is the second person with access, and where the recovery route lives (usually a mobile number tied to an email inbox nobody checks).

Expect this to be uncomfortable. Most firms find at least two systems where only one person has admin rights, and one of those systems is the Microsoft 365 tenant, which controls everything else.

2. The supplier sheet

Every company that could break your week should be on here: broadband, telephony, website host, payment provider, insurance, payroll, and whoever supplies the kit. Include the account number and the actual human you deal with. Company switchboards are fine until you need someone at 8am on a Monday.

3. The renewal calendar

Domain names, TLS certificates, software renewals, Cyber Essentials certificates, insurance policies. Put them in a shared calendar with a reminder 60 days out. This single step prevents more outages than most security spending.

4. The workaround notes

Ask the unofficial IT person to write down the five things they'd have to explain over the phone if they vanished tomorrow. Keep it to a page. Bullet points. This is the part people skip and the part that hurts most.

5. The break-glass envelope

Somewhere physical and somewhere digital, store credentials for the handful of accounts that would otherwise lock you out — the password manager's master recovery, the tenant's break-glass admin account, the domain registrar. Sealed, signed, in a safe or a locked drawer at the owner's home, with a written rule about when it may be opened.

Then make somebody else do it

A document that only its author can read is not documentation. Before you file it away, get a second person to follow it cold, on a spare machine, with no help. Wherever they get stuck, that's your gap. Fix it and try again next quarter.

This is also the most honest way to test a leaver's departure, a new starter's induction, or the moment your office manager finally takes that fortnight in Portugal.

The bit nobody enjoys

Running this exercise will almost certainly surface something you can't fix cheaply — an ancient server nobody understands, a website built by a cousin, a payroll export held together with habit. That's fine. Knowing where the weak seam is beats discovering it at 4pm on a Friday.

Small firms don't need an IT department to survive this. They need one shared document, one second pair of hands, and a willingness to write down the things everyone assumed were obvious. Two hours now versus an unknown number of hours in a crisis — that's the whole trade.

If your team is small enough that this piece made you think of a specific person, that's your answer.