Picture a mid-sized law firm on the eve of a critical court deadline. The case management system stops responding, the attorneys can't access the filings in progress, and the only person who knows how to restore the database, and who knows where the server credentials are kept, is on medical leave and unable to answer the phone. The team searches for a written-down password, a manual, a vendor contact, and finds nothing, because all of it has always lived in the memory of a dedicated, competent professional.
This scenario describes a risk that few companies record in their risk maps, even though it is present in nearly every organization that has entrusted its IT (information technology) to a single analyst or a small team. Over the years, that professional accumulates decisions, shortcuts, and exceptions that never made it onto paper, and the company comes to depend on one person in the same way it might depend on a single client or a single supplier.
The question worth taking away from this article is simple and uncomfortable: if the person who knows your IT inside and out left tomorrow, how long would it take the operation to reorganize, and how much would that cost in deadlines, revenue, and reputation?
When critical knowledge has a single address
Knowledge concentration rarely stems from poor management. It arises from merit: the professional who solves problems quickly gets more requests, learns more about the environment, and becomes the natural go-to for everything, while the company, pleased with the results, stops asking how things work under the hood. The risk grows precisely when operations are going well, which is why it almost never comes up in a board meeting before it turns into an incident.
The triggers are predictable, and none of them requires a crisis: a resignation, a promotion to another department, a medical leave, or the overload that leads the professional to put off everything that isn't urgent. ISACA's State of Cybersecurity 2024 survey, from the global association of audit, governance, and information security professionals, indicates that stress levels among cybersecurity professionals are on the rise, largely due to an increasingly challenging threat landscape, and identifies significant skills gaps in the field. A stressed, irreplaceable professional represents both a departure risk and an error risk.
The job market makes the picture worse. According to the IT Industry Outlook 2025 from CompTIA, the technology industry association, the imbalance between the supply of digital skills and the demand for specialists is forcing companies to change how they attract and retain talent, and demand for technical skills remains high across all sectors. The same study indicates that more than three in four professionals in technical roles feel optimistic about their career potential, which suggests that the analyst who keeps your IT running probably has good options outside your company.
In the legal sector, the consequences take on concrete form. A firm that cannot restore its client document repository within a court deadline faces a missed deadline, exposure to professional liability, and strained relationships with clients who entrusted confidential information to the firm. When a corporate client, during a vendor audit, asks for proof of how those documents are protected, the firm must present documented policies, records, and tests, something a professional's memory, however trustworthy that person may be, cannot replace.
The impact also reaches the company's value. In due diligence, the detailed investigation that precedes a merger, an acquisition, or the entry of a new partner, a lack of IT documentation is read as a hidden liability, because the buyer needs to know whether the systems will keep running after the transaction. Data protection regulations such as the GDPR (General Data Protection Regulation, the European Union's general data protection regulation) and the LGPD (Lei Geral de Proteção de Dados, Brazil's General Data Protection Law) reinforce this requirement by demanding that organizations demonstrate with evidence how they handle personal information.
How to turn dependency into distributed capability
The first step is to treat the issue as a business risk, with an owner, a deadline, and a metric. In May 2010, NIST (National Institute of Standards and Technology, the benchmark institute for technology standards) published guide SP 800-34 Rev. 1 on contingency planning, which helps organizations assess systems and operations to define continuity requirements and priorities. The guide includes a BIA (Business Impact Analysis) template, a useful tool for listing critical systems, the impact of each outage, and, by extension, who knows how to operate them.
The second step is to measure dependency with objective questions. For each critical system, leadership should know who holds the administrative credentials, where the documentation is, when the last restore test was performed, and which vendor to call in the event of a failure. When the answer to these questions is always the same name, the company has found its human single point of failure.
The third step is to distribute knowledge without stripping authority from the person who built it. An extended-team model, such as managed IT services, combines a NOC (Network Operations Center), a SOC (Security Operations Center), runbooks, which are step-by-step operational playbooks, and shared monitoring of the environment. The in-house professional continues to make decisions and lead, while the specialized backup team documents procedures, tracks alerts, and absorbs part of the repetitive workload.
When evaluating a partner, demand evidence: documentation delivered in a format the company controls, periodic test reports for backup and disaster recovery, a credential vault with role-based access, and a transition plan that preserves the role of in-house IT.
5 questions every manager should ask
Which systems would be left without an owner if one or two people left the company tomorrow?
Answering requires an honest, system-by-system inventory that maps each critical asset to the people capable of operating it, restoring it, and negotiating with the vendor. At a law firm, the list typically includes the case management system, the client document repository, email, deadline tracking, and attorneys' remote access.
The exercise often reveals that systems considered simple depend on a configuration only one person understands. Every system with a single name in the owner column deserves documentation priority, because that is where an unexpected absence turns into downtime.
What does an unexpected absence of the person who knows your entire IT environment cost in deadlines and revenue?
The cost rarely shows up as a single line item in the budget. It spreads across lost billable hours, emergency consultants hired in a rush, deadlines that require extension requests, and clients who start questioning the firm's ability to protect what they entrusted to it.
For anyone who needs predictable costs, dependence on one person works like a hidden variable expense that stays invisible while everything runs and materializes all at once, at the worst possible moment. Converting that risk into a known, recurring cost through documentation, monitoring, and contracted backup support trades surprise for predictability.
How much of the value I've built depends on knowledge stored in a single person's memory?
A company's worth rests, in part, on its ability to keep running without depending on specific individuals. Investors, buyers, and successors pay close attention to this, because a business that only operates with certain people present is worth less and is harder to transfer.
For those who founded or run the business, documenting IT is a way to protect the assets built over years. A firm that can demonstrate how it protects clients' confidential documents, with written policies and recorded tests, enters due diligence and contract renewals with demanding corporate clients in a stronger position.
How do I get backup to document the environment without pulling my team away from day-to-day operations?
Documentation and standardization rarely happen on the in-house team's own initiative, and the reason is almost always a lack of time, since day-to-day operations consume every available hour. When each day brings tickets, updates, and incidents, recording procedures gets pushed to later, and that later usually never comes.
Specialized backup support breaks the deadlock by taking on continuous monitoring, alert triage, and runbook creation together with the in-house professional, who validates each procedure. The IT leader gains time for strategic projects, shares the burden of repetitive tasks, and retains authority over decisions about the environment they know better than anyone.
Which indicators show that key-person risk in IT is actually decreasing?
Three indicators are enough to get started: documentation coverage of critical systems, the frequency and results of restore tests, and the time needed to onboard a new professional to the environment. Each can be tracked in management meetings without requiring technical knowledge from whoever is tracking them.
A fourth signal is qualitative and revealing, because it shows how many people, inside and outside the company, can answer the critical questions about each system. When that count goes from one name to several, the company has measurably reduced a risk that was previously invisible.
Frequently asked questions
What is key-person risk in IT?
Key-person risk in IT is the dependence on a single professional, or a very small team, to operate, restore, and protect critical systems. It surfaces when that person leaves, falls ill, gets promoted, or becomes overloaded, and the company discovers that credentials, routines, and decisions were never documented.
Does an extended IT team replace the in-house professional?
An extended IT team serves as backup for the in-house professional, who retains leadership and authority over the environment. The model adds continuous monitoring, structured documentation, and operations and security specialists, spreading knowledge without sidelining the person who knows the business.
How do you start reducing dependence on a single IT professional?
The starting point is an inventory of critical systems that shows, for each one, who has access, where the documentation is, and when the last restore test took place. Based on that map, the company prioritizes documenting systems with a single owner and defines indicators to track progress.
Find out in just a few minutes which parts of your IT depend on a single person with the Strategic IT Assessment, no strings attached.
If your IT lives in one person's head, talk to Zamak and turn that knowledge into a company asset.