Every business of a certain size has one person who quietly holds the whole operation together in their head. They know which spreadsheet is the real one, which customer is fussy about appointment times, and the login for the one system nobody else has ever needed to use. Everything's fine, right up until they're on a beach with no signal.
This is a real business risk, not just an inconvenience
Key-person dependency is a recognised operational risk, and it's a particularly common one in small businesses where processes grow organically rather than being documented from day one. It's not a criticism of "the guy" - he probably built genuinely good systems. The problem is that they only exist properly in one head.
The tell-tale signs
- "Just ask Dave" is the answer to more than one operational question
- Passwords exist in one person's memory, not in any shared, secure place
- A client calls with an urgent question and the honest answer is "he's back Monday"
The fix doesn't require replacing anyone
It's mostly about getting what's in someone's head into a shared system - proper documentation, shared (and securely managed) access, and processes that don't rely on tribal knowledge. This is one of the quieter benefits of moving off ad-hoc tools and into a proper shared system: it forces the knowledge out into the open as a side effect, rather than as a special project nobody has time for. Password and access management specifically is worth taking seriously on its own - the National Cyber Security Centre has straightforward guidance aimed at exactly this kind of small business risk.
The verdict
Nobody begrudges Dave his holiday. The business just shouldn't need him to enjoy it in peace.