The Bus Factor of a Five-Person Business

Now apply the question to your business - and be honest, because nobody's marking this. If you were unreachable for a month starting tomorrow, what would still run? Who could invoice? Who knows the banking? Who knows which of the seventeen logins matters and where the domain is registered? In most owner-operated businesses the bus factor is one, the one is you, and the insurance industry's term for it - key person risk - gets discussed only at policy renewal, as a premium, never as a fixable property of how the business runs.

It isn't always the owner

Here's the version that surprises people. I ask an owner to list what only they know, and the list is long but expected. Then I ask what only someone else knows, and the room goes still. The bookkeeper who is the only person who's ever run payroll. The "good with computers" technician who set up the NAS in 2019 and left. The office manager who knows which supplier actually answers the phone and what the alarm code is.

A five-person business doesn't have one key person. It has five, each keying a different part of the machine, and no overlap anywhere - because overlap feels like waste when everyone's flat out. The same instinct that skips the spare laptop skips the spare brain.

And unlike the laptop, people leave on no notice, get sick in the middle of BAS season, and take holidays - or worse, don't take holidays, which ought to worry you more. An employee whose absence the business cannot survive is an employee the business is quietly forcing to never be absent. That's not loyalty. That's a structural fault wearing a long-service pin.

Knowledge redundancy, not people redundancy

You can't afford two of everyone; no small business can. The fix isn't hiring - it's moving knowledge out of heads and into the business, where absence can't take it hostage.

Three habits do nearly all of the work, and none of them costs money. First, the run book: suppliers, accounts, access, recovery paths, written down and kept current. Most key person risk is really undocumented-supplier risk in a nicer jacket, and it dissolves the moment the knowledge is on paper.

Second, one cross-training hour a month. Not a program, not a framework - Karen shows someone payroll while doing payroll; you show Karen where the domain renewals live. Rotate. In a year you've covered the twelve most critical tasks for the cost of one lunch break each.

Third, treat actual holidays as the test. A fortnight's leave, genuinely offline, is a live-fire continuity exercise - the kind a thirty-minute paper drill rehearses cheaply first. If the business can't survive someone being in Bali, it can't survive them resigning, and you'd rather learn that from a postcard than a doctor's certificate.

I watched the expensive version of this lesson on big projects more times than I can count: the contractor who was "too critical to release" at handover, whose rate doubled accordingly, because an organisation with thousands of staff had let one person become a wall. The five-person version is the same fault with no procurement department to absorb it. When I built Red Bridge Cyber, writing things down as if I'd be gone next month wasn't humility - it was the cheapest insurance available.

I've written before that nobody is coming to fix this for you, and that's still true - but there's a harder edge to it here. In a key-person business, you are the thing that can fail. The refrain points inward. Availability isn't only about servers and backups; it's about whether the business can reach what it needs to operate, and the scarcest thing it needs is currently between your ears.

So: a month, starting tomorrow, unreachable. What stops? Write that answer down - and notice that writing it down is the beginning of fixing it.

---

Sources

• Red Bridge Cyber, perspective: Write the Run Book Before You Need It
• Red Bridge Cyber, perspective: The Thirty-Minute Fire Drill
• Red Bridge Cyber, perspective: Nobody Is Coming to Fix Your Website