Key person dependency as an enterprise risk
Test what fails when a critical person is unavailable. Continuity depends on accessible knowledge, authority and competent cover.
The performance question
Dependency can arise from relationships, specialist expertise, approvals or system access. It may be amplified when pressure leaves no time for transfer. Do not describe the person as the risk; the risk is the organisation’s inability to operate without continuous individual availability.
What the evidence supports
FRC Principle J and Provision 17 address senior succession, while HSE recommends assessing staffing use and workload. These support continuity and capacity review. They do not establish a standard probability of absence or a financial value for dependency.[1][2]
A practical approach
Map essential processes and identify tasks without competent authorised cover. Arrange shared access within proper permissions, documented context and supervised practice for deputies. Test a planned absence with actual decision authority transferred. Account for the additional load on those providing cover.
How to review progress
Report unresolved tasks and the actions needed for continuity. Repeat the test after major role or system changes. A name in a succession document is not sufficient evidence if the person lacks time, expertise or authority to act.
Sources and references
- UK Corporate Governance Code 2024 Opens in a new tab
Financial Reporting Council
Application; Principles A, E, F, I, J and O; Provisions 2, 5, 6, 17, 28 and 29
- Human factors: Workload Opens in a new tab
Health and Safety Executive
Processing limits, task analysis, workload drift and staffing