When Expertise Becomes a Single Point of Failure

When Expertise Becomes a Single Point of Failure

The Governance Blind Spot Hiding in Plain Sight

A CCC Advisory Insight on Key Person Risk| September 2026

The Scenario

Consider an organisation where one employee understands the regulatory process, the legacy system, the key client relationship, the critical supplier, and the reporting process. On the organisational chart, the function is covered by five distinct areas of responsibility. In practice, the knowledge required to keep all five running sits in one person’s head.

This is not a hypothetical edge case. It is a more common pattern than most risk registers reflect, and it rarely announces itself until the person in question is unavailable, whether through resignation, illness, or simply annual leave taken at the wrong moment.

This is what governance and risk professionals describe as key person risk, or key person dependency risk: the exposure an organisation carries when critical knowledge, judgement or relationships depend on one individual rather than on the organisation itself.

Why This Happens

Key person risk of this kind is rarely the result of a deliberate decision. It accumulates. A person joins a small team and, over years, becomes the one who remembers why a system was configured a certain way, who holds the client relationship’s history in their head rather than in a CRM, and who has quietly become the only person capable of reconciling a particular report. Growth outpaces documentation, informal onboarding substitutes for structured knowledge transfer, and trust in a capable individual substitutes for a resilient process. None of this looks like a problem while the person is present. It only becomes visible in their absence.

Analysis of organisational dependencies consistently finds that key person risk exists well beyond founder or executive level. They show up in roles responsible for vendor security reviews, financial reporting, customer onboarding, regulatory compliance and legacy systems, etc., and a change in any one of these roles can disrupt continuity across the wider organisation, not simply within the role itself. A key person, in this sense, is not necessarily a senior title. It is whoever the rest of the team would call first if something went wrong.

The Cost Of Not Knowing

The difficulty with key person risk is that it often sits outside the way organisations normally think about operational risk. Systems are documented, suppliers are assessed and critical processes are mapped, but the people who make those processes work are not always examined with the same level of detail.

The UK's operational resilience framework provides a useful example of why this matters. Firms within scope of the FCA's requirements are expected to identify and document the people, processes, technology, facilities and information needed to deliver their important business services. The purpose is not simply to create a map. It is to understand where vulnerabilities exist and whether a service could remain within its impact tolerance during a disruption.

The FCA's more recent review of firms' operational resilience work found that some firms were still placing too much emphasis on technology when mapping their dependencies, with less mature approaches to people, processes, facilities, information and third-party dependencies. The FCA also highlighted the importance of using mapping and scenario testing to identify vulnerabilities rather than assuming that a service is resilient because the relevant documentation exists. That distinction matters beyond financial services.

An organisation can have a documented process, an assigned owner and a business continuity plan and still carry serious key person risk if the person who knows how to make the process work is unavailable. The documentation may tell someone what should happen, but not necessarily why certain decisions are made, how exceptions are handled or which relationships need to be managed when something goes wrong.

This is where the difference between documented responsibility and organisational capability becomes important. A responsibility can be assigned to the organisation. The expertise required to perform it may still belong to one person.

What Good Looks Like

The organisations that manage this risk well do not necessarily try to eliminate individual expertise. They make sure that expertise does not remain trapped with the individual.

That starts with documentation, but not documentation for its own sake. Knowledge is easier to retain when it is captured as part of normal work, through decision records, process documentation, system notes, meeting records and structured handovers. The aim is not to document every task someone performs. It is to make sure that the knowledge required to keep a critical activity running does not disappear when the person who holds it does.

Organisations should also periodically test where these dependencies exist. For each critical system, client relationship or regulatory process, it is worth asking who the team would call if something went wrong and the usual owner was unavailable. If the answer is consistently the same person, that dependency deserves closer attention. The next question is what the organisation would actually lose if that person were unavailable for an extended period. It may not simply be their workload. It could be historical knowledge, regulatory judgement, system access, client relationships or an understanding of how several seemingly unrelated processes fit together.

Cross-training and succession then become part of normal operations rather than activities that begin when someone announces their departure. Where appropriate, organisations can use named alternates, shared responsibilities, structured handovers and periodic absence testing to make sure that a critical capability is not dependent on one individual.

Some regulated environments already recognise the importance of this principle. For example, UK audit rules include specific alternate arrangements for sole practice auditors so that continuity can be maintained if the sole practitioner becomes unable to continue.

For governance and risk functions, the practical answer is not necessarily to create another standalone exercise. Key person dependencies can be incorporated into existing operational resilience and business continuity work. If an organisation is already mapping the people and resources required to deliver its critical services, the question is whether that mapping goes far enough to identify the individual expertise on which those services actually depend.

Conclusion

Technically, an organisation with five critical functions may have five people covering them. Practically, if the knowledge required to keep those functions running sits with one individual, it may have one point of failure wearing five different job titles. That is the governance blind spot.

Resilience is not simply a question of how many people are on an organisational chart. It is whether the organisation can continue to operate when one of the people carrying its critical knowledge, relationships or decision-making capability is unavailable.

The real question is therefore not whether an organisation has capable people. It is whether the capability they hold has become part of the organisation itself. If critical knowledge exists in only one person's head, the organisation may not be as resilient as it appears.

And the time to find that out is before the person becomes unavailable.

Prepared as part of CCC Advisory’s regulatory insights and advisory work.

© CCC Advisory. All rights reserved.