Key-Person Dependency Checklist for Small Teams

Every small team has one: the person who knows how the invoices get sent, why the firewall is configured that way, and where the export script lives — all from memory. The bus-factor audit asks one honest question: if this person got hit by a bus tomorrow, what stops? The checklist has five parts: find the single points of failure, capture the five answers they hold, make the password manager carry the load, prove a second person can do the work, and write the runbook for the morning notice lands. An hour a quarter, done before you need it.

1. The audit: name the people, not the titles

Start with a one-page table. One row per person whose absence would hurt — not job titles, actual humans. Most ten-person teams find two or three:

Person	What only they know	What breaks on day 1	Mitigation owner
The ops/sysadmin	Firewall rules, server quirks, deploy steps, vendor logins	Remote access, deploys, the odd cable nobody knows the purpose of	Second admin (see the admin first-week runbook)
The bookkeeper	Which autopays run off which account, who gets paid when	Payroll, a surprise charge, the audit question nobody can answer	Owner + shared finance vault
The founder/sales lead	Which customer tolerates what, every unwritten promise	The renewal call, the escalation nobody else has context for	Shared CRM notes, not memory

If your instinct is "we're too small for this" — that is exactly when it matters. Small teams have the fewest people to absorb a gap. Keep the table in the same place as the delegation of authority page, because they answer each other.

2. The five answers to capture while the person still works here

Knowledge capture fails when it is vague ("document everything"). It works when it is five named artifacts:

Credentials — every login they hold lives in the shared password manager vault, not their browser profile or a note on their desk. If you do nothing else on this page, do this one (see the password manager rollout).
Runbooks — the ten recurring procedures written as steps a stranger can follow: deploys, backups, the monthly close, the renewal run. Use the runbook template; aim for ten, not a hundred.
Vendor relationships — for each critical vendor: the account, the escalation contact, the contract date, and the last promise made verbally. Memory-only vendor knowledge is the gap that shows up as a lapsed domain or an expired license (see the vendor escalation ladder and the software license register).
The "why" decisions — one page of why we did it this way: the firewall rule that looks wrong but is load-bearing, the vendor chosen after the cheaper one failed. Without this, the successor "fixes" the work-around and causes the outage.
The contact sheet — who to call at the ISP, the bank, the IT contractor, the landlord of the server closet. Personal relationships leave with the person; write the names down.

3. The password manager is the bus-factor fix you already own

Shared vaults per role, not one person's personal vault: an ops vault, a finance vault. Ownership belongs to the role, and the role survives resignations.
The break-glass account covers the day the vault itself is unreachable (see the break-glass account checklist).
Rotate what the person owned after they leave — the keys, the API tokens, the vendor portal passwords. Departure is the scheduled moment for the secrets rotation, not a someday task.
No exceptions for "temporary" logins — the trial account the sysadmin set up under their own email outlives them and owns the production integration. Hunt for those during the audit.

4. Prove it: the two-hour shadow test

Documentation that has never been used by a second person is a hope, not a control. Once a quarter, per critical person:

Step	Pass condition
Pick the top three recurring tasks from the runbook list	Two people named per task, written on the dependency table
The second person does the task alone, docs only	Completed with zero questions to the primary
Every question they had to ask	Answered in the doc the same day — that is the gap list
Anything that lived only in the primary's head	Captured before the test ends, or it never happened

The same logic drives the on-call handoff and the drill schedule: rehearsed is real, unread is decoration. Keep the docs findable — the process documentation practices page covers where they live so nobody has to ask where the wiki is.

5. The single-point-of-failure register

The audit output is one page, kept next to the dependency table:

Every critical task: at least two people who can do it and one named backup. "Primary is on holiday" should be a scheduling fact, not an emergency.
Every critical credential: in the vault, with the owner listed as the role.
Every critical vendor: two contacts — the account owner and the person who knows the contract (see the vendor contract checklist).
Every critical system: one line of "if this person leaves, do X first" — the X is usually rotate credentials plus read the runbook.
The quarterly diff: re-run the audit with the user access review — the same quarter, the same meeting, ten extra minutes.

6. The morning notice lands — the departure runbook

The planned version and the 8 a.m. resignation version share one rule: the relationship stays warm and the knowledge capture gets scheduled, in that order.

Hour one: thank them, agree the last day, and book the capture sessions now — two 90-minute sessions this week beats "write everything down before you go."
Session one: the vault sweep — move every personal-held credential into the shared vault while they are present. This is the highest-value hour in the whole plan.
Session two: walk the runbooks — they narrate, the successor drives, the gaps get fixed live. Record the "why" decisions in the doc, not in a video nobody will re-watch.
Same week: rotate what they own (the rotation checklist), transfer vendor contacts, and run the standard offboarding checklist — the dependency work rides on top of it, never instead of it.
The two-week-after check: the successor runs one critical task end to end and reports what they had to guess. Fix the doc, close the file.

If the exit is hostile or sudden, skip the warmth and go straight to the vault sweep, the rotation, and offboarding — the same order, minus the sessions that require cooperation.

7. The quarterly bus-factor card

Quarter	Do	Done when
Q1	Re-run the dependency table; diff against staff changes	Every row has a second name
Q2	Shadow test: two critical tasks, docs only	Zero questions to the primary
Q3	Vault audit: no personal-held production credentials	Zero exceptions, break-glass still tested
Q4	Full drill: primary is "away for two weeks," successor runs the week	Nothing escalated to the absent primary

The score that matters: how many critical things stop if one person disappears? The first audit usually says "most of them." Two quarters of this checklist moves it toward zero — and the team gets calmer, because the knowledge stopped living in a head and started living in a place.

Related notes

Runbook Template for Small Teams — the format the captured knowledge lives in.
Process Documentation Best Practices — where the docs live so nobody has to ask.
SOP Checklist Template — the recurring task version of the same idea.
Password Manager Rollout for Small Business — the shared-vault fix this page leans on.
Break-Glass Account Checklist — the login that works when the vault does not.
Employee Offboarding Checklist — the standard departure lane this runbook extends.
Delegation of Authority Template — who decides what while the primary is away.
The New Admin's First Week Runbook — the successor side of the handover.
Secrets Rotation Checklist — rotate what the leaving person owned.
User Access Review Checklist — the quarterly meeting this audit rides with.
On-Call Handoff Checklist — the weekly version of the knowledge transfer.
Software License Register — every key and seat out of one person's head.
Vendor Escalation Ladder — vendor knowledge written down, not remembered.
Vendor Contract Checklist — the clauses the second contact needs to know.

checklist (#141) - five passes (people, machines, vendors, secrets, money path), six-column register with blast radius and last-tested evidence, four decisions (eliminate/duplicate/document/accept), worked five-person store example, quarterly cadence with restore drill; sitemap 140 urls, index TOP card, README NEW, 5 backlinks)

People are only one layer of the map. The single-point-of-failure register & audit checklist walks the other four — machines, vendors, secrets, and the money path — and turns each finding into a priced decision instead of a hope.