Single Point of Failure Audit for Small Teams: Find the One Thing That Kills Everything

Every small business runs on a handful of invisible single points of failure: the one DNS provider, the one laptop with the only copy of the accounting file, the one contractor who holds the deploy credentials, the one power adapter for the office server. None of them are problems — until the day they are, and then they're the whole problem. A SPOF audit doesn't eliminate risk; it makes the invisible visible and prices the fallback before the outage prices it for you. This audit takes one person about two hours, once or twice a year.

TL;DR: The Two-Hour Audit

• The gap it closes: redundancy failures are silent — nobody notices that "the backup laptop" was repurposed in March, or that the backup vendor account expired, until the primary dies.
• The method: pick your three most critical flows (orders, payments, customer comms), walk each one end to end, and tag every dependency one level deep — every link where "if this dies, the flow stops."
• The rule: you don't fix every SPOF. You fix the ones where blast radius is catastrophic and likelihood is nonzero, and you write down the ones you accept.
• The payoff: most fixes cost nothing — a printed recovery page, a second admin account, an offline copy of the vendor list. The expensive ones get budgeted on purpose instead of discovered at 2am.

Walk the Wire: The Method

Pick one critical flow — say, "a customer buys something." Now trace it as a chain of physical and virtual links, and for each link ask: what else provides this? If the answer is "nothing," you found a SPOF. One level deep is enough; mapping four levels deep produces a diagram nobody reads.

Do this for your three flows. A four-person team typically surfaces 10–18 SPOFs in the first pass. That's normal, and it's the point: the audit converts vague dread into a ranked list.

The Eleven Usual Suspects

Almost every small-team audit finds some of these. Scan the list before you walk the wire — it primes the search:

1. The domain registrar. Auto-renew off, credit card expired, single admin. The business dies of an expired credit card, not a hacker.
2. The payment processor. Account freezes are the classic small-business outage — funds frozen for 30 days with no recourse. Read the vendor contract checklist clause on fund holds before you need it.
3. The single admin account. One person holds owner rights to the domain, the store, and the email tenant. If their phone is at the bottom of a lake, so is your access. The fix is a break-glass admin — see the secrets rotation checklist for storage.
4. The one laptop. The machine with the local books file, the design sources, or the deploy keys. If it's not backed up to two places, it's the business.
5. The office network. One router, one ISP, one power circuit. The internet outage runbook is the drill for this one.
6. The contractor with the keys. The freelancer who holds the DNS, the hosting, and the deploy pipeline — and replies to email within a week. This is the people-shaped version: the key-person dependency checklist handles the human half.
7. The third-party integration. One webhooks provider, one shipping API, one tax service — with no documented fallback and no idea what breaks when they do. The vendor escalation ladder at least gets you a human fast.
8. The certificate and the cron job. SSL expiry and a nightly job nobody monitors each take the site down quietly. The SSL expiry runbook and cron monitoring checklist are the pre-made fixes.
9. The shared inbox. One email address (support@, orders@) whose password one person knows, on one phone, with no delegate access.
10. The printer, the dongle, the physical key. The only key to the server cabinet or the mail room is a SPOF with a blast radius you'll meet on a Saturday.
11. Knowledge itself. The setup that exists in one person's head: the deploy sequence, the vendor contacts, the router admin password. If it's not written, it's a SPOF. The runbook template is the cure.

Score It: Blast Radius × Likelihood

Rate every SPOF on two axes and fix in order:

The discipline that makes the audit worth anything is the last row: an accepted risk you wrote down is a decision; an unexamined one is a surprise.

Worked Example: The Agency That Almost Lost Tuesday

A five-person marketing agency ran the audit on a quiet Friday. Top finding: their DNS registrar account was in the name of a founder's personal email, with auto-renew disabled and the credit card on file expired in March. Blast radius: total — no DNS, no email, no website, no client campaigns. They fixed it in twenty minutes: card updated, auto-renew on, registrar lock enabled, and a second admin added. The next finding was a contractor in another country who held sole deploy access to a client's site — the fix was a shared vault entry and a documented handover, not a confrontation.

Total audit cost: two hours and two 20-minute fixes. The alternative scenario — DNS lapses on a launch Monday, recovery takes three days through registrar support queues — is the kind of story that ends with "we lost the client." The audit is how you read that story in advance, as fiction, instead of living it as news. Close the loop with the after-action report if any SPOF on the list has already bitten you once.

Paste-In SPOF Register (CSV)

date,system,dependency,second_provider,blast_radius,likelihood,action,owner,review_date
2026-09-12,website,DNS registrar,none,total-kill,medium,card+autorenew+2nd admin,owner,2027-03-01
2026-09-12,checkout,payment processor,none,total-kill,low,2nd processor dormant,sam,2027-03-01
2026-09-12,deploys,contractor creds,none,blocking,medium,vault entry + runbook,alex,2026-12-01
2026-09-12,office,printer firmware key,none,annoyance,low,accepted in writing,sam,2027-03-01

How This Fits the Rest of the Plan

The SPOF audit is the input to your disaster recovery plan: every catastrophic-blast-radius row becomes a scenario the DR plan must answer, and the measured cost of each fallback belongs in the downtime budget. Re-run the audit after any big change — new processor, new office, new hire — and once a year regardless. The restore drill and the user access review cover the two SPOFs this audit always re-finds: the backup that was never tested and the account that was never removed.

Instant-Download Ops Kits

This checklist is part of the Hive80 Lab ops kit line — field-tested, instantly downloadable:

• The First 30 Minutes — free incident quick-start
• Ops Field Cards — 12 printable incident checklists — $4
• Ops Starter Kit — full incident-response kit for small teams — $14
• Ops Mega Bundle — all 5 kits in one download — $29

⚡ Launch pricing is live at the store — check the banner for today's code.

Related Ops-Notes Pages

• Key-Person Dependency Checklist
• User Access Review Checklist
• Domain Hijack Protection Checklist
• Payment Outage Playbook for Small Teams
• Internet Outage Runbook
• Vendor Contract Checklist
• Disaster Recovery Plan Template for Small Teams
• Runbook Template