Key person risk is the danger that your small business depends too heavily on one person, usually the owner or a single key hire. If that person gets sick, quits, or is otherwise out, revenue, relationships, or knowledge can walk out the door with them. Most founders ignore this risk until it costs them.
In the P7 Performance Framework, this is the seventh driver: Protection. It is the one founders almost always score themselves on last, because it does not feel urgent the way sales or hiring does. Nothing is on fire today. But Protection is the driver where a single bad event can unwind years of work in an afternoon, and that is exactly why it gets ignored until the worst possible moment.
What is key person risk?
Key person risk is the exposure a business carries when too much of its value lives inside one person. In a founder-led business doing $2M to $10M, that person is usually the owner, but it can also be a top salesperson who owns every client relationship, a lead technician who is the only one who knows how the work actually gets done, or an operator who holds the whole system in their head.
The test is simple. Ask what happens to revenue, delivery, and client trust if that one person is gone for ninety days starting tomorrow. If the honest answer is that the business takes serious damage, you have concentrated key person risk, and right now it is uninsured.
Why founders ignore Protection until it is too late
Protection loses every battle for attention. Sales has a number attached to it. Hiring has an open seat staring at you. Protection has nothing visibly broken, so it never makes it to the top of the list. The work of documenting a process, cross-training a backup, or signing the right agreement always feels like it can wait until next quarter.
The problem is that you do not get to choose when the event happens. A key person does not give ninety days notice before a health emergency. A competitor does not warn you before hiring away your top rainmaker. Protection is the one driver where you cannot react after the fact, because by the time it is urgent, the damage is already done.
What actually breaks when a key person is gone
Key person risk shows up in three common ways, and each one quietly threatens the business:
- The owner is suddenly out. If nothing important happens unless you touch it, then an illness, injury, or family emergency does not just slow the business down. It stops it. Owner dependency is key person risk pointed directly at yourself.
- A key hire walks out. When one person owns all the client relationships, the sales process, or the technical knowledge, their resignation letter takes a chunk of the business with it, often straight to a competitor.
- The knowledge or IP is not protected. Critical processes, contracts, passwords, and intellectual property that live in one person's head or one person's accounts are one departure away from being gone. Nothing is documented, so nothing can be handed off.
Any one of these can cost you clients, revenue, and momentum that took years to build. Most owners know the exposure is there. They just have not made it concrete enough to act on.
Business continuity planning for a small business
Business continuity planning for a small business does not require a thick binder or a corporate risk department. It requires making the business survivable without any single person. A practical starting point looks like this:
- Map the single points of failure. List every function that would break if one specific person disappeared for ninety days. Those are your key person risks, ranked by damage.
- Document what lives in heads. Turn the critical knowledge, processes, and relationships into written systems the business owns, not the individual.
- Build a backup for each critical role. Cross-train a second person, even partially, so no function depends on one human being.
- Secure the legal and financial basics. Make sure contracts, IP, accounts, and a basic succession or contingency plan are in writing, in the company's name, and accessible to more than one person.
None of this is glamorous, and that is the point. Protection is boring right up until the day it is the only thing that matters.
Where Protection fits in the bigger picture
Protection is one of seven drivers in the P7 Performance Framework, alongside People, Process, Platform, Product, Pipeline, and Profit. For most growing businesses it is not the constraint capping growth today, which is exactly why it gets skipped. But ignoring it does not make the risk go away. It just means you find out about it at the worst possible time.
The point of a full diagnostic is to see all seven drivers at once, so Protection gets weighed honestly instead of quietly deferred year after year. The free P7 Score diagnostic scores all seven in about 30 minutes, including how exposed you are on Protection, so you can decide what to address now and what to plan for.
Frequently asked questions
What is key person risk in a small business? It is the risk that the business depends so heavily on one person, usually the owner or a key hire, that losing them would seriously damage revenue, delivery, or client relationships. The more value concentrated in one person, the higher the risk.
How do I reduce key person risk? Document what lives in people's heads, cross-train backups for critical roles, and put contracts and IP in the company's name. The goal is to make every important function survivable without any single individual.
Is key person risk only about the owner? No. The owner is the most common single point of failure, but a top salesperson, lead technician, or sole operator can carry just as much concentrated risk. Anyone the business cannot function without is a key person.
Protection is the driver you are most tempted to skip and least able to afford ignoring. If you are not sure how exposed you are, start with the P7 Score and find out before an event forces the question for you.