# Your Business Has a Bus Factor of One

By Aimery Barrault

In June of 1994, someone on the Python programming mailing list posted a thread with a simple subject line: "If Guido was hit by a bus?"

Guido van Rossum created the Python language. At the time the entire project depended on him. If he stepped away, the whole thing would stall. That conversation gave us the term "bus factor." It is the number of people who would have to disappear before your operation stops.

If that number is one, you have a blind spot.

I work in IT consulting and cybersecurity, so I spend a lot of time inside other people's businesses. I look at their systems, their processes, how things actually run day to day. And one of the most common patterns I see, across every type of company, is this: the whole thing depends on one person. Sometimes two. And nobody has really stopped to think about what happens if that person is not there.

The term comes from software but the problem is everywhere. Sales. Finance. Operations. Marketing. Supply chain. It shows up in places people do not expect.

The Numbers Behind It

A survey by the National Association of Insurance Commissioners found that 71% of small businesses are dependent on one or two key individuals for organizational success. That is nearly three out of four companies where the whole operation hinges on someone showing up every day.

SE Advisory, an investment bank that works with middle-market companies, found that founder-dependent businesses receive valuations 30 to 50% below market comparables. Independent businesses in the lower middle market sell for 7 to 8x EBITDA. Founder-dependent companies struggle to hit 3 to 4x. That gap represents real money.

For small privately held companies it can be even more severe. Brady Ware, a business advisory firm, says that in extreme cases like sole proprietorships that are service businesses, the effective key person discount can reach 100%. That means the business has no transferable value at all. Everything walks out the door with the owner.

Where I See It Show Up

Most people assume this is a tech problem. Passwords and servers. And sure, that is part of it. But in the businesses I have worked with, the bus factor shows up across the entire operation. Here is what I keep running into.

Sales and Client Relationships

This is the one that costs the most money and gets talked about the least. There is usually one person who closes most of the deals, knows every client by name, has pricing conversations nobody else is part of. They remember what the client said at dinner six months ago and use it to close the next contract.

The relationship is with that person. Not with the company. And when they leave or get pulled away, those relationships go with them.

Verified Metrics puts it simply: if a top salesperson or technical expert leaves, it can result in an immediate and substantial loss of sales or billable hours. For small and mid-sized companies that can be devastating.

What I suggest to clients is straightforward. Introduce a second point of contact on every major account. Log client interactions in a CRM the whole team can access. Make sure the relationship belongs to the business, not to one person's memory.

Finance and Accounting

In a lot of the businesses I work with, one person runs payroll. One person does the books. One person has the login to the bank. One person knows how the invoicing system actually works.

I have sat in meetings where the owner could not tell me what accounting software they use because "That is Sarah's department." If Sarah takes a week off, nobody gets paid. Invoices do not go out. Cash flow goes dark. Nobody planned for it because nobody thought about it.

The ISO 9001 quality standard, used across manufacturing globally, was updated in 2015 to include risk-based thinking as a core requirement. The whole idea is to catch risks like this before they become real problems. Having one person with sole access to financial systems is exactly the kind of thing that standard is built to flag.

The fix is not complicated. Train a second person on payroll. Document the month-end close process. Put banking and accounting credentials in a shared password manager with proper access controls.

Operations

This is where it hides in plain sight. There is usually someone in operations who just knows how everything runs. The order things need to happen. The workarounds when something breaks. Why that one vendor gets called on Tuesdays not Mondays.

Then they give notice. And two weeks is nowhere near enough to capture what they know. Vendor relationships cool off. Processes that seemed to run on autopilot turn out to be entirely dependent on one person's daily attention.

Brady Ware makes a good point on this: if more than 20% of your day is spent doing work that employees could handle, you are too deep in the weeds and it is actively hurting the value of your business.

Technology and IT

This is the obvious one. Admin credentials, API keys, hosting dashboards, domain registrars, cloud consoles. In most small companies these live with one or two people. Sometimes just in their browser autofill.

The most extreme case I have come across is QuadrigaCX. In 2018 the CEO of this Canadian cryptocurrency exchange died unexpectedly and took the only passwords to the company's encrypted systems with him. $137 million in customer funds were locked. The company filed for bankruptcy. Internal Auditor, the publication of the Institute of Internal Auditors, covered it as a textbook example of what happens when access is concentrated in a single person.

That is the extreme version. But a smaller version of it plays out all the time. The developer who is the only one who knows how production is configured. The IT admin who holds all the cloud credentials. When that person is unavailable, the business is locked out of its own infrastructure.

Marketing

Marketing bus factor is easy to miss. Someone manages your social accounts. Someone knows the brand voice. Someone has the login to the ad platform with all the campaign history. Someone maintains the email list and knows the segmentation logic.

If all of that sits with one person or one freelancer and they disappear, you do not just lose a team member. You lose access to your own audience.

I always tell clients the same thing here. Make sure you own the accounts, not your agency. Centralize the credentials. Document the brand guidelines somewhere the team can find them.

Vendor and Supply Chain

This catches people off guard. Your purchasing manager has a relationship with your key supplier. They get better pricing because of that personal connection. They know who to call when something is backordered. They know the shortcuts.

If that person leaves, the supplier relationship does not transfer automatically. Pricing might change. Response times might slow down. And you might not know until you are already behind.

Simple steps go a long way here. Get vendor contacts documented. Introduce backup contacts. Make sure the terms are written down somewhere other than one person's inbox.

A Quick Way to Check

Here is a simple exercise I walk clients through. Takes about 30 minutes.

Write down every system your business depends on. Email, hosting, CRM, accounting, project management, cloud services, banking, ad platforms, vendor portals. Next to each one, write who has admin access.

If the same name shows up more than three times, your bus factor is one.

Do the same for client relationships. Who owns the relationship with your top five clients? If one name shows up across the board, that is not a strength. That is a concentration of risk.

Then do it for processes. Who runs payroll? Who closes the books? Who manages campaigns? Who fixes the production system when it breaks at 11 PM? Every row with a single name and no backup is a gap.

What Actually Helps

None of this is flashy work. That is why it gets skipped. But it is some of the highest-leverage work a business can do.

Write It Down

If only one person knows how something works, that knowledge needs to be on paper. Not a manual nobody reads. A one-page runbook for each critical system. What is it. Who has access. How do you log in. What do you do if it breaks.

Centralize Access

A shared password manager with role-based access. Not a sticky note. Not a spreadsheet. Not "I will tell you if you need it." A real system where if someone is unavailable the business keeps access to its own tools.

Cross-Train

Every critical function should have at least two people who can do it. Not at the same level. Just enough to keep things moving. You are not building redundancy for the fun of it. You are building a business that can handle a bad week.

Formalize the Informal

If a client relationship lives in one inbox, introduce a second contact. If a vendor deal is a handshake, get it in writing. If a process exists as tribal knowledge, turn it into a checklist.

Consider Key Person Insurance

It exists for a reason. It does not replace the operational work but it buys time and stability if a critical person becomes unavailable.

A Note for Founders

Founders tend to be the biggest single point of failure in their own company. I see it constantly. They know every password because they created every account. They own every client relationship because they closed every deal. They understand every system because they built it from scratch.

It feels like being essential. But it is actually a bottleneck that gets worse as the business grows.

Class VI Partners, an investment bank that works with middle-market companies, says that business owner dependence is the single most prevalent risk they encounter. It comes in 14% higher than the next most common risk. And the number one regret their clients have after selling? They did not hire their key management people sooner.

SE Advisory frames it as the "90-day test." Could your business run profitably for 90 days if you were completely unreachable? If the answer is no, the problem is not staffing. It is structure.

The goal is not to make yourself unimportant. It is to make the business resilient enough that it does not fall apart because of one bad week.

This Is What We Do

At Barratec, we help small and mid-sized businesses find and fix these gaps. It starts with understanding where the single points of failure actually are. Not just in IT, but across sales, operations, finance, and everywhere else things quietly depend on one person.

We help our clients document what only one person knows. Centralize access so the business is never locked out of its own systems. Build processes that do not break when someone takes a vacation or moves on. Set up the security and infrastructure so that things keep running no matter what.

If any of this sounds familiar, we should talk. Not to sell you something. Just to figure out where the gaps are and what to do about them.

Sources

• Bus factor origin, 1994 Python mailing list: Wikipedia and Grokipedia, "Bus factor."
• 71% of small businesses dependent on 1-2 key individuals: National Association of Insurance Commissioners survey, cited by Nationwide Insurance, "Navigating Key Person Risks."
• Founder-dependent valuations 30-50% below comparables, 90-day test: SE Advisory, "Founder Dependency: The Hidden Valuation Killer That Could Cost You Millions."
• Key person risk discount up to 100%, 20% tactical threshold: Brady Ware & Company, "Managing Key Person Risk."
• Owner dependence as most prevalent risk, 14% above next: Class VI Partners, "Business Owner Dependence: The Risk Hidden in Most Middle-Market Businesses."
• QuadrigaCX, $137M locked, single point of failure: Internal Auditor (IIA), "The Single Point of Failure," April 2019.
• ISO 9001:2015 risk-based thinking: International Organization for Standardization; referenced by Henderberg Business Solutions.
• Key person departure impact on sales and billable hours: Verified Metrics, "Key Man Risk: The Person Who Can Make or Break Your Company."