A single point of failure in a small business is anything only one human can operate: a person, a password, a vendor relationship, or a task nobody ever wrote down. You already have several. The quickest proof is to pick one name on your team, yours included, and picture that phone switched off for ten working days starting tomorrow morning. Whatever stops is the list.
This walkthrough turns that thought experiment into a half-day working session with a finished output: four inventories, one ranked list, and a fix assigned to every line above the cutoff. Do the six steps in order. The ranking in Step 2 is what keeps you from spending a month documenting something that could wait while the real exposure, usually a login, sits untouched.
What counts as a single point of failure in a small business?
A single point of failure is any dependency with exactly one path through it. In a service company those paths come in four kinds: a person who is the only one trained, a credential only one person can use or reset, a relationship an outside party has with one individual instead of with the company, and a task that lives in someone's memory. Software teams have a name for the number of people who would have to disappear before work stalls: the bus factor. Most small service businesses have a bus factor of one in at least three places.
Notice what is not on the list. Being busy, being the best at something, or being the person customers ask for by name is concentration, and it is a different problem. The test here is strict: does work stop, or become unrecoverable, without that one human?
If this sounds like your week, see how owners hand this off.
How do you find every single point of failure in a small business?
Step 1 of 6: build the four lists. Block 90 minutes. Open a spreadsheet with five columns: item, type, who holds it today, who else could do it, and how you would recover. Bring one person from the office who knows how things really get done. Work the lists in this order, because each one surfaces rows for the next.
List 1: Passwords and accounts
Start here because it is the fastest to enumerate and the most often catastrophic. Pull the last two months of bank and card statements. Every recurring charge is an account with an admin behind it. For each one, write down the admin email address and whose phone receives the two-factor code. Then add the accounts that never bill you:
- Bank and online banking: authorized signers, and who can add or remove users.
- Payroll provider and EFTPS: who holds the login and PIN used for federal tax deposits.
- The EIN itself: who the IRS has on file as the responsible party.
- The accounting file: QuickBooks Online has exactly one primary admin, and that role normally has to be handed over by whoever holds it.
- The field service platform: Jobber, Housecall Pro, ServiceTitan, or whatever runs your schedule and customer history.
- Domain registrar and DNS: very often registered under a web designer's account or a former employee's personal email.
- Google Business Profile: who the primary owner is. Your reviews and your map listing sit under that one login.
- Phone system: who can change after-hours forwarding, and which personal cell it forwards to.
- State license portal, secretary of state filing account, and insurance carrier portal (the one that issues certificates of insurance).
List 2: People
Go role by role and ask one question: who covered this the last time they took a week off? If the honest answer is that nobody did and the work waited, that is a row. The usual suspects in a service business are the dispatcher who builds tomorrow's board, whoever runs payroll, the estimator whose numbers nobody else can reproduce, and the technician holding a credential that attaches to the individual. EPA Section 608 certification for refrigerant work and state backflow tester certification both belong to the person, not the company. One certified tech can be the only path to an entire line of revenue.
Put the license holder on this list too. Many contractor licenses depend on a single qualifying individual.
List 3: Vendor and outside relationships
For each supplier, subcontractor, agent, and outside professional, ask two things. Does the vendor know a second name at your company? Do you know a second name at theirs? The counter rep who extends your terms, the one drywall sub who always shows up, the insurance agent who turns a certificate around in an hour, the freelance IT person, and the property manager at your largest account are all relationships that tend to belong to one employee's cell phone.
List 4: Undocumented tasks
Walk the calendar by frequency: weekly, monthly, quarterly, annual. The annual ones are the dangerous ones, because twelve months is long enough for everyone to forget the steps. License renewals, the workers' comp premium audit, vehicle registrations, sales tax permit renewals, 1099s in January, and certification renewals all qualify. Finish by asking each person on the team, “What do you do that nobody would know to do if you were gone?” If you want a fuller method for pulling this out of people who hate writing, see the guide on documenting tribal knowledge without asking the field to write anything.
What done looks like: as a rule of thumb, a company of ten to twenty people ends up with 40 to 80 rows. Fewer than 25 usually means the accounts list is incomplete. Every row has a name in the “who holds it today” column, and most have a blank in “who else could.” Those blanks are your map.
How do you rank each point of failure by the damage it would do?
Step 2 of 6: score every row. Rank by what happens the day that person is unavailable, not by how important the item feels. Score each row on two questions, 1 to 3, and multiply.
- Time to pain: how soon does damage start? Same day is 3. Within the week is 2. A month or more is 1.
- Time to recover: once you notice, how long to restore it? Hours is 1. Days is 2. Weeks, or anything that depends on mail, a government office, or a third party's cooperation, is 3.
| Row | Pain | Recovery | Score |
|---|---|---|---|
| Only the dispatcher can build tomorrow's schedule | 3 | 2 | 6 |
| One person holds the payroll login and EFTPS PIN | 2 | 3 | 6 |
| One tech holds the only backflow certification | 2 | 3 | 6 |
| Domain registered under a former employee's email | 1 | 3 | 3 (override) |
| License depends on one qualifying individual | 1 | 3 | 3 (override) |
| Only the office manager knows the monthly sales tax filing | 1 | 2 | 2 |
Then apply one override. Any row where failure triggers a tax penalty, a license suspension, or the loss of an asset you cannot buy back goes to the top regardless of score. Slow-burning rows are the ones that surprise owners. A domain can sit quietly for eleven months and then take your email and website down on the same morning.
Two numbers explain why the ranking deserves the effort. According to the Bureau of Labor Statistics, median employee tenure with a current employer was 3.9 years in January 2024, the lowest reading since 2002. The person holding your only copy of a process is, statistically, leaving. And the consequences are specific: the IRS failure-to-deposit penalty is 2% of the unpaid payroll tax deposit when it is 1 to 5 days late, 5% at 6 to 15 days, and 10% beyond that. A new EFTPS enrollment sends the PIN by mail, which takes five to seven business days. One missing login can cost you a penalty tier before you are able to fix it.
What done looks like: the sheet is sorted by score, there is a line drawn under every 6, every 9, and every override, and each row above the line has a fix owner and a date.
Which single point of failure should a small business fix first?
Step 3 of 6: remove the access failures. Access fixes go first because they take minutes, need no training, and cover the rows with the longest recovery times. Work through them in one week.
- Add a second admin to every account on List 1. A real second user with their own login, not a shared password. Shared passwords break the moment one person changes them, and they leave no record of who did what.
- Move account ownership to role addresses. Use something like accounts@ or admin@ on your own domain, delivered to two people. Nothing the company depends on should be registered to a personal Gmail address.
- Put credentials in a business password manager with shared vaults and an emergency-access setting. Store the two-factor backup codes there, and register a second device for any authenticator app.
- Fix the bank. Add a second authorized signer, or at minimum a second online user who can view and release payments under a limit. Ask your banker directly what happens to account access if the sole signer is incapacitated.
- Fix the government accounts. Confirm who the IRS lists as the responsible party on your EIN. A change has to be reported on Form 8822-B within 60 days, and plenty of businesses still list a former partner or an old bookkeeper. Confirm who makes payroll tax deposits and that a second person can.
- Reclaim the assets. Move the domain into a registrar account the company owns. Make yourself the primary owner of the Google Business Profile and add a second owner now. Newly added owners and managers wait seven days before they can remove other users or take over primary ownership, so this cannot be done in an emergency.
Watch for: the second admin who was added but never logged in. An untested backup is a guess.
What done looks like: for every List 1 row, the “who else could” column holds the name of someone who has successfully signed in, with their own credentials, while you watched.
Which single points of failure need a second person, and which need a document?
Step 4 of 6: assign a backup or a procedure. Sort the remaining people and task rows with two questions: how often does this happen, and how much judgment does it take?
- Frequent and judgment-heavy (dispatching, estimating, running payroll): this needs a second trained human. A document alone will not carry it.
- Rare and procedural (annual renewals, permit filings, the year-end 1099 run): this needs a written checklist with screenshots, where the login lives, and the date it is due.
- Rare and judgment-heavy (the workers' comp audit, a bonding renewal): this needs the checklist plus the name and number of the outside professional who helps you through it.
For the second-person rows, train by reversal. The backup runs the task while the primary watches and says nothing unless something is about to go wrong. Do that twice. Then put the backup on the task solo one scheduled day each month, permanently, so the skill does not decay. The mechanics of making that stick are covered in how to hand off a process so it stays handed off.
Individual credentials are the hard case, because you cannot cross-train a license. The fix is to identify the second eligible person now and start their experience or exam clock. In California, for example, a licensee whose qualifying individual leaves has 90 days to replace them before the Contractors State License Board suspends the license. Rules vary by state and trade, so look up your own board's replacement window and write it on the row.
Watch for: making yourself the backup for everything. That relocates the failure point to the owner instead of removing it.
What done looks like: every row above the line has either a named backup who has done the task alone at least once, or a written procedure that someone other than its author has followed start to finish without asking a question.
How do you keep a vendor relationship from becoming a single point of failure?
Step 5 of 6: re-anchor vendor relationships to the company. A vendor relationship is safe when it survives a change of contact on either side. Three moves get you there.
- Send the introduction. One short email per vendor from the current contact: here is the second person on our account, please copy them going forward.
- Get the facts out of the phone. Account numbers, credit limits, negotiated terms in writing, and the name of the rep's manager all go in the shared drive.
- Keep a warm second source. Open an account with a second supplier and place an order through it once a quarter. Vet a second subcontractor and keep their certificate of insurance on file before you need them.
Run the same check in the other direction. Your largest customers should know two names at your company. If a property manager only ever deals with one of your people, that account leaves when the employee does. Clear ownership helps here, and the orphaned-task audit for roles and responsibilities is a useful companion to this step.
What done looks like: every vendor above the line has two contacts on each side, and the terms exist somewhere other than a text thread.
How do you test whether the business still has a single point of failure?
Step 6 of 6: run the phone-off test. Everything so far is a claim. This step is the proof. Take the highest-ranked person on your list and schedule a real day off for them, announced a week ahead, phone off. Ask the team to keep a stuck log: every moment someone could not proceed, what they needed, and what they did instead.
Each line in that log is one of two things. It is a row you missed in Step 1, or a fix from Steps 3 through 5 that did not hold. Add it to the sheet, score it, and repeat with the next person down. Do the owner last and for two consecutive days. If the prospect of that makes your stomach drop, pair this drill with the longer exercise in building a continuity plan for a month-long absence.
What done looks like: a full day with zero calls to the person who is out and a stuck log with fewer than three entries.
How often should a small business redo its single point of failure map?
Review the sheet for 30 minutes each quarter, and reopen it immediately on four triggers: someone is hired, someone gives notice, a new piece of software is adopted, or a new license, bank account, or major vendor is added. Departures matter most. Admin transfers belong on your offboarding checklist and should happen before the last day, while the person is still there to approve the handover from their side.
There is a second payoff beyond resilience. A company with no one-person dependencies is easier to step back from and easier to hand to a manager or a buyer. That is the operating discipline we care about at Turnkey Services: a business that runs on systems instead of on any one person's attention, the owner's included.
What else do owners ask about a single point of failure in a small business?
What is the most common single point of failure in a small business?
The owner. After that, admin logins: the bank, payroll, the domain, and the Google Business Profile are routinely controlled by one person's email and one person's phone. Access problems are also the quickest to fix, which is why they come first in this walkthrough.
Is it risky to give an employee admin access to banking or payroll?
Less risky than leaving one person with sole access. Use separate logins for each user, role-limited permissions, payment limits, and dual approval where the bank offers it. Two users with an audit trail are safer than one user with a password nobody else has ever seen.
I can't afford two people for every role. What then?
You do not need a second hire. You need a second trained person on the five or six tasks that scored highest, drawn from the team you already have, and a written procedure for everything else. An outside provider who already handles a function, such as payroll or IT, can serve as the documented backup for it.
What if the single point of failure is me?
Run the same six steps with your own name on the rows. Start with access, since you probably hold the bank, the EIN, and the license. Talk to your attorney about who has legal authority to sign for the company if you cannot, because a password manager does not grant that.
How long does removing single points of failure take?
Mapping and ranking takes half a day. Access fixes take about a week, mostly waiting on verification codes and second-user approvals. Cross-training the top rows takes a quarter, because the backup has to perform each task alone more than once before you can trust it.
Frequently asked questions
What is the most common single point of failure in a small business?
The owner. After that, admin logins: the bank, payroll, the domain, and the Google Business Profile are routinely controlled by one person's email and one person's phone. Access problems are also the quickest to fix, which is why they come first in this walkthrough.
Is it risky to give an employee admin access to banking or payroll?
Less risky than leaving one person with sole access. Use separate logins for each user, role-limited permissions, payment limits, and dual approval where the bank offers it. Two users with an audit trail are safer than one user with a password nobody else has ever seen.
I can't afford two people for every role. What then?
You do not need a second hire. You need a second trained person on the five or six tasks that scored highest, drawn from the team you already have, and a written procedure for everything else. An outside provider who already handles a function, such as payroll or IT, can serve as the documented backup for it.
What if the single point of failure is me?
Run the same six steps with your own name on the rows. Start with access, since you probably hold the bank, the EIN, and the license. Talk to your attorney about who has legal authority to sign for the company if you cannot, because a password manager does not grant that.
How long does removing single points of failure take?
Mapping and ranking takes half a day. Access fixes take about a week, mostly waiting on verification codes and second-user approvals. Cross-training the top rows takes a quarter, because the backup has to perform each task alone more than once before you can trust it.