Workforce continuity and key-person risk management is the pre-incident risk discipline of finding where critical work depends on too few people and reducing that exposure before disruption. It is different from a people recovery strategy, which explains how the alternate workforce is mobilized after an incident.
Identify dependencies at activity level
Use the BIA, process maps and operational interviews to find dependencies on unique technical knowledge, regulatory licences, privileged credentials, signing authority, customer relationships, language capability and undocumented workarounds. Tie every dependency to a critical activity and the time at which absence becomes unacceptable.
Measure concentration, not just named backups
A primary and deputy can still represent one failure point if they share the same office, transport route, supplier team, authentication mechanism or manager. Challenge correlated absence and geographic, organizational and technology concentration.
| Risk question | Weak evidence | Stronger evidence |
|---|---|---|
| Who can perform the task? | A deputy is named | Deputy has current competence and recent rehearsal |
| Can they act? | Manager says yes | Access and delegated authority are verified |
| Can both be lost? | Not considered | Shared-location and shared-dependency scenarios tested |
| Is knowledge transferable? | Procedure exists | Alternate completed representative work independently |
Prioritize treatment
Rank dependencies by criticality, time sensitivity and difficulty of replacement. Treatment can include cross-training, documented procedures, rotation, succession, emergency access, contracted standby capability, redesigned approval paths or removal of unnecessary specialist dependency. A backup name alone is not treatment.
Govern succession and authority
Confirm temporary decision authority, spending limits, external communication authority and privileged access can transfer when required. Define who approves the transfer, its limits and how it is withdrawn. Review these arrangements when roles, systems or organizational structures change.
Assurance measures
- Percentage of critical roles with independently tested alternates.
- Critical activities with only one credential or licence holder.
- Overdue cross-training and succession actions.
- Primary/alternate pairs exposed to the same disruption.
- Time since each alternate last performed or exercised the role.
- Open workforce-risk treatments beyond their target date.
Reviewer challenge
Select the individual whose unexpected absence would cause the greatest operational impact tomorrow. Remove them from the scenario and ask who performs each critical decision and task, with what access, authority and evidence of competence. Any answer that depends on contacting the absent person is an unresolved key-person risk.
Turn the analysis into recovery capability
Once critical people dependencies and treatments are understood, use People Recovery Strategy to define the incident-time staffing ladder, mobilization sequence, minimum service, shift endurance and end-to-end exercise acceptance criteria.
Identify capability dependencies, not only named people
Key-person risk exists when an essential outcome depends on knowledge, authority, credentials, relationships or access held by too few people. Map the capability first, then identify primary and alternate personnel. Include approval rights, privileged accounts, specialist certifications, supplier contacts, physical access and tacit operational knowledge. This avoids treating a succession list as proof that the work can actually continue.
Define minimum staffing by role and shift
For each critical activity specify the minimum roles, competencies and headcount needed at each stage of disruption. Consider 24-hour coverage, travel restrictions, caring responsibilities, fatigue and simultaneous incidents. A single alternate is rarely enough for a prolonged event. Define maximum safe shift length, handover requirements and the point at which additional staff or external support must be mobilized.
Prove alternates can perform
Cross-training is not complete when a course is attended. Alternates should demonstrate the task using the systems, records and approvals required in production-like conditions. Test access before an incident, including remote access and emergency credentials. Where segregation of duties is mandatory, ensure the continuity arrangement preserves the required independent roles rather than bypassing controls for convenience.
Protect knowledge and decision authority
Capture critical procedures, decision criteria, contact paths and recovery sequences in controlled repositories accessible during disruption. Record who may delegate authority and how emergency delegation is documented. For specialist knowledge that cannot be fully documented, establish shadowing, rotation or external support arrangements and test that the backup resource can be reached within the required time.
Exercise simultaneous unavailability
Test scenarios where several key people are unavailable at once, including the normal incident leader. Measure mobilization time, staffing achieved, task completion, error rate and handover quality. Continue long enough to expose second-shift and fatigue issues. Any failed competency, access or staffing requirement should become a corrective action with an owner and retest date.
Monitor concentration and change
Review workforce dependencies after restructuring, outsourcing, role changes, system changes and turnover. Useful indicators include critical roles with no demonstrated alternate, expired credentials, excessive overtime during tests, and actions overdue from workforce exercises. The desired outcome is not “two names per role”; it is demonstrated capacity to sustain the critical service for the required duration.
Scenario-based workforce decisions
Use scenarios that remove different forms of availability. A transport disruption tests geographic concentration; an identity outage tests whether alternates can authenticate; a health event tests simultaneous absence; and a cyber incident may remove both people and normal collaboration tools. For each scenario, define the minimum roles required, the latest mobilization time and the authority that can reprioritize staff between competing services.
Where contractors or specialist suppliers form part of the minimum team, verify contractual call-out arrangements, access sponsorship and replacement lead times. Do not count an external resource as available solely because a contract exists. Evidence should show that the resource can be contacted, cleared, connected and productive within the continuity target. Revalidate this evidence when contracts, locations, systems or security controls change.
Operational validation checkpoint for Workforce Continuity & Key-Person Risk: Identify and Reduce People Dependencies
For Workforce Continuity & Key-Person Risk: Identify and Reduce People Dependencies, the most useful quality test is whether the organization can identify roles where one person, credential, relationship or specialist skill can stop a critical service and convert that dependency into tested coverage. A credible implementation should be supported by key-role register, alternates, cross-training evidence, delegated authority, access rights, workload capacity, documentation and exercise results. Reviewers should be able to trace those artifacts to an accountable owner and to the critical service, scenario or decision they are intended to protect. If the evidence is old, generic or disconnected from the actual operating environment, treat the gap as an improvement item rather than assuming the documented approach will work during disruption.
A practical failure mode for Workforce Continuity & Key-Person Risk: Identify and Reduce People Dependencies is naming a backup person who has never performed the task, cannot access required systems or lacks the authority to make time-critical decisions. Challenge that assumption in a walkthrough, exercise, test or evidence review that reflects realistic constraints. The corrective action is to require alternates to demonstrate the role under realistic conditions and track unresolved single-person dependencies as explicit continuity risks. Record the decision, owner, due date and proof required for closure so the improvement can be verified instead of remaining a narrative recommendation.
- Decision: state what must be decided, triggered or recovered when this capability is used.
- Evidence: identify the current artifact or test result that proves the capability exists for Workforce Continuity & Key-Person Risk: Identify and Reduce People Dependencies.
- Dependency: name the person, system, supplier, facility, data source or authority that can prevent the outcome.
- Threshold: define the point at which the current approach is no longer sufficient and escalation is required.
- Verification: specify how the owner will demonstrate that the corrective action materially improved the capability.
Connect this review to People Recovery Strategy: Mobilize Minimum Competent Staffing After Disruption so the decision does not sit in isolation. Workforce Continuity & Key-Person Risk: Identify and Reduce People Dependencies should remain consistent with the wider BIA, recovery strategy, crisis governance and exercise evidence that apply to the same service.