When a Single Specialist Becomes a Critical Business Dependency

01Find indispensable work, not merely indispensable people

Identify tasks whose interruption would threaten a priority product, safety function, regulatory deadline or restoration sequence. Then map the required knowledge, authority, access and equipment for each. Asking “Who would be hard to replace?” produces subjective popularity rankings; asking “Which task cannot be completed without this person?” yields a testable dependency.

Use BIA and recovery workflow reviews to surface expert approval, maintenance, application administration, product release and external liaison steps. A person may not be the only technical expert but may be the only individual permitted to sign, access an encrypted system or contact the authority. Distinguish these different bottlenecks before selecting controls.

A single specialist can be hidden in approval chains rather than in organizational charts. For example, a plant may have three qualified operators but only one employee permitted to reset a specific system. Follow the work transaction end to end and look for steps that require a unique credential, experience or external relationship. This reveals more than a generic talent-retention discussion.

Technical context: ISO/TS 22317:2021 — Guidelines for business impact analysis is one verified source for the concepts discussed here.

02Separate tacit know-how from formal authorization

Some expertise can be documented and transferred; other functions require a license, experience, external accreditation or a formal delegation. A written procedure does not confer professional competence or legal authority. Assess the underlying task, error consequences and supervision conditions. Where substitute staff cannot legally perform the work, plan for a qualified external provider or a safe suspension route.

Information access is another distinct risk. A backup person who lacks secure credentials or equipment cannot execute an otherwise understood process. Coordinate with security and HR to create controlled emergency access without sharing personal passwords or weakening accountability.

Keep separate records for documented knowledge, professional qualification and authorization. A deputy may know what to do but lack the legal license to perform it. Another person may be qualified but unable to obtain the necessary emergency access. Treat each gap with an appropriate control. A document library cannot substitute for regulated competence or secure delegated authority.

03Design a competence-based backup rather than a name in a column

Appoint deputies against each essential task, but require demonstration through observed work, supervised practice or scenario testing. Training attendance does not prove the ability to handle a rare failure. For complex processes, maintain a skill matrix that distinguishes familiar, supervised and independently competent performance. Include periodic refresh where knowledge is used infrequently.

Multiple backups can be justified for remote locations or shifts. However, forcing every person to master every specialized task may be inefficient. Compare cross-training, job rotation, supplier on-call agreements and technology redesign according to risk and cost. The goal is reliable substitute capability, not merely a larger training record.

Observe the backup during a real or safely simulated task. They should locate the current instruction, identify stop conditions, use approved tools and document the result without hidden coaching. If performance depends on the primary specialist being reachable, classify the backup as partial rather than fully effective. This honest distinction makes training and resource decisions more useful.

04Capture decision logic that ordinary instructions omit

Critical specialists often know exceptions, equipment quirks and unofficial workarounds that never enter controlled documentation. Interview them about fault diagnosis, prerequisites, escalation boundaries, safe stops and known failure patterns. Observe a real transaction and create a usable decision tree or operating note that another competent person can follow. Validate the record through a walk-through by the deputy, not just specialist approval.

Protect sensitive details while ensuring timely access. A complete recovery manual locked behind the missing specialist’s credentials is ineffective. Define custodians, secure storage, offline access where appropriate and revision triggers after system changes.

Informal know-how can be converted into decision support by asking the specialist to explain common misdiagnoses, warning signs and criteria for escalation. Capture the logic in controlled troubleshooting guidance, not simply a recording of keystrokes. Ask a competent reviewer who was not involved in writing it to follow the route and challenge ambiguous steps.

05Challenge vendor and location dependencies

An individual may work for a supplier rather than the organization. Check contractual support coverage, geographic reach, replacement qualifications and the expected response during a regional event. An outsourced “24/7 support” label may hide one engineer covering several customers. Include the supplier’s escalation route and capacity evidence in the dependency assessment.

Consider travel restrictions, transport outages and illness affecting an entire location. A substitute in the same room is not always independent. Where the work depends on specialist tools, confirm access to those tools and spare parts as well as human competence.

Supplier support should be checked for common-mode dependency. An external company may promise coverage yet rely on the same specialist who already serves the organization. Request an actual escalation structure and qualified alternative. Where the facility lies in a remote region, examine travel and spare-part access. A strong service contract is not proof of immediate on-site capability.

06Exercise sudden unavailability realistically

In a controlled test, assume the key specialist cannot be contacted. Ask the deputy to perform the essential activity, locate the documentation, obtain authorization and resolve a realistic exception. Observe recovery time, decision quality, safety checks and gaps in equipment access. Avoid quietly allowing the specialist to coach the team during a supposedly independent exercise.

The exercise should be safe for the task and environment. Some high-consequence operations require simulation or supervised practice instead of live failure injection. Record what was proven, what remains assumed and any temporary risk acceptance. ISO 22398 provides exercise guidance adaptable to such testing.

During an exercise, remove the specialist from the communications list and observe who can make the decision next. For high-consequence equipment, use a simulation or supervised environment rather than risking an actual failure. Track time to recognize the problem, obtain authority, perform the task and verify safe results. These are more meaningful than a course-attendance percentage.

07Keep expertise resilience connected to workforce changes

Review critical-role dependencies during resignations, retirements, reorganizations, major projects and technology modernization. Succession planning alone is insufficient if the replacement role lacks access, practical experience or decision authority. Define an owner who will monitor competence currency and refresh operating evidence after material change.

Report concentrations that cannot be eliminated immediately with clear mitigation and residual exposure. Some organizations may rationally retain a rare expert dependency while maintaining an external standby contract or safe shutdown option. That is a transparent risk decision, not proof of complete continuity resilience.

When the specialist moves to another role, treat the change as a control redesign event. Review whether training, access delegation, technical instructions and external support remain current. The human resources succession plan should be reconciled with business continuity and access control records. Explicitly accept any rare dependency that remains unmitigated with an informed management decision.

Closing Perspective

Single-person dependency is a problem of demonstrable task capability and authority. It is reduced by verified substitutes, accessible decision knowledge, realistic testing and honest treatment of tasks that cannot be delegated safely.