Key Man Risk (Key Person Risk): Meaning, Assessment and How to Reduce It

The owner says everything is documented. Then the sales manager who has looked after the two largest customers for twelve years hands in her notice, and nobody else has met the people who sign the orders.

Key man risk – also called key person risk – is the risk that a business loses money, customers or the ability to operate when one specific person leaves, falls ill or dies. In most small and mid-sized companies it is not an insurance problem but a knowledge problem: pricing rules, customer relationships and know-how that live in one head and nowhere else.

By Indrek Põldvee, co-founder of Xhive · Reading time ~11 min

What is key man risk?

Key man risk is the exposure a company carries when a disproportionate share of its revenue, decisions or operational know-how depends on one individual. If that person stops being available – because they resign, retire, sell the company, get sick or die – the business loses something it cannot quickly replace.

The person is often the founder or owner, but not always. In many companies the key person is someone without a senior title: the sales manager who has handled the two largest customers for fifteen years, the warehouse lead who knows which supplier will deliver on a Saturday, or the bookkeeper who is the only one who understands how the old pricing spreadsheet really works.

A simple test: if this person were unreachable from Monday for three months, what would stop, slow down or go wrong? If the honest answer is "quite a lot", you have key man risk.

Key man risk, key person risk, key person dependency: what's the difference?

The terms describe the same thing from slightly different angles:

We use "key person risk" in the rest of this article, but everything applies equally to key man risk.

Why is key person risk a knowledge problem, not an insurance problem?

Search for "key person risk" and most of what you find is written by insurers. Their answer is key person insurance: a policy that pays the company a sum of money if a named person dies or becomes disabled.

Insurance can be useful. It buys time and covers lost profit while you recover. But it solves only the financial part of the problem. Insurance replaces money, not knowledge. The payout does not tell you which customers had a side agreement on payment terms, how the production scheduling actually works, or why the company never works with a particular supplier.

Research supports this. In a study published in the Review of Finance in 2022, economists Sascha Becker and Hans Hvide used Norwegian tax data on about 1,500 entrepreneurs who died unexpectedly. For larger startups, the average effect on sales was around 60%; for smaller ones, the loss showed up as lower survival. The key finding was why: the damage came from the entrepreneur's personal "specialness" – their specific knowledge and relationships – rather than from the leadership change itself. When the founder was only a financial investor and not running the business, the effect was much weaker.

In other words, the business did not suffer because the money left. It suffered because what the person knew left with them.

How big is the risk? What the research shows

There is no single study that measures key person risk across all companies, but several reliable sources point in the same direction.

• Knowledge is rarely captured. A 2025 APQC survey of 1,000 organisations found that only 8% consistently capture knowledge from employees who retire, and 16% do not try at all. The most common reason was simply not having enough time.
• Much of a person's knowledge is theirs alone. A 2018 Panopto/YouGov survey of US knowledge workers estimated that 42% of institutional knowledge is unique to the individual who holds it. The study was vendor-sponsored and covers large US employers, so treat the exact number with care. In small companies, where one person often covers several roles, the share is likely to be higher rather than lower.
• Replacing someone is slow and expensive. Research summarised in MIT Sloan Management Review (2005) found new professionals need about 20 weeks to reach full productivity and executives more than 26 weeks. Gallup (2019) estimates the cost of replacing an employee at one-half to two times their annual salary – and calls that conservative.
• Illness and death are a real cause of closures. McKinsey's 2026 report on small-business ownership transitions, based on US Census data, notes that roughly 6% of business closures are caused by the owner's illness or death.
• The risk spikes when ownership changes. Research by Wharton's Daniel Kim (2024), using US Census data on around 4,000 startup acquisitions, found that 33% of acquired employees left within a year, compared with 12% of comparable regular hires – and that these departures could largely be predicted before the deal.

The pattern is consistent: knowledge concentrates in a few people, almost nobody captures it systematically, and the cost appears suddenly – usually at the worst possible moment.

Key person risk examples

Key person risk shows up in a handful of recurring forms. The examples below are illustrative composites, not specific companies.

• The owner who is also the salesperson. The top ten customers buy because of a personal relationship with the owner. Nobody else has met their decision-makers.
• The pricing keeper. Quotes are produced by one person using a spreadsheet, rules of thumb and memory of past deals. Margins quietly fall when someone else tries.
• The supplier whisperer. One buyer knows which supplier can be pushed, which one is reliable in a crisis and which terms were negotiated verbally years ago.
• The systems person. The ERP, the integrations or the old database were set up by one person. Documentation is "in their head" or in a folder only they can interpret.
• The licence or compliance holder. A permit, certification or regulatory relationship is tied to a named individual.

Most companies have at least two of these. The danger is highest when the same person appears in several categories – usually the owner.

How do you assess key person risk?

You can get a first estimate in under an hour. Answer the ten questions below with a simple yes or no. Every "yes" adds one point.

Key person risk score – 10 questions

How to read the score

This scoring framework is our own practical tool, not a validated academic scale. Its value is in forcing specific answers to questions most owners never ask out loud.

To go one step further, list your critical tasks and plot each one on two axes: how unique the knowledge is (how many people could do this today) and how big the impact is if it stops. Tasks in the top-right corner – high impact, held by one person – are your real key person risk. That is where to start.

How do you reduce (mitigate) key person risk?

Reducing key person risk is not about making people replaceable. It is about making sure the business does not stop when one of them is unavailable. Six levers work in practice, roughly in this order:

1. Map who knows what. You cannot reduce a risk you have not located. Use the matrix above and be honest: titles and org charts are misleading. The question is not "who is responsible" but "who actually knows".

2. Interview the key people – about real situations, not processes. If you ask an experienced person "how do you do your job?", you get the official process. The valuable knowledge – judgement, exceptions, who to call – comes out when they describe specific events. This is the principle behind the Critical Decision Method, an interview technique developed in 1988 by Gary Klein and colleagues to capture the expertise of fire commanders. Ask: "Tell me about the last time something went wrong that only you could fix. What did you notice first? Who did you call? What would a newcomer have done?"

3. Give every key customer a second contact. For each important customer, make sure at least one other person has a real relationship with their decision-maker – not just a name in the CRM.

4. Write down decisions, not just procedures. Procedures describe the normal case. Businesses fail on the exceptions. Record the pricing rules, discount logic, supplier history and "why we don't do X" – the reasons behind decisions.

5. Pair and shadow. Software teams raise their bus factor by having two people work on critical code. The same works for pricing, purchasing or key accounts: a second person handles the task under supervision until they can do it alone.

6. Use contracts and insurance last, not first. Retention agreements, notice periods and key person insurance protect you financially. They do not reduce the underlying risk, so treat them as the final layer.

A practical timeline: steps 1–2 can be done in a few weeks. Steps 3–5 take months, because relationships and skills need time to transfer. That is why the best moment to start is before anything has happened.

A 30-day plan to reduce key person risk

If your score above came out at 3 or more, this plan moves the most important knowledge out of one head and into the business within a month. It needs one owner or manager to drive it and about two hours a week.

Week 1: Find the key people

• Answer the 10 questions with two or three managers separately, then compare the answers.
• List your 15 to 20 critical tasks and plot each one on the risk matrix.
• Name the people in the top-right corner. In most small companies there are two to four.

Week 2: Interview them

• Book 60 minutes with each key person. Explain the purpose: keeping the business running, not replacing them.
• Ask about real situations, using the interview questions below. Record the conversation if they agree.
• Check the most important answers with one colleague.

Week 3: Write down decisions and name backups

• Turn each interview into a one-page summary: customers, pricing rules, suppliers, systems and recurring exceptions.
• Name a backup person for every task in the top-right corner of the matrix.
• Book the first customer meetings where the backup joins the key person.

Week 4: Test it

• Let the backup handle one real task from start to finish while the key person only observes.
• Fix what went wrong and update the one-page summary.
• Put a quarterly review in the calendar and score the 10 questions again.

Checklists you can use today

Copy these into your own document or task list. Each item is something you can check off in one sitting.

What to capture from each key person

• Customers they own: decision-makers, history, informal agreements and open issues
• Pricing: how non-standard prices and discounts are set, and where the limits are
• Suppliers: real terms, verbal agreements and who to call in a crisis
• Recurring tasks they do weekly, monthly or yearly that nobody else does
• Approvals and decisions they make alone
• Systems, spreadsheets and files only they use, and where they are stored
• Access rights they control (transfer these through your administrator or password manager, never in a document)
• Outside contacts: accountant, bank, authorities and partners
• Known exceptions and workarounds
• What a successor would most likely get wrong in the first month

10 interview questions for a key person

1. Tell me about the last time something went wrong that only you could fix.
2. What did you notice first that told you something was off?
3. Who did you call, and why that person?
4. What would someone new in your role have done differently, and what would it have cost?
5. Which customer would be unhappy within a month if you were away?
6. Which decision do you make every week that is not written down anywhere?
7. Where is the history of that decision stored?
8. What did you have to learn the hard way when you started in this role?
9. How long did it take before you stopped asking your predecessor questions?
10. If you were away for three months from Monday, what would break first?

Customer second-contact checklist

• For each top-ten customer, write down who holds the relationship today
• Name a second person for each customer and introduce them in a real meeting, not only by email
• Make sure the second person knows the customer's decision-maker, buying cycle and special terms
• After six months, check that the customer has contacted the second person directly at least once

How Xhive approaches key person risk

Xhive does this work as a structured service for owners and for buyers of owner-run companies. The method has three steps:

1. Interview. We talk to the owner, the managers and the specialists who hold the knowledge. Each question builds on the previous answer and asks about real situations, not about the official process.
2. Check. We compare the answers with each other and with the company's documents. Where they differ, we ask again.
3. Map. The result is a map of who knows what. Each critical item gets one of three marks: write it down now, automate it, or already in place.

A person reviews every finding before it goes into the report. Owners use the map to prepare for a sale, a succession or a long absence. Buyers use it during due diligence, before signing, while the seller is still available to fill the gaps.

Why buyers care: key person risk in acquisitions

Key person risk matters most when a company changes hands. A buyer pays for future cash flows. If those cash flows depend on a person who is about to leave, the buyer is paying for something that may not survive the deal.

Buyers respond in three ways: they lower the price (advisers commonly cite discounts of 10–25% of enterprise value for strong owner dependency), they shift risk back to the seller through an earn-out, or they walk away.

The research shows how often this is missed. Bain & Company's 2023 M&A report ranked people issues among the least accurate areas of due diligence. McKinsey's 2026 report on small-business ownership transfers lists key person risk as one of the main problems new owners face after a deal – together with sellers who disengage quickly after the sale, leaving little time to pass on what they know.

That last point is easy to overlook. Before signing, the seller is motivated to explain how the business works. After they have been paid, that motivation drops. The best time to capture the knowledge is during due diligence, not during the handover.

If you are buying a company, our M&A due diligence checklist includes a full people and knowledge section. If you are planning to sell, see our guide to exit planning for business owners (coming soon).

Questions owners and buyers ask about key person risk

What is key man risk in simple terms?

It is the risk that a business suffers when one important person is no longer available. The person holds knowledge, relationships or decision-making power that nobody else has.

Is key person risk the same as key man risk?

Yes. "Key man risk" is the older term; "key person risk" is the modern, gender-neutral version. Both describe the same exposure.

Does key person insurance remove key person risk?

No. Insurance pays out money if a named person dies or becomes disabled. It does not preserve their knowledge or relationships, and it usually does not apply if they simply resign or retire.

How do I identify the key people in my company?

Ask which tasks would stop, slow down or go wrong if a person were unavailable for three months, and who else could do each task today. People who appear repeatedly with no backup are your key people – regardless of their title.

How long does it take to reduce key person risk?

Mapping and interviewing can be done in a few weeks. Transferring relationships and skills to a second person usually takes several months, which is why it is best started well before a planned sale or retirement.

Why do buyers discount companies with high key person risk?

Because they are paying for future earnings. If those earnings depend on one person who may leave after the deal, the buyer either lowers the price, adds an earn-out or decides not to buy.

The plain conclusion

Reducing key person risk will not fix a weak business, a bad price or a shrinking market. Key person insurance will not fix it either; it only pays out money.

What it does fix is narrower and still valuable: the business keeps running when one person is not there. Customers have a second contact, pricing logic is written down, and a buyer can see what they are paying for.

Watch out for documentation theater: a handover file that looks complete, but that nobody can actually run the business from. The test is simple. Can the backup do the task alone?

Start with the 10-question score. If it comes out at 3 or more, run the 30-day plan before something forces you to.