A practical framework to identify key people, assess risks, and decide what to do next.
Founders spend most of their time finding market fit, checking out competitors, hiring, fundraising, attending board meetings and analyzing financials and projections. In CEE markets, where startups and scaleups are founder heavy, one type of question is rarely asked: “What if our CTO is unavailable for 30 days”.
It is not merely about mortality – burnout, sudden departures, illness, or even paternity leave can remove someone from the team overnight. For startups and scaleups, such loss can be detrimental – not because competitors got better, but because a team member was irreplaceable. This raises an uncomfortable question: do you know who in business plays a make it or break it role?
Why key people matter more than you think?
Corporations build redundancy into every function: if CFO leaves, there are deputies, if Sales VP quits, there is regional head ready to step up. Startups and scaleups rarely have such setup early on.
When you are in the growth phase you are flexible, lean and pivot, people are not just roles – they are the business, they are the face to customers, media and investors.
Business Development is not just about closing deals, they hold most of the client relationships and know their counterparts personally. CTOs are walking technical documentation library. HRs are the beating heart of the company that holds so much of the ethos of the company.
That is why identifying the key people is not just about job description but also about impact, dependency and risk mitigation. Situations where this is important are not that rare actually. Check these scenarios:
- A UK investor required continuity measures before releasing funds. A CEE startup paused closing for two weeks until key roles were mapped and mitigations documented. Lesson: map roles early to avoid conditional funding surprises.
- A compliance officer named on licenses became unavailable. Onboarding froze. Naming a deputy, restoring access, and documenting workflows reopened the pipeline. Lesson: assign deputies for named responsibilities.
Key Person risk framework
So, how should the process of assessing key person risk look like?
Step 1: map business-critical functions
List the functions that could stall your business within weeks. Of course, it depends on the business sector and business model. For startups and scaleups that would be:
- fundraising,
- product development,
- technical architecture,
- regulations and compliance,
- customer relationships.
The first clue that someone is a “key person” is that their function cannot be paused or reassigned without serious consequence – restructuring, cost, delay, loss of quality, loss of market confidence.
Step 2: Run the “what if they vanished?” test
Run through this questionaire:
- Can you find good replacement within 30 days?
- Would customers, vendors notice?
- Would investors ask for a quick zoom call?
- Would operations be disrupted?
- Would a launch be delayed?
- Would a fundraising stall?
If any of the answers pause threat, answer is Yes — the person is a “key person”. This exercise often surprises founders. It’s not always the CEO who emerges as most critical, it might be the technical co-founder, or even a senior employee with a rare certification.
Step 3: Consider factors outside the company
For example: person is GDPR sole point of contact, or sole financial signatory for deadlines. Compliance officer is named on key licenses. Sales lead has admin access to CRM or manages clients worth 60% of the revenue… Maybe founder personal credibility unlocks capital or him/her leaving would trigger bad publicity? Or maybe one of the software engineers has unique knowledge about key code?
The absence of these people is not assessed only on a practical level, often optics impact could be media-related, market confidence-related or investor-related.
Step 4: Sort and group roles – replaceable vs irreplaceable
Fast Replaceability
<30-90 days |
Slow Replaceability
>90 days |
|
High impact | replaceable | Irreplaceable = key person |
Low impact | replaceable | replaceable |
Irreplaceable roles cause immediate disruption to services, product development, cashflow, compliance or fundraising. Prioritize the top-right corner: high impact, slow to replace. Being clear about this difference helps founders prioritize where to focus their energy.
Step 5: Risk management with layered responses
Once you’ve identified your key people, as a founder attention shifts to: how do we manage this risk? Different approaches work together, rather than in isolation.
- Succession planning: keep up-to-date communication, have handover procedures, train deputies, no single person owns a process end-to-end, organizational memory and governance.
- Cross functional overlap: rotation or systematic share of knowledge between founders/heads, dual admins, testing permissions quarterly
- Contractual – shareholder agreements, client contracts, vendor terms, knowledge transfers to reduce dependency on individuals
- Investor communication: Being transparent about how you have assessed and mitigated key person risk during due diligence can strengthen trust during funding rounds.
- Key person insurance: A financial safety net if an irreplaceable founder or executive dies or becomes incapacitated – it ensures the company has resources to stabilize, hire replacements, or satisfy buyout clauses.
A Practical Checklist for Founders
Here’s a straightforward action plan.
Within 30 days:
-
- List your top five most critical roles.
- Run the “what if they vanished?” scenario.
- Identify who falls in the “irreplaceable” category.
Within 90 days:
-
- Start documenting knowledge for irreplaceable roles.
- Cross-train team members where possible.
- Review shareholder agreements for buyout obligations.
- Review access hygiene.
Before major business events or funding round:
-
- Report on key person risk to your co-founders/board.
- Consider Key Person Insurance if the absence of one person would materially affect investors’ confidence.
- Present a simple risk-mitigation plan to investors, it signals maturity and foresight.
- Assemble Continuity pack for the data room.
Key person risk management is a mature business practice. The founders who systematically identify these dependencies and plan for them build companies that can weather unforeseen changes and attract and retain investors who value operational maturity.