Key-person risk appears when critical knowledge, authority or relationships depend too heavily on one individual. The risk may remain invisible until that person is unavailable, changes roles or leaves during a demanding moment.
Identify critical work, not only senior titles
A key person may be an executive, but the same risk can sit with a specialist who understands a reconciliation, vendor connection, customer relationship or regulatory filing that few others can perform. Leaders map important decisions, recurring processes and emergency responsibilities to the people who currently carry them.
The assessment should consider customer impact, financial exposure, control requirements and how long the bank could operate without that knowledge or authority. A popular employee is not necessarily a key-person risk, and a quiet operational role may be critical.
Documentation makes knowledge transferable
Current procedures, decision records, contact lists and system instructions give another qualified person a reliable starting point. Documentation should explain important exceptions and escalation paths, not merely list routine clicks.
A document cannot replace experience or judgment. Owners should walk through the process with a backup and update the record when systems, products or responsibilities change.
Cross-training builds coverage while preserving controls
A designated backup needs supervised practice, access appropriate to the role and feedback on real or simulated work. Rotations and paired reviews can broaden understanding while revealing undocumented dependencies.
Coverage does not justify giving everyone unrestricted access. Segregation of duties, approval limits and least privilege should remain in place, including when temporary responsibilities are activated.
Succession and emergency authority answer different needs
Succession planning develops people who may assume a role over time. Emergency coverage identifies who may act immediately, which decisions they can make and how temporary authority is approved and withdrawn.
Both plans should include leadership, operational and technical responsibilities. A named successor without training, access or decision rights does not provide usable continuity.
Testing shows whether the plan works
Planned absences, tabletop exercises and handover rehearsals can show whether a backup can locate information, complete critical work and escalate unusual conditions. Findings become actions with owners and deadlines rather than informal observations.
The goal is not to make individual expertise unimportant. It is to ensure that valuable expertise strengthens the institution instead of becoming a single point of failure.
Read the primary material
Banking Explained prioritizes regulators, official publications and first-party announcements.