The Event
It usually surfaces as a small, almost administrative question. A buyer’s diligence team, or the advisor prepping the data room, asks who has access to the domain registrar, the cloud console, the payroll system, the shared email admin account.
There’s a pause. Then the answer comes back: one person. Usually the founder. Sometimes an early hire who’s been there since the beginning and never left.
This isn’t a red flag in the sense of wrongdoing. It’s just how most owner-led companies actually run. Nobody sat down and decided to build it this way. It just never came up until someone from outside the business asked.
What It Costs
A buyer doesn’t experience this as a technical gap. They experience it as a question about what they’re actually buying: a business, or a business that only works as long as one specific person is reachable, healthy, and cooperative.
That question shows up before any deal paperwork gets drafted. The most common shape it takes is a longer transition services agreement, tying the founder to the business well past the date they expected to be done, sometimes for nothing more than being reachable if a password is needed. It also shows up as a flatter multiple outright: a business that depends on one irreplaceable person for its own operations reads as smaller and riskier than the same business would with documented, transferable access. (The escrow, holdback, and insurance mechanics that follow a specific security finding are their own piece in this series. This one is earlier and narrower: it’s about what a buyer decides before any of that gets negotiated.)
There’s also a cost that has nothing to do with deal terms at all. Diligence runs on a timeline. If the one person with access is unavailable for a week during that window, the process doesn’t pause to accommodate it.
What to Do This Week
- List every system that depends on one person’s login: domain registrar, cloud hosting, financial software, email administration, and anything else that would stop a transaction cold if that person were unreachable
- Name a second person for the systems that matter most, even if it’s just financial and domain access to start
- Write the access list down somewhere a diligence team could actually review, not somewhere it only exists as institutional memory
- Stop there for now. This week is about knowing the shape of the problem, not fixing it all at once
When to Call Someone
The moment worth watching for isn’t a security incident. It’s the moment in a sale conversation when the client can’t answer a basic access question without a long pause, or answers it with a name that’s also the only name on everything else. That’s the point where the gap moves from theoretical to something a buyer will actually find.
Line for the Email
I’m going to flag this in the sale process before a buyer finds it first.
References
Source: J.P. Morgan, “Introduction to Business Succession Planning”