For many UK SMEs, the most serious technology risk is not a failed server, a ransomware incident or an expired support contract.
It is the person who knows how everything works, and is the only person who knows.
That individual may understand the business rules inside a critical application, remember years of undocumented workarounds, hold privileged access, know which suppliers to call and understand how to recover the system after an outage. If they resign, become seriously ill or simply become unavailable, the organisation may discover that its disaster recovery plan was built around one human being.
That is not resilience. It is dependency with a salary attached.
The issue is particularly acute for organisations running IBM i Management environments, including Power Systems and AS/400 estates. These platforms can remain highly dependable for decades, but the expertise surrounding them is becoming harder to replace.
According to Fortra’s 2026 IBM i Marketplace Survey, 69% of respondents identified finding IBM i technologists as their top concern. That overtook cybersecurity for the first time.
The message for UK SMEs is clear: key-person risk belongs in the same conversation as cybersecurity, compliance and business continuity.
Why the risk is greater than it appears
A single specialist often carries several types of knowledge at once:
- How the platform is configured
- Which applications depend on which databases and jobs
- What can safely be changed
- How backups are performed and restored
- Which suppliers support the environment
- Why apparently unusual settings were introduced
- How to respond when a normal procedure fails
Much of this knowledge may never reach a formal document. It lives in notebooks, memory, email threads and the phrase, “Just ask Dave.”
That creates a single point of failure across people, processes and technology.
The risk is also increasing because the platform is not standing still. IBM’s recent IBM i 7.6 TR2 enhancements and IBM i 7.5 TR8 enhancements include developments in security, database services, administration and high availability. These updates create opportunities, but they also require structured assessment and competent planning.
A business cannot make sensible decisions about upgrades, recovery, security or modernisation if only one person understands the starting point.
Five practical steps to remove the single point of failure
1. Map the dependency before trying to solve it
Start with a structured dependency review rather than a vague request for “better documentation”.
Identify:
- Critical business services
- Supporting applications and databases
- Infrastructure dependencies
- Privileged accounts
- Backup and recovery processes
- Internal and external contacts
- Scheduled jobs and integrations
- Known manual workarounds
- Regulatory or customer obligations
For each dependency, record who understands it, who can administer it and who can recover it.
The result should be a practical service map, not an encyclopaedia. The objective is to show what would stop working if the expert was unavailable for one day, one week or one month.
2. Turn personal knowledge into controlled operational knowledge
Documentation must be usable by another competent person under pressure.
Prioritise the procedures that matter most:
- Starting and stopping critical services
- Checking backup completion
- Performing a test restore
- Escalating a major incident
- Managing privileged access
- Applying approved changes
- Contacting suppliers
- Recovering core applications
- Reverting an unsuccessful update
Store the documentation in a controlled location with version history, ownership and review dates. Avoid keeping the only copy on a departing employee’s laptop or in a private mailbox. That is not document control; it is digital folklore.
3. Establish a second line of capability
Cross-training is not the same as sending someone a manual.
A second person should be able to observe, practise and eventually perform important tasks under supervision. This may include an internal employee, an outsourced specialist or a trusted channel partner.
The right model is often a small capability network:
- One business owner
- One internal operational contact
- One strategic IT consultant
- One specialist technical resource
- Clearly defined escalation routes
This is where a consultancy-first approach adds value. The role of the Fractal IT Director is to connect business priorities, risk, systems and suppliers into a coherent operating model, rather than simply waiting for a helpdesk ticket.
4. Test recovery without the key person present
A recovery plan that has never been tested is an assumption.
Run a practical exercise using a scenario such as:
The primary IBM i specialist is unavailable on the morning of a critical processing failure.
Ask the team to:
- Identify the affected service
- Locate the relevant documentation
- Access the required credentials through the approved process
- Contact the correct technical resources
- Confirm backup availability
- Restore or fail over where appropriate
- Communicate with affected users and customers
- Record the lessons learned
This should form part of a broader Disaster Recovery programme. Recovery time objectives and recovery point objectives must be based on business impact, not on what the current expert happens to believe is achievable.
5. Link succession planning to technology decisions
Key-person risk should influence investment decisions.
For example, replacing a server may not reduce the underlying risk if the organisation still has one person who understands the application environment. Conversely, moving everything to the cloud may introduce new dependencies if identity, integrations, data ownership and recovery responsibilities are not properly designed.
The answer may involve a combination of:
- Targeted modernisation
- Better monitoring
- Specialist support
- Improved documentation
- Staff development
- Resilient hosting
- Cloud Solutions
- Formal supplier management
- A controlled technology roadmap
The strategic question is not “Should we keep or replace the platform?” It is “How do we make the business independent of one person while preserving reliable business operations?”
What an ISO 27001 assessor would ask
An ISO 27001 assessor is unlikely to accept “our expert has always dealt with it” as evidence of control.
They may ask:
- Which roles would materially affect the business if unavailable for two to four weeks?
- Where is key-person dependency recorded in the risk register?
- What information assets, systems and services depend on that person?
- Who owns the risk?
- What treatment has been selected?
- What documented procedures allow another person to take over?
- How are privileged credentials controlled?
- Can another person contact the relevant suppliers?
- When was the recovery process last tested?
- What evidence shows that backup restoration works?
- What events trigger a review of the risk assessment?
- How is key-person risk reflected in the Statement of Applicability?
The key point is that ISO 27001 is not merely about having policies. It is about demonstrating that risks are identified, owned, treated and reviewed.
A staff departure, major role change or significant platform update should trigger a reassessment.
Where Cyber Essentials fits
Cyber Essentials provides a baseline for protecting organisations against common online threats. Its five technical control areas include firewalls, secure configuration, security update management, user access control and malware protection.
Those controls are important, but they do not remove key-person risk by themselves.
A UK SME should ask:
- Can patching continue if the usual administrator is absent?
- Are administrative accounts controlled independently of one employee?
- Can another authorised person access security information?
- Are critical devices and systems included within scope?
- Are backup and recovery arrangements protected from unauthorised access?
- Do access reviews happen when someone changes role or leaves?
Cyber Essentials provides a technical baseline. ISO 27001 provides a broader management system for understanding and treating risk. Key-person resilience sits between the two.
Modernisation does not remove the need for expertise
Many organisations are considering new business systems alongside legacy platform resilience.
Microsoft’s Dynamics 365 Business Central 2026 release wave 1 focuses on automation, governance, reporting, finance, supply chain and AI-enabled processes. The associated major release is version 28.
That may make Business Central attractive, but implementation is not a software installation exercise. It requires decisions about:
- Business process design
- Data quality and migration
- Integration with existing systems
- User roles and access
- Reporting and controls
- Testing and acceptance
- Training and operational ownership
- Cutover and fallback planning
A Dynamics 365 Jump Start should therefore begin with discovery and risk assessment, not a product demonstration. The organisation needs to understand what must be preserved, what should be changed and which knowledge cannot be lost during transition.
Implementation support is most valuable when it connects the new platform to the wider technology strategy. The consultancy should provide the architecture, governance and decision-making discipline. Specialist partners can then deliver defined technical components where required.
How Technology Expense Management can fund resilience
Resilience work is often delayed because it is seen as an additional cost.
Technology Expense Management can change that calculation by identifying recoverable cost elsewhere in the estate.
A structured review may find:
- Duplicate connectivity services
- Unused or over-allocated software licences
- Overlapping support contracts
- Out-of-contract cloud spend
- Retired users still consuming subscriptions
- Unnecessary mobile or Voice and Connectivity charges
- Hardware and maintenance that no longer support business requirements
The recovered budget can then fund practical resilience measures, such as:
- A second specialist resource
- Documentation and knowledge transfer
- Backup testing
- Additional connectivity
- Monitoring
- Security improvements
- Staff training
- A formal recovery exercise
This is not cost-cutting for its own sake. It is cost rationalisation that redirects money from low-value consumption into risk reduction.
The consultancy-first operating model
Managed IT Services can provide valuable execution, but they should support a strategy rather than become a substitute for one.
The same principle applies to Network Solutions, Helpdesk Support, Cloud Solutions, Voice and Connectivity, hardware and software licences. These are execution services: important bolt-ons that help deliver the agreed operating model.
The strategic work comes first:
- What does the business need to protect?
- Which systems are genuinely critical?
- Where is knowledge concentrated?
- What should be modernised?
- What should remain stable?
- Which risks can be accepted?
- Which costs can be recovered?
- Which specialist partners are needed?
A Fractal IT Director approach treats the business as a system of connected dependencies. People, platforms, suppliers, security, continuity and cost are considered together.
The objective is not to eliminate expertise. It is to ensure expertise is shared, governed and available when the business needs it.
Final assessment
If your only specialist leaves tomorrow, could another competent person:
- Understand the environment?
- Access the required information?
- Contact the right suppliers?
- Restore critical services?
- Explain the risks to management?
- Continue the recovery process without guesswork?
If the answer is no, your largest disaster recovery gap may not be technical.
It may be organisational.
Start with a dependency map. Document the essential procedures. Build a second line of capability. Test recovery without the key person. Use Technology Expense Management to fund the work. Then connect the result to your ISO 27001, Cyber Essentials, modernisation and business continuity plans.
For wider services across the Evestaff group, the gateway is evestaff.co.uk.
SEO tags: IBM i Management, Disaster Recovery, Dynamics 365 Jump Start, Technology Expense Management, ISO 27001 consultancy, Cyber Essentials UK, key-person risk, business continuity, Managed IT Services, Cloud Solutions, Network Solutions, Helpdesk Support, Voice and Connectivity, UK SME IT consultancy
Join The Discussion