When the Only Person Who Knows the System Takes December Leave: Key-Person Risk for Singapore SMEs

If one person in your company is the only one who can release a payment, unlock the accounting system, approve a discount or answer the WhatsApp line, your operation pauses the moment they go on leave. In a 10 to 30 person Singapore SME this is almost always true, and December is when it gets tested. The fix is not a 60-page continuity manual. It is a two-week exercise you can start this month: list every task only one person can perform, sort each into document, delegate or automate, and clear the top five before leave calendars lock in mid-November.

What does key-person dependency actually look like in a small company?

It rarely looks like a missing manual. It looks like ordinary arrangements that were sensible when the company had four people and never got revisited:

• One Corppass administrator, with no second admin appointed.
• A single authorised approver on corporate internet banking, holding the only hardware token.
• One accounting login with payroll rights, shared informally when needed.
• Two-factor authentication codes landing on one personal mobile phone.
• A WhatsApp Business account registered to an individual's number rather than a company line.
• Suppliers and long-standing customers who will only deal with one named person.
• Pricing logic, credit exceptions and delivery workarounds that exist only in someone's head.
• A website or system built by a vendor whose hosting and domain accounts are in the vendor's name.

Each item on its own is minor. Together they mean your company has a single point of failure with an annual leave entitlement.

Why does December expose this more than any other month?

Four pressures land in the same four weeks. Many SME leave years end on 31 December, so untaken leave gets dumped into the final month. School holidays pull parents out at the same time. Year-end volume rises as customers push for delivery before the shutdown. And the compliance calendar does not pause: a 31 December GST quarter-end, CPF contributions due by 14 January, year-end stocktake and payroll cut-offs all fall on a skeleton crew.

The compounding factor is that your suppliers and bankers are equally short-staffed, so the informal favour that normally rescues you is unavailable. A dependency that costs you two hours in July costs you a shipment in December.

How do you find your dependencies in one afternoon?

Open a spreadsheet with one column for the task and one for every person who can perform it unaided. Work through five prompts, then highlight every row that has exactly one name:

1. Access. Every system the business runs on, and who holds administrator rights: Corppass, bank, accounting, payroll, CRM, email, domain registrar, hosting, e-commerce, WhatsApp.
2. Approvals. Payments, purchase orders, credit terms, discounts, refunds, leave, overtime. Who can authorise each, and what the ceiling is.
3. Knowledge. Tasks with no written procedure: month-end close, the quotation formula, which supplier discounts at what volume, how a recurring customer's order is configured.
4. Relationships. Accounts where the counterparty deals with one person by name and would escalate badly if someone else called.
5. Devices. Any code, token or authenticator app that lives on one physical device.

Most owners find between twelve and twenty single-name rows. You are not going to fix all of them. Rank by what breaks within 48 hours of that person being unreachable, and take the top five.

What should you document first if you only have two weeks?

Write a one-page run sheet per task, not a process manual. Each sheet needs five things: the trigger that starts the task, the steps in order, the system used and where the credentials are stored, who to escalate to when it does not go as described, and what a completed task looks like. Fifteen minutes each is enough. If writing is slow, record a screen capture while doing the task once and attach it.

Two rules make the difference between a document and a working control. Store run sheets in a shared company drive, never a personal folder or a departing laptop. And put credentials in a shared password manager with role-based access, so cover staff receive access to a specific account rather than a WhatsApp message containing a password.

Which dependencies should you automate rather than document?

Documentation transfers work to another human, which only helps if that human has capacity in December. Automation removes the task. A practical dividing line: if it happens weekly or more often and takes under ten minutes, automate it; if it is monthly and requires judgement, document and delegate it.

The highest-return automations for a small team are usually on the customer side, because that is where absence is most visible. Order status self-service stops the flow of "where is my order" calls that only one person can answer. An after-hours auto-reply that states a realistic response window protects the relationship even when nobody is at the desk. Moving recurring supplier payments to standing GIRO instructions removes a per-invoice approval bottleneck. Shifting the enquiry line from a personal mobile to a shared business number means coverage is a permission setting, not a handover.

Some items are neither documentation nor automation, just a five-minute administrative fix that nobody has made time for: appoint a second Corppass administrator, add a second bank approver, add a second named contact to your key supplier accounts.

What does a realistic coverage plan look like between now and December?

Working back from a typical mid-December start to leave season:

• By 10 October: dependency spreadsheet complete, top five identified.
• By 24 October: second administrator added on Corppass, banking, accounting and your customer channel. Password manager in place.
• By 7 November: five run sheets written, and each one executed once by the substitute while the usual owner watches without touching the keyboard.
• By 21 November: leave calendar locked, a named cover person published per function, escalation contacts circulated to staff and to key suppliers.
• December: cover performs the task for real. The usual owner remains reachable for exceptions but is not the first line.

The dry run on 7 November is the part most companies skip and the only part that proves anything. A procedure that has never been executed by the substitute is a document, not a continuity plan. Expect the first attempt to surface a missing permission or an undocumented step, because that is precisely what it is for.

Frequently asked questions

Is a formal business continuity plan legally required for a Singapore SME?

There is no general legal requirement for a small private company to hold a formal continuity plan. Related obligations do exist: under the PDPA you must appoint at least one data protection officer and make their business contact information available, and a notifiable data breach must be reported to the PDPC within three calendar days of you assessing it as notifiable. Neither is satisfiable if the only person who understands your systems is uncontactable, so name a deputy. Government and large-corporate tenders increasingly ask for continuity documentation as a qualifying condition.

What if the single point of failure is an external vendor rather than an employee?

Treat it the same way, but the fix is ownership rather than documentation. Domain registrar, hosting, cloud accounts, code repository and analytics should all be registered in the company's name with your own billing, and the vendor added as a user. Ask for a written handover pack covering architecture, credentials location and deployment steps as a contract deliverable. If a vendor resists holding accounts in your name, treat that as a lock-in risk to price into the relationship.

What is the single cheapest first step if we do nothing else?

Add a second administrator to every business-critical account this week, and move credentials into a shared password manager. It costs under an hour and a small monthly subscription, and it converts the worst failure mode, total lockout, into an inconvenience. Everything else on the list can wait until October.