{"id":71,"date":"2026-11-01T23:09:40","date_gmt":"2026-11-01T17:39:40","guid":{"rendered":"https:\/\/eidoran.com\/insights\/?p=71"},"modified":"2026-11-01T23:09:40","modified_gmt":"2026-11-01T17:39:40","slug":"key-person-risk-startup-due-diligence","status":"publish","type":"post","link":"https:\/\/eidoran.com\/insights\/key-person-risk-startup-due-diligence\/","title":{"rendered":"Key Person Risk in Startups: How Investors Test for It"},"content":{"rendered":"\n<div class=\"wp-block-group has-cream-background-color has-background\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n\n<h2 class=\"wp-block-heading\">The short version<\/h2>\n\n\n<ul class=\"wp-block-list\">\n<li>Key person risk is a person whose absence would stop the product shipping, the revenue running or the system being understood.<\/li>\n\n<li>In a technology company it usually sits with a founder or a first engineer who holds knowledge, access and decisions in one head.<\/li>\n\n<li>Five tests expose it: production, access, knowledge, onboarding and absence.<\/li>\n\n<li>Score each critical system by how many people can run it. One person means the system is a single point of failure.<\/li>\n\n<li>Founders can fix most of it in weeks. Investors should ask for the fix as a condition or a funded plan.<\/li>\n<\/ul>\n\n<\/div><\/div>\n\n\n\n<h2 class=\"wp-block-heading\">What key person risk is<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Every young company depends on a few people. That is normal. Key person risk is the point where the dependency becomes dangerous: one person leaves, falls ill or is hired away, and something that matters stops.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Engineers call the same idea the bus factor: how many people need to disappear before a project stalls. A bus factor of one is the risk.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For investors, this is a technology question as much as a people question. The risk comes from a company that cannot keep running without them.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why it shows up so often in technology companies<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Early engineering is fast and informal. The first engineer builds the core, deploys it, and holds the passwords. The founder who is also the chief technology officer makes the architecture calls, talks to customers about them, and fixes things at night.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">None of that is wrong at the start. It becomes a problem when the company grows and the habits do not change. By Series A or later, a handful of systems are running the revenue and only one person truly understands each. Knowledge held in one head is a form of <a href=\"https:\/\/eidoran.com\/insights\/technical-debt-due-diligence-pricing\/\">technical debt<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Five tests investors can run<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">1. The production test<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ask who can deploy a change to production and who can roll one back. If the answer is one name, ask what happens when that person is on a flight.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. The access test<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">List the accounts that matter: cloud root, source code owner, domain registrar, payment gateway, app store accounts, single sign-on administrator, and the password manager. For each, ask who can log in today. Look for accounts held in a personal email address or on one person&#8217;s phone.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. The knowledge test<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Pick the module that earns the money or holds the most sensitive data. Ask the team who could explain it end to end. Then ask a second person to explain the same part. The gap between the two answers shows how much is in one head.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. The onboarding test<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ask how long it takes a new engineer to run the system on their own laptop and make a small change in production. Then ask to see the document they follow. If the real answer is &#8220;they sit with the founder&#8221;, the knowledge is not written down.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">5. The absence test<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ask what stopped the last time the key person was away for two weeks. Real examples are more useful than reassurance. If nobody can remember, ask whether the person has actually taken two weeks away.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A simple scoring grid<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Take the five or six systems the business cannot run without. For each, count how many people can operate it without help.<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><thead><tr><th>Score<\/th><th>Meaning<\/th><\/tr><\/thead><tbody><tr><td>0<\/td><td>One person only, nothing written down<\/td><\/tr><tr><td>1<\/td><td>One person plus a document that is out of date<\/td><\/tr><tr><td>2<\/td><td>Two people can operate it, document is current<\/td><\/tr><tr><td>3<\/td><td>A team can operate it, tested by someone other than the owner<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Any critical system scoring 0 or 1 deserves a plan before closing. Several at 0 is a finding the investment committee should hear in plain words.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1200\" height=\"604\" src=\"https:\/\/eidoran.com\/insights\/wp-content\/uploads\/2026\/11\/key-person-risk-scoring-grid.webp\" alt=\"Illustrative grid showing how many people can operate each critical system, with the billing engine scoring zero because only one person can run it\" class=\"wp-image-62\" srcset=\"https:\/\/eidoran.com\/insights\/wp-content\/uploads\/2026\/11\/key-person-risk-scoring-grid.webp 1200w, https:\/\/eidoran.com\/insights\/wp-content\/uploads\/2026\/11\/key-person-risk-scoring-grid-300x151.webp 300w, https:\/\/eidoran.com\/insights\/wp-content\/uploads\/2026\/11\/key-person-risk-scoring-grid-1024x515.webp 1024w, https:\/\/eidoran.com\/insights\/wp-content\/uploads\/2026\/11\/key-person-risk-scoring-grid-768x387.webp 768w\" sizes=\"auto, (max-width: 1200px) 100vw, 1200px\" \/><figcaption class=\"wp-element-caption\">Illustrative scoring grid, not a client example.<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">An illustrative scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This is an illustration, not a client story.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a software company with 30 people, where one engineer built the billing engine and still maintains it. Billing is where revenue is recognised and customers are charged. Only that engineer has the production credentials, and the setup notes are in a personal notebook.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">During diligence nothing is wrong. The product works and customers are happy. But a competing offer for that engineer would stop the company&#8217;s ability to invoice within weeks, and the investor would find out after the money moved.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same company, with a second engineer trained on billing, credentials held in the company&#8217;s password manager and a written runbook, is a different investment at the same price.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What to do about it<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Founders can reduce key person risk quickly:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Move every critical account to company ownership, with at least two administrators.<\/li>\n\n<li>Write the runbook for each critical system and have someone else follow it.<\/li>\n\n<li>Pair a second engineer with the owner on the next change to each system.<\/li>\n\n<li>Hold a short review each quarter and score the grid again.<\/li>\n\n<li>Retain the key people deliberately, with equity or agreements, before a deal makes it urgent.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Investors can ask for the same in the deal terms: access transfer as a closing condition, a funded plan in the first hundred days, and retention agreements for the people who matter. Insurance on a key person can cover a financial loss, but it does not restore the knowledge. These tests sit inside a full review such as the <a href=\"https:\/\/eidoran.com\/insights\/technology-due-diligence-checklist\/\">technology due diligence checklist<\/a>, and the quarterly re-scoring belongs in <a href=\"https:\/\/eidoran.com\/insights\/technology-governance-vs-technology-due-diligence\/\">technology governance after closing<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Eidoran advises investors and boards on this through its <a href=\"https:\/\/eidoran.com\/#practice\">technology due diligence and governance practice<\/a>. Related reading: <a href=\"https:\/\/eidoran.com\/insights\/technology-due-diligence-checklist\/\">technology due diligence checklist<\/a>, <a href=\"https:\/\/eidoran.com\/insights\/series-a-technical-due-diligence\/\">Series A technical due diligence<\/a>, <a href=\"https:\/\/eidoran.com\/insights\/technical-debt-due-diligence-pricing\/\">how investors should price technical debt<\/a>, <a href=\"https:\/\/eidoran.com\/insights\/technology-governance-vs-technology-due-diligence\/\">technology governance vs technology due diligence<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Frequently asked questions<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What is key person risk in a startup?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It is the risk that the loss of one individual would seriously harm the business. In technology companies it usually means a founder or early engineer who alone holds critical knowledge, access or decisions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How do investors assess key person risk?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">By testing real situations: who can deploy, who holds the accounts, who understands the core modules, how long onboarding takes, and what happened during past absences. They also look at retention terms for the people involved.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What is the bus factor?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">It is the number of people who would have to leave before a project or system could not continue. A bus factor of one means a single person is a point of failure.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can key person risk be removed completely?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No, and it should not be. Some people will always matter more. The aim is to make sure no single departure can stop the business, and that the company can recover within days, not months.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Is key person insurance enough?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. It can provide money if a person is lost, but it cannot replace what the person knew. Documentation, shared access and retention terms address the actual technology risk.<\/p>\n\n\n\n<div class=\"wp-block-group has-paper-color has-ink-background-color has-text-color has-background\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n\n<h2 class=\"wp-block-heading\">Raising a round?<\/h2>\n\n\n<p class=\"wp-block-paragraph\">Talk to us before the data room opens.<\/p>\n\n\n<div class=\"wp-block-buttons is-layout-flex wp-block-buttons-is-layout-flex\">\n<div class=\"wp-block-button\"><a class=\"wp-block-button__link has-text-color has-background wp-element-button\" href=\"https:\/\/eidoran.com\/?utm_source=insights&amp;utm_medium=blog&amp;utm_campaign=key-person-risk-startup-due-diligence#contact\" style=\"background-color:#c2a05e;color:#0e1116;border-radius:2px\">Request a Confidential Briefing<\/a><\/div>\n<\/div>\n\n<\/div><\/div>\n\n\n\n<p class=\"has-small-font-size wp-block-paragraph\"><em>This material is prepared for the general information of boards, investors and advisors, and does not constitute investment, legal or accounting advice.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Key person risk is the single point of failure investors often miss. Five practical tests, a simple scoring grid and what to fix before diligence starts.<\/p>\n","protected":false},"author":1,"featured_media":63,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[5],"tags":[27,23,26,24,21],"class_list":["post-71","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology-due-diligence","tag-bus-factor","tag-investors","tag-key-person-risk-2","tag-startups","tag-technology-due-diligence"],"_links":{"self":[{"href":"https:\/\/eidoran.com\/insights\/wp-json\/wp\/v2\/posts\/71","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/eidoran.com\/insights\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/eidoran.com\/insights\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/eidoran.com\/insights\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/eidoran.com\/insights\/wp-json\/wp\/v2\/comments?post=71"}],"version-history":[{"count":1,"href":"https:\/\/eidoran.com\/insights\/wp-json\/wp\/v2\/posts\/71\/revisions"}],"predecessor-version":[{"id":76,"href":"https:\/\/eidoran.com\/insights\/wp-json\/wp\/v2\/posts\/71\/revisions\/76"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/eidoran.com\/insights\/wp-json\/wp\/v2\/media\/63"}],"wp:attachment":[{"href":"https:\/\/eidoran.com\/insights\/wp-json\/wp\/v2\/media?parent=71"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/eidoran.com\/insights\/wp-json\/wp\/v2\/categories?post=71"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/eidoran.com\/insights\/wp-json\/wp\/v2\/tags?post=71"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}