The risk that doesn't appear on the balance sheet
There is a type of operational risk that appears in no audit report and that few COOs have documented: the critical process that only one person knows how to run.
This isn't a new risk. But over the past two years it has become more costly. Mid-size companies have grown in operational complexity without growing their teams. The result is predictable: one person accumulates the knowledge of an entire process. They know which exception to handle how, which supplier to call first, which column in the spreadsheet needs adjusting before the report is closed.
When that person goes on vacation, falls ill, or resigns, the process stops. Or worse: someone else runs it incorrectly without realizing it.
Why this problem is more common than it appears
In a company of 50 to 200 people, it's common to find between three and eight critical processes with single-person dependency. The most frequent:
- Month-end financial close with adjustment logic known only to the controller
- Account reconciliation between systems that are not integrated
- Management report generation that requires consolidating sources manually
- Exception handling in billing or logistics
- Client or vendor onboarding with undocumented steps
The problem isn't that these people are irreplaceable. The problem is that the knowledge lives in their heads, not in the system.
What an agent does in this context
An AI agent is not a chatbot or an automated form. It is a system that executes a sequence of steps with conditional logic, accesses the relevant data sources, and produces a documented output.
In the context of single-person dependency, the agent serves three functions:
First, it captures the implicit procedure. During the implementation phase, work is done with the person who currently runs the process to map every step, every exception, and every business rule. That knowledge moves from the individual into the system.
Second, it executes the process consistently. The agent doesn't skip steps, doesn't improvise, and doesn't vary its judgment from one day to the next. Every execution is traceable and auditable.
Third, it creates visibility that didn't exist before. The COO can see how many times the process ran, what exceptions were encountered, how long it took, and whether the output was correct. That visibility is new. Previously, it lived in one person's inbox.
A concrete example: the management close at a distribution company
A distribution company with 80 employees had its monthly management close concentrated in a single person on the finance team. The process took three to four business days, involved consolidating data from three different systems, applying manual adjustments in Excel, and generating the final report for senior management.
The risk was clear: if that person was unavailable, the close was delayed. If they made an error, no one caught it until management reviewed the numbers.
After implementing an agent for this process, the estimated results in the first 90 days were:
- Reduction of close time from three to four days to under eight hours
- Elimination of 70%–80% of manual steps in Excel
- Full traceability of every adjustment applied
- Ability for another team member to oversee the process without needing deep knowledge of it
The monthly hour savings were estimated at 25–35 hours. The operational risk associated with single-person dependency was eliminated.
Why documentation alone doesn't solve this
The standard response in many organizations is to ask the person to document the process. It's a partial solution.
Documentation goes stale. No one reads it under pressure. And it doesn't resolve the execution problem: someone still has to do the work, now with a manual that may not cover every exception.
An agent doesn't replace the person. It frees them from repetitive execution so they can focus on the decisions that genuinely require human judgment. And it ensures the process runs the same way when they're not there.
How to identify which processes carry this risk
Three questions allow you to quickly identify the processes with the greatest exposure:
- If this person were unavailable tomorrow, who would run this process and how long would it take?
- Is there up-to-date documentation that would allow someone else to run it without assistance?
- Is the output of this process verifiable by someone who didn't run it?
If the answer to all three is no or uncertain, that process has single-person dependency and represents an active operational risk.
Implementation time is the most common objection
The most frequent pushback COOs hear when this solution is proposed is: "We don't have time to implement anything right now."
That's understandable. The team is operating at 100%. No one has capacity to stop and redesign.
That's why the implementation model that works in mid-size companies doesn't require stopping. The first agents are built in parallel with the team that currently runs the process, in focused working sessions. In six to eight weeks, the agent is in production and the team knows how to operate it.
The cost of not acting is higher than the cost of implementing.
Conclusion
Single-person dependency is not a talent problem. It's an operational design problem. And it has a concrete solution, with a reasonable implementation timeline and measurable impact in the first weeks.
If your company has critical processes that today depend on one or two key people, the first step is to identify them precisely and estimate the real risk they represent.
Request a free diagnostic. In a 15-minute conversation, we identify which processes have the greatest exposure and which ones can be automated in under eight weeks.
