The Single Point of Knowing: Auditing Knowledge Dependency in UK Professional Firms

In most firms there is a person who knows. Not the managing partner, and not necessarily anyone with a title. The person who knows where the 2019 deeds are stored, which printer jams on the third floor, which client insists on a telephone call before any email, and what the bank's actual cut-off time is for a same-day payment. When that person is on annual leave, the firm experiences small frictions. When that person leaves, it experiences a slow unravelling.

Why the risk stays hidden

Key-person risk is usually discussed in terms of rainmakers and founding partners. Operational dependency is quieter. It does not appear in the management accounts until it does, and by then the cost is already being paid in missed deadlines, duplicated effort and client irritation.

The warning signs are consistent. Enquiries route through one desk because nobody else knows the answer. Approval requests wait for one individual to return. A software administrator account belongs to a single named person. The phrase "how we do it here" is spoken rather than written. Firms often discover the extent of the dependency at the worst possible moment: a resignation letter, a period of sickness, or a retirement date that arrives sooner than expected.

There is an external dimension too. Professional indemnity insurers ask about business continuity. Clients ask about continuity of service. Data protection rules require firms to know who has access to what. Knowledge dependency is therefore not merely an HR concern; it is a governance matter that touches insurance, client confidence and regulatory compliance.

The audit: map the knowledge, not the org chart

Do not begin with a staff survey. Begin with a workflow inventory. For each core process — client onboarding, file opening, billing, credit control, payroll, archive management, supplier administration, IT administration and regulatory filings — ask three questions. Who performs it? Who else could perform it today, without notice? What would break if the first person were unreachable for a fortnight?

Build a register with columns for process, named owner, named deputy, where the knowledge lives (document, system or memory), frequency, consequence of failure scored from one to five, ease of substitution scored from one to five, and actions required. High frequency, high consequence and low substitutability produce a red rating. These are the firm's single points of knowing.

Be specific. "Billing" is too broad to audit. "Raising the monthly work-in-progress report and reconciling disbursements before the partner review" is a process that can be tested. The same applies to "preparing the covering letter required by the client who insists on a named partner's signature".

Include the unglamorous details: alarm codes, key safes, software licence renewals, domain and hosting accounts, multi-factor authentication devices, bank mandates and dual-authorisation arrangements, courier accounts, stationery suppliers, and the idiosyncratic preferences of long-standing clients. These are the items that cause disproportionate disruption when they are held in one head.

Documentation that people will actually use

The common failure of knowledge capture is the wiki nobody opens. Documentation should be short, task-shaped and stored where the work happens. A one-page run sheet for each red process is usually sufficient. It should state the trigger, the steps, the decision rules, the contacts, the escalation route, the common failure points, and a last-verified date.

Decision rules matter more than steps. Anyone can follow a checklist. The dependency usually sits in the judgement: why a particular client is billed in a particular way, why a supplier is paid early, why a file is retained beyond the standard period. Record the reasoning, not just the action.

Keep a single calendar of obligations covering statutory filing dates, insurance renewals, software auto-renewals, payroll cut-offs and regulatory returns. Give each entry a named owner and a named deputy. Appoint a custodian of the register itself; otherwise the audit becomes an artefact of one week in November and nothing more.

Cross-training that survives a busy week

Cross-training fails when it is scheduled as an event. It works when it is built into the rhythm of the week.

• Reverse shadowing: the deputy performs the task while the owner observes and corrects. Not the other way around.
• Ask-me-anything sessions: thirty minutes on a single process, minuted or recorded, with the deputy asking the questions a newcomer would ask.
• Paired approvals: for one quarter, two people sign off on the red processes.
• Named deputies in writing: in the process register, in the delegation schedule and in the holiday handover note.

For regulated work, confirm that the deputy has the necessary permissions — system access, bank authority and professional body registration where relevant. Cross-training without access is theatre.

The 90-day handover drill

A drill tests cover before it is needed. Run it once a year, or whenever a red process changes hands.

Days one to thirty: capture. The owner and deputy complete the run sheet together. The deputy performs the task at least twice with the owner present. Gaps are logged rather than glossed over.

Days thirty-one to sixty: cover. The deputy performs the task while the owner remains available but does not intervene unless asked. The owner keeps a note of every intervention. Each one represents either a documentation gap or a training gap.

Days sixty-one to ninety: swap. The deputy owns the task. The owner is deliberately unavailable for a defined period; one week is usually enough, two is better. Measure what happened: missed deadlines, duplicated effort, client enquiries that stalled, approvals that waited.

Then debrief. Update the run sheet. Update the register. Repeat for the next red process. The purpose is not to prove that the deputy is perfect. It is to discover where the knowledge still lives in one head.

Governance and the client view

Report the register to the board or management committee at least annually. Record the red, amber and green counts, the actions taken and the residual risk. Link the register to succession planning, to the business continuity plan and to the professional indemnity renewal pack.

There is a client dimension as well. Clients notice when the person who knew their file has gone. A firm that can say "here is the deputy, here is the note, here is the plan" retains confidence. A firm that cannot may not.

Confidentiality applies throughout. Knowledge capture must not become a reason to copy client data into shared drives without a lawful basis. Keep run sheets process-focused and keep client-specific notes in the client file, under the firm's retention and access rules.

A quiet form of resilience

The person who knows where everything is deserves recognition, not simply a heavier workload. But reliance on a single memory is not a compliment to them, and it is not a strategy for the firm. Dependency auditing is unglamorous work and, when conducted properly, largely invisible. That is rather the point.