What Happens If the Person Who Manages Your Accounts Leaves or Is Unavailable?

Small businesses often run through trust.

One person knows the Microsoft 365 admin account. One person handles the website. One person talks to the IT provider. One person manages accounting software. One person knows how backups are configured. One person has the recovery codes, the MFA device, or the vendor contact.

That may work on a normal day.

It becomes a business risk when that person is sick, travelling, terminated, in conflict with the business, unavailable after an accident, or simply no longer willing or able to help.

The issue is not whether the person is trustworthy. The issue is whether the business has a second path.

The business impact can be immediate

If the account manager is unavailable, the business may lose time or control in several ways:

• Staff cannot reset passwords.
• New employees cannot be added.
• Former employees cannot be removed.
• MFA prompts go to a phone the business cannot access.
• Vendor support will not speak to the owner because the owner is not listed.
• Accounting, payroll or payment systems cannot be administered.
• Website or domain problems cannot be fixed.
• Email security settings cannot be changed during an incident.
• Backups exist, but nobody can access the recovery console.
• A cyber insurance or incident-response request cannot be answered quickly.

In a larger organization, there may be a formal IT department, HR process and access-management system. In a small business, the process is often informal. That does not make it wrong, but it does make documentation and backup access more important.

This is key-person risk, not just an IT problem

Key-person risk is usually discussed in sales, finance, ownership or operations. It applies to technology too.

The business may technically own the system, but if only one person can administer it, recover it or explain it, the business is dependent on that person.

That dependency becomes more serious when it affects:

• Email and calendar
• Files and document storage
• Domain, DNS and website
• Banking, payments and accounting
• Payroll and HR systems
• Customer records or case management
• Backup and recovery platforms
• Password manager and recovery vault
• Security tools and remote support
• Social media and advertising accounts

The Canadian Centre for Cyber Security recommends reviewing administrative accounts and privileges regularly, including accounts held by cloud service providers or managed service providers. That matters for small businesses because outside providers and trusted internal staff often sit directly on the recovery path.

When someone leaves, access needs to change fast

When a staff member, contractor, volunteer, bookkeeper or outside administrator leaves, the business should be able to answer:

• What systems did they access?
• Did they have administrator rights?
• Did they know shared passwords?
• Did they control MFA or recovery methods?
• Were any systems registered under their personal email or phone?
• Did they have access to customer, employee, financial or confidential information?
• Which vendors knew them as the main contact?
• What needs to be disabled, transferred or reviewed?

NIST small-business guidance recommends taking protective action immediately when an employee leaves, including removing access from systems. In practice, many small businesses cannot do that quickly because they do not have a current access list.

Unavailable is different from leaving

Departure is only one scenario.

The same problem can happen when a person is still trusted but unavailable. They may be in the hospital, on vacation, off-grid, dealing with a family emergency, or unable to receive an MFA prompt because a phone is broken.

That scenario needs a different approach. The business should not remove access unnecessarily, but it still needs a documented backup path for critical systems.

For example:

• A second named administrator can help recover Microsoft 365.
• A protected emergency access process can support a lockout.
• Vendor support contacts can list more than one authorized person.
• Backup recovery instructions can be documented before they are needed.
• Recovery codes and admin details can be stored securely with clear authorization rules.

The goal is continuity without creating a free-for-all.

What not to do

Avoid solving key-person risk by creating a single shared admin login that everyone knows.

That may feel convenient, but it creates other problems. It becomes harder to know who made a change, harder to remove one person’s access, and easier for a password to spread beyond the people who should have it.

Better options include:

• Named user accounts for each person
• Separate administrator accounts where appropriate
• MFA on privileged systems
• Least-privilege access
• A documented offboarding checklist
• A protected emergency access process
• Regular access reviews
• Clear vendor authorization records

A practical owner checklist

For each critical system, record:

• The main business purpose
• The named owner
• The primary administrator
• A backup administrator or recovery contact
• Whether MFA is enabled
• Whether MFA depends on one person’s device
• Whether the account uses a business email address
• Whether former staff or vendors still have access
• Whether the provider will recognize the owner
• What happens if the primary administrator cannot respond

Then review the list when a person changes roles, leaves, changes phone numbers, changes email addresses, or moves from employee to contractor.

Where CyberTECT fits

CyberTECT’s Break-Glass Readiness Review helps identify these single-person dependencies before they become emergencies.

The review focuses on practical questions: who can access what, who can recover what, what depends on one person, what access should be removed, what needs a backup administrator, and what needs to be documented so the owner is not locked out of the business.

This is especially useful for rural businesses, professional offices, nonprofits, trades, retailers and owner-operated teams where one trusted person often carries most of the digital process.

Frequently asked questions

Is this only a concern when someone quits or is fired?

No. It also applies when someone is sick, unreachable, travelling, in conflict with the business, has a broken phone, loses access to email, or cannot complete an MFA prompt.

Should every employee have admin access as a backup?

No. Backup access should be deliberate. Use named accounts, least privilege, MFA and a clear process for when elevated access is allowed.

What if an outside IT provider manages everything?

That can be fine, but the owner should still know what the provider controls, which accounts they access, who inside the business is authorized, and what happens if the provider relationship changes.

What should be done before an employee or contractor leaves?

List their systems, remove or transfer access, rotate shared credentials if they existed, update MFA and recovery methods, remove vendor authorizations where needed, and verify that files, email, accounting, website and backup access remain under business control.

Does this article provide legal or HR advice?

No. Employment, termination, privacy and contractual questions should be reviewed with the appropriate professional advisor. This article focuses on operational access and continuity.

Related CyberTECT guidance

• Break-Glass Readiness Review
• Who Owns Your Business Accounts and Passwords?
• How to Set Up Emergency Access for Critical Business Systems
• Digital Operations Checkup

Sources and further reading

• Canadian Centre for Cyber Security — Managing and controlling administrative privileges
• Canadian Centre for Cyber Security — Implement access control and authorization
• NIST — How to Protect Your Business from Cyber Attacks

This article provides general operational cybersecurity information. It is not legal, privacy, insurance, employment, professional-regulatory or incident-response advice.