As the holidays approach and your CFO, controller, or “operations hero” sets their out-of-office, what really happens in the rest of the business?
For many small and mid-size companies, Christmas and year-end are often when the business is most exposed to key person risk: one or two people hold critical knowledge in their heads, and when they’re away, everything slows down or stops. Approvals pile up, payments are delayed, revenue can’t be recognised, and everyone is “waiting for John to come back in January”.
This post is about making sure that when key people are out-of-office, your organisation isn’t out-of-control.
1. Why Christmas exposes Key Person risk
Christmas and year-end are a perfect storm:
• higher transaction volumes (sales, refunds, discounts, gift cards)
• finance under pressure to close the books
• more staff on leave, including senior people
• external parties needing decisions quickly (banks, auditors, key customers)
In SMEs, this often collides with:
• undocumented processes
• single approvers for payments or contracts
• one person who understands the ERP or accounting system
• founders still signing off on everything important
The result: avoidable delays, errors, and sometimes bad decisions taken by people who feel forced to improvise.
Your goal isn’t to create enterprise-level business continuity in a month. It’s to ensure that if one key person disappears for two weeks, the business can still perform the basics safely.
2. Identify your top 5 “single point of failure” processes
Don’t try to fix everything before the holidays. Focus. A simple way to start is to ask: “If this person were offline for 10 days, what are the 3–5 things only they can do?”
Typical key-person processes:
• releasing or approving bank payments
• approving credit notes, refunds, or big discounts
• closing the month / finalising management accounts
• onboarding new suppliers or changing bank details
• dealing with urgent cash or tax issues
Turn that into a short list covering: 1) Process, 2) Primary owner, and 3) What breaks if they’re away? For example:
• Supplier payments run – owned by Controller – payroll and key suppliers can’t be paid
• Customer credit notes > €5k – owned by CFO – sales grinds to a halt for big accounts
• System user access changes – owned by IT lead – no access changes, but also no ability to lock users out if something happens
These are the processes you protect first.
3. Document “just enough” for the holidays
You don’t need a 20-page SOP. For the top 5 processes, aim for one page each: enough for a competent colleague to follow if they have to.
For each process, capture:
• purpose – what this process is for (e.g., “to pay approved suppliers on time, safely”)
• when it runs – frequency and timing (e.g., “every Tuesday and Thursday, plus 20 Dec and 28 Dec year-end runs”)
• systems used – which tools / portals are involved (ERP, banking platform, payroll system)
• inputs – what must exist / be approved before starting
• key steps – 5–10 bullet points, numbered, in actual sequence
• checks / controls – what must be double-checked (totals, approvals, bank details)
• what can go wrong & who to call – 2–3 typical issues, plus a name and phone/Teams contact
If you can’t do this for all five, do it for the top two. That alone already reduces your holiday risk significantly.
4. Cross-train and assign backups
Documentation without a backup person is still a risk. Your next move is to nominate and brief a second-in-command for each critical process.
For each key process:
• assign 1 primary backup, not a vague “the team”
• walk them through the one-page guide live, step by step
• have them perform the process once before the holidays, with the primary owner watching
• confirm any limits. For example: “You can approve payments up to €10k; above that, it waits for the CFO.” “You can issue credit notes for pricing errors, but not for disputes.”
This doesn’t have to be perfect. A trained backup who can do 80% of the job safely is much better than a team that can do 0%.
5. Create simple “if X happens while I’m away” playbooks
This is where you convert informal knowledge into small “emergency cards”. Ask each key person to write a short note that starts with: “If X happens while I’m away, do this…”
Typical scenarios:
• Cash crunch: “If we can’t pay all suppliers, here is the order of priority and who to escalate to.”
• Major customer issue: “If customer Y threatens to stop orders over a credit limit, here’s our minimum acceptable compromise and who must be in the loop.”
• Fraud / security concern: “If you see unusual bank changes, user access issues, or invoices that don’t look right, follow this 3-step escalation.”
• System outage: “If the ERP is down, here’s the manual workaround and the contact at our IT provider.”
Keep these playbooks simple (one page if possible), specific (actual customer names, bank relationships if needed), and visible (shared folder, printed in the finance office, or pinned in Teams/Slack).
These aren’t full crisis-management plans. They’re don’t panic, do this first guides.
6. Embed continuity into next year, not just Christmas
If you do the work above, you’ll have:
• a list of your top key-person processes
• 2–5 one-page process guides
• at least one trained backup for critical areas
• a few “if X happens…” playbooks
That’s already a big step up. You can build on this by:
• Making one-page process guides part of your onboarding and handover routines.
• Gradually expanding from 5 processes to 10–15 over the year.
• Adding a periodic review to check that backups are still in the company and still trained.
This is exactly the kind of structured, incremental work where having a library of control templates, example procedures, and checklists helps you move faster and stay consistent.
If you want to move from “we hope nothing breaks when people go on leave” to a lower-risk, lower-drama way of working, you don’t need a huge project. You need a clear list of risks, a handful of simple documents, and a few trained backups.
InternalControlToolbox.com can help you turn those into a repeatable system: templates for key processes, practical control checklists, and a structure to keep everything up to date — so your next holiday season can be out-of-office, not out-of-control.
Leave a Reply