Key person risk: an IT handover checklist for small businesses

In most small businesses, one person quietly holds the keys. They registered the domain, set up the email, know the hosting login, and have the authenticator app on their phone. Usually it is the founder, sometimes a long-serving office manager, sometimes a freelancer who set everything up years ago.

That works perfectly until the day it does not. Illness, an accident, a resignation, a falling-out with a contractor, or simply two weeks off-grid on holiday when the website goes down. Suddenly nobody can renew the domain, reset a password or even prove the business owns its own accounts.

This is key person risk, and it is one of the most common gaps in small business continuity. The fix is not complicated. It is a list, kept somewhere safe, with a plan for who can open it.

The handover checklist

Work through each area and write down three things for each item: what it is, where it lives, and who can get in. You are not trying to document every setting, just enough that someone competent could take over.

1. Domains and DNS

Every domain the business owns, including old ones that still redirect
Which registrar each is with, the account login, and the email address the renewal reminders go to
Expiry dates and whether auto-renew is on (and which card it uses)
Where DNS is hosted, if not at the registrar (Cloudflare, your web host)

Domains matter most. Lose the domain and you lose the website and email together. Check yours with our domain expiry checker.

2. Email

The email provider (Microsoft 365, Google Workspace, your host)
The admin account login, which is separate from your own mailbox
Who else has admin rights. The answer should never be "nobody else"

3. Website and hosting

Hosting provider and control panel login
The website's admin login (WordPress or similar)
Where backups are kept and how to restore one
The developer or agency who built it, and how to reach them

4. Money

Online banking: who else is a signatory or has access
Payment providers (Stripe, PayPal, GoCardless, card terminals)
Accounting software, payroll and HMRC online services
Which subscriptions renew on which card, so a cancelled card does not quietly switch services off

5. Business systems

CRM, booking, stock, helpdesk and any line-of-business software
Social media accounts and the email or phone number they are tied to
Wi-Fi, alarm codes, door entry and anything else with a PIN

6. Two-factor authentication and recovery codes

This is the part most handovers miss. A password is no use if the second factor is on a phone in a locked drawer. For each important account, note:

Where the authenticator lives (whose phone, which app)
Where the backup or recovery codes are stored
The recovery email and phone number on the account

7. People and instructions

Who should be told first if something happens, and who should be given access to what
Key suppliers and advisers: IT support, accountant, solicitor, web developer
A short note for each critical system on what to do if it breaks. Even two lines ("restart the router in the comms cupboard; if the site is down, call the host first") saves hours

Where to keep it

The list is only useful if it is both secure and reachable. Most businesses get one of those right and the other wrong.

A spreadsheet on the shared drive is reachable, but anyone with drive access can read every password in it.
A password manager is secure, but it usually only helps the person who owns it. If they are the one who is unavailable, the vault is as locked as everything else.
A sealed envelope in the safe works surprisingly well for the master recovery details, as long as someone remembers to update it.

The better answer combines both: credentials encrypted at rest, plus a controlled way for named people to receive them, only when they genuinely need to, with a delay that you can cancel if you were simply on holiday.

Test it

A handover plan you have never tested is a hope, not a plan. Once a year, pick one system and ask a colleague to log in using only what is written down. Whatever they get stuck on is the gap you need to fill.

How VigilVault helps

We built VigilVault around exactly this problem. It stores credentials, recovery codes and instructions in an encrypted vault, and lets you nominate trusted people to receive specific bundles if you become unreachable. You choose who gets what, how long the waiting period is, and a single sign-in cancels it. A nominee can also request emergency access, and you are notified and can decline.

Because it also monitors your websites, SSL certificates and domain expiry dates, the same tool that warns you a domain is about to lapse holds the registrar login that someone else will need to renew it.

Every new account starts with a 30-day Pro trial, no card needed, which includes the full handover. Or read our business continuity guide for the bigger picture. Start your handover plan free.