The "bus factor" — the number of people who would need to be hit by a bus (or, more realistically, hand in their resignation) before a critical function breaks — is the most underassessed risk in growing companies. It does not appear on risk registers. It does not surface in board discussions. And it is not something most founders think about until they are standing in the wreckage of a departure they did not see coming.
This is a self-assessment. Twenty questions across five operational domains. Answer honestly, score each item, and the result will tell you where your company's concentration risk lives — and how urgently you need to address it.
Domain 1: Technical Knowledge
- Question 1 — If your most senior engineer disappeared tomorrow, could the remaining team deploy a production hotfix within 24 hours? Score 1 if no, 3 if it would take more than 24 hours but less than a week, 5 if yes without hesitation.
- Question 2 — How many people can explain the core architecture decisions that govern your system design? Score 1 if one person, 3 if two to three people, 5 if the decisions are documented and understood by the broader team.
- Question 3 — Is there any system, service, or integration that only one person has ever worked on? Score 1 if yes and it is production-critical, 3 if yes but it is non-critical, 5 if no single-person systems exist.
- Question 4 — Could a new senior engineer, given access to your documentation, understand the system well enough to make meaningful contributions within 30 days? Score 1 if it would take 90+ days, 3 if 30-60 days, 5 if 30 days or less.
Domain 2: Customer Relationships
- Question 5 — How many of your top 10 customers have a relationship with more than one person at your company? Score 1 if fewer than three, 3 if three to six, 5 if seven or more.
- Question 6 — If your top salesperson left, what percentage of your pipeline would be at risk? Score 1 if more than 40%, 3 if 20-40%, 5 if less than 20%.
- Question 7 — Are customer relationship histories documented in a CRM that anyone on the team can access, or do they live in one person's email and memory? Score 1 if they are predominantly in someone's head, 3 if partially documented, 5 if fully documented and accessible.
- Question 8 — Has any customer ever said "I only work with [specific person's name]" when discussing their account? Score 1 if this applies to three or more key accounts, 3 if one to two accounts, 5 if no accounts.
Domain 3: Operational Processes
- Question 9 — Who runs payroll, and what happens if they are unavailable for two weeks? Score 1 if one person with no backup and it would cause missed payroll, 3 if one person with a documented process another could follow, 5 if multiple people are trained.
- Question 10 — Is there any operational process (invoicing, vendor management, compliance reporting, data pipeline management) that only one person knows how to execute? Score 1 if three or more critical processes are single-threaded, 3 if one to two, 5 if all critical processes have documented backups.
- Question 11 — Could your company operate at 80% capacity if your office manager, operations lead, or chief of staff was out for a month? Score 1 if significant functions would break, 3 if there would be noticeable degradation, 5 if the company would function normally.
- Question 12 — If you needed to onboard a new employee tomorrow, does a written onboarding process exist, or does it live entirely in someone's head? Score 1 if there is no documented process, 3 if partially documented, 5 if fully documented and recently tested.
Domain 4: Strategic and Financial Knowledge
- Question 13 — How many people in your company can build, explain, and update the financial model? Score 1 if one person, 3 if two to three, 5 if the model is documented and multiple people can operate it.
- Question 14 — If the CEO were incapacitated for 60 days, does a clear chain of authority exist for all major decision categories (spending, hiring, strategy, customer escalations)? Score 1 if no succession plan exists, 3 if informal understanding among leaders, 5 if documented and communicated.
- Question 15 — How many people have the passwords, access credentials, and administrative rights needed to keep all critical systems running? Score 1 if one person, 3 if two to three with partial access, 5 if access is properly distributed with a password management system.
- Question 16 — Could your board or investors get a clear picture of company health if the CEO and CFO were simultaneously unavailable for two weeks? Score 1 if no, 3 if they could get partial information, 5 if dashboards and reports exist that any leader could present.
Domain 5: Cultural and Organizational Gravity
- Question 17 — Is there one person whose departure would cause more than two other people to seriously consider leaving? Score 1 if yes and that person manages or influences more than 20% of the company, 3 if yes but their influence is limited to a small team, 5 if no single departure would trigger cascading attrition.
- Question 18 — Does your company have a cultural identity that exists independent of any single leader, or is the culture essentially one person's personality amplified? Score 1 if the culture is inseparable from one person, 3 if the culture is partially institutionalized, 5 if the culture is embedded in practices, norms, and rituals that would survive any single departure.
- Question 19 — When a cross-functional conflict arises (engineering vs. sales, product vs. finance), is there only one person who can mediate it? Score 1 if yes, 3 if two to three people can mediate but one is strongly preferred, 5 if multiple leaders can effectively resolve cross-functional disputes.
- Question 20 — If you were to map every critical workflow in the company, how many would pass through the same person? Score 1 if more than 50% of critical workflows depend on one individual, 3 if 25-50%, 5 if less than 25%.
Scoring and Interpretation
Add your scores across all 20 questions. Maximum possible: 100.
- 80-100: Low concentration risk — Your organization has distributed knowledge, documented processes, and redundancy in critical roles. Single departures would cause disruption but not crisis. Maintain this through ongoing documentation discipline and cross-training.
- 60-79: Moderate concentration risk — You have some single points of failure, but they are limited to specific domains. Identify the lowest-scoring domain and create a 90-day remediation plan. Prioritize documentation and cross-training for the most concentrated functions.
- 40-59: High concentration risk — Multiple critical functions depend on single individuals. A single unexpected departure in the wrong role could materially impact the company's ability to operate. This should be an immediate priority for the leadership team and should be disclosed to the board.
- Below 40: Critical concentration risk — The company's ability to function is deeply dependent on a small number of individuals. This is an existential risk that should be treated with the same urgency as a cash crisis. Begin remediation immediately: document critical processes, cross-train team members, distribute access and authority, and build succession depth.
The Uncomfortable Truth
Most companies scoring below 60 are aware of the problem at some level. The founder knows they are the bottleneck. The CTO knows nobody else understands the architecture. The VP of Sales knows the top accounts are personal relationships. They know — and they defer action because fixing concentration risk is unglamorous, time-consuming work that competes with revenue growth, product development, and everything else that feels more urgent.
The urgency becomes clear only after the single point fails. And by then, the cost of remediation has multiplied by 10x because you are rebuilding under pressure rather than transferring under control.
The bus factor audit is not comfortable. It is not supposed to be. It is supposed to surface the risks that every growing company accumulates and nobody wants to name — before the naming happens in an emergency all-hands meeting.
