Risk management

When one person knows everything, that's a risk

Most accounting firms have a single person who knows the ASIC compliance for the entire client book. If that person leaves or is sick or takes leave, the firm has a problem. Here is how to think about it.

The risk is not just departure

Long service leave. Illness. Parental leave. Even good firms run on assumed continuity. The exposure is the same whatever the cause, but the timing of departure is the case partners think about most because it is the most public.

The question that matters: if your corp sec specialist was unavailable for the next six weeks, what would happen to your client book? If the honest answer is “a series of late lodgements and panicked partner phone calls”, you have a key-person risk you have not priced.

The four invisible failure modes

These are the parts of the corp sec function that are almost never documented. Partners assume they are; the corp sec person assumes someone else has done it; nobody has.

The registered agent portal login lives in someone's head

Most firms cannot say where it is documented. When the person leaves, the password follows them out the door.

The annual review reminder process lives in their calendar

A personal Outlook calendar is not a firm-level continuity tool. The reminder structure dies with the person.

Quirks of clients with unusual share structures live in their memory

Why client X has three share classes, why client Y is on a foreign-person exclusion clause, why client Z's annual review needs to wait until after their tax return: all of this exists as institutional memory in one head.

Standing instructions are rarely written down

The unwritten rule that "we always lodge X first, then Y" is the kind of thing that prevents errors. It is also the kind of thing that disappears in a departure.

Six questions to assess your firm's exposure

Run through these in your head. If any take longer than five seconds, that is the answer.

Who else can lodge with ASIC if your main person is out for two weeks? (If you cannot answer this in five seconds, that is your answer.)

Where are the standing instructions for each client documented? (If they're not, they don't exist outside one head.)

When was the last time the main person took two consecutive weeks off without anyone calling them?

Does anyone else hold admin access to your CAS360 instance, or is the access concentrated in one user?

If your main person resigned tomorrow with three weeks' notice, what would be lodged late?

Has anyone other than the main person actually opened the share register for your top 20 clients in the last 12 months?

Run the full 12-point continuity checklist →

Three ways to address it

We sell the third option, so the obvious framing is to say it's the only answer. We do not believe that. The first two are real options, with real limits.

Document everything

Rarely happens in practice

Build a written runbook covering every recurring task, every client quirk, every system access. Maintain it forever.

In theory, this works. In practice, the work to maintain a thorough runbook competes with billable work, so it never quite happens. Most firms have a partial runbook that goes stale within six months.

Cross-train another team member

Works until they leave too

Train a second person on the corp sec function. Maintain redundancy through deliberate cross-training.

A meaningful improvement on the single-person model. The risk is that you are now exposed if either person leaves. With shorter average tenures, that probability is non-trivial.

Outsource the function

Structurally different

The corp sec function lives outside any single person at your firm. The provider's entire business depends on continuity, so they engineer for it.

The structural answer. Your provider has multiple people across multiple offices and cannot have a single point of failure because their entire commercial proposition depends on continuity.

Continuity is the provider's commercial proposition

Your provider's whole business is corporate secretarial. They have multiple people across multiple offices. They cannot have a single point of failure because their entire commercial proposition depends on continuity. If they lose a person, the business model breaks.

That is why a competent provider invests in cross-training, documentation, and redundancy that no single firm can justify investing in for the size of their corp sec team. The structural depth is the product.

What happens to your provider if their key person leaves?

Fair question. Fair answer.

CoSec is structured so that any of Cathie, Ian, or Aaron can step into any client relationship. Each of us holds the relevant authority on every account; each of us has worked through the operational systems for every entity in the book. Drafting capacity sits across the team rather than with one drafter.

Behind the named partners, our drafting and lodgement team operates with the same redundancy. No single staff departure changes service for any client. We have tested this in practice, staff have come and gone over the years; clients have not noticed.

Continuity reading

Already lost someone?Operational in 72 hours Departure cost calculatorBy firm size Continuity checklist12-point firm audit In-house vs outsourcedHonest cost maths

Talk to our team about how we structure for continuity

Send us your firm size and current corp sec setup. We will walk you through how the continuity question would change under each of our service models.