1. Treat key-person dependency as an enterprise exposure
Key-person risk exists when an individual can materially interrupt a product, service, cash flow, legal action or stakeholder relationship. The person may be a founder, managing director, family principal, sales leader, chief engineer, finance controller, project director or system administrator. The correct test is functional: what stops, slows or becomes less reliable if the person is unavailable for one day, two weeks, three months or permanently?
Boards often describe the exposure as a succession issue. That framing is incomplete. The dependency can affect daily revenue before a formal transition begins. A proposal may wait for one person's judgement. Customers may call a founder instead of an account team. Supplier concessions may rest on a private relationship. Bank tokens, corporate seals, tender portals, pricing exceptions or contract knowledge may be concentrated in one pair of hands. The business can remain legally alive while losing operating velocity and cash confidence.
The continuity plan should begin with outcomes. It should name the revenue streams, customers, decisions, obligations, information and access that must continue. It should set a maximum tolerable disruption for each outcome and a recovery-time objective for each supporting role. The UK government's business-continuity toolkit uses these concepts in a business-impact analysis; ISO 22301 places them within a documented system that is implemented, monitored, reviewed and improved.
The board mandate should cover planned and sudden absence. Planned succession, retirement, parental leave, sabbatical and sale transition provide time to transfer capability. Illness, death, travel disruption, resignation, detention, cyber compromise or conflict can remove the person without preparation. A useful operating model must work across both conditions.
The board protects outcomes by connecting dependency diagnosis, authority, capability, evidence and rehearsal.
2. Ground continuity in current governance and resilience standards
The UAE's Federal Decree-Law No. 37 of 2022 makes continuity explicit. Article 2 states objectives that include an inclusive legal framework for ownership and governance, transfer across generations and support for family-company continuity. Article 6 permits a family charter to address ownership, objectives, values, share valuation, profit distribution, family-member education and qualification, and dispute mechanisms. The law also states that the memorandum of association prevails where it conflicts with the charter.
Management authority matters during a transition. Article 14 provides for appointment of one or more managers and permits a manager to be a partner, non-partner or legal person, subject to the company's constitutional documents. It also permits a board of directors for a family limited liability company. Articles 15 and 16 address manager powers, representation, due care, reporting, fair treatment and independent judgement. Article 22 directs interpretation toward continuity, growth, good management and smooth transition. These provisions create legal options; the company's current memorandum, licences, resolutions and applicable free-zone or mainland rules determine the actual authority.
The G20/OECD Principles of Corporate Governance 2023 state that boards should oversee key executives and succession planning. The commentary connects CEO and other key-executive succession to business continuity and talent development. That principle supports a standing board process with named ownership, documented readiness and periodic review.
ISO 22301:2019 provides a general business-continuity management system for organisations of any size. It covers planning, establishment, implementation, operation, monitoring, review, maintenance and continual improvement. UK government guidance translates the discipline into practical steps: identify key products and services; conduct a business-impact analysis; define recovery objectives; develop incident and continuity plans; train people; exercise the plan; and keep it current.
Table 1. Authoritative requirements and the board response
| Authority | Verified principle | Board response | Evidence for diligence |
|---|---|---|---|
| UAE Federal Decree-Law No. 37 of 2022 | continuity, governance, family charter, management and smooth transition | align charter, memorandum, resolutions and succession design | current constitutional documents, authority schedule and transition protocol |
| G20/OECD Principles 2023 | board oversight of key executives and succession planning supports continuity | assign a committee or board owner and review readiness | board minutes, role profiles, successor assessments and exercise results |
| ISO 22301:2019 | documented continuity system should be planned, operated, monitored and improved | integrate people dependency into the business-continuity system | business-impact analysis, plans, tests, incidents and corrective actions |
| UK government BCM guidance | identify critical activities, MTPD, RTO, roles, invocation and exercises | translate the standard into operational thresholds and drills | service map, recovery targets, call tree and post-exercise actions |
| NIST SP 800-34 | information-system contingency planning should recover systems, operations and data | connect people continuity to system and data recovery | tested access, backups, alternate processing and restoration evidence |
| NCSC access guidance | privileged access should be limited, approved, audited and supported by a protected emergency process | remove personal credential dependence and establish controlled break-glass access | named roles, dual control, logs, vault evidence and access tests |
The table is a governance map; legal application depends on the company's jurisdiction, form and constitutional documents.
3. Build a dependency register from outcomes to individuals
The dependency register should map a critical outcome to every person-dependent element. The unit of analysis is smaller than a job title. A sales director may be replaceable for routine account management and irreplaceable for one regulator-facing licence renewal. A founder may delegate pricing and remain the only person able to interpret a complex legacy contract. A finance manager may have a deputy for reporting and still control the only working bank token.
Start with products, services and cash events. For each, identify the decisions, relationships, knowledge, access and signatures required. Then identify the primary holder, competent deputy, evidence location, permitted authority, recovery time and failure consequence. Score the exposure using the financial impact, time sensitivity, substitutability, documentation quality, access concentration and external dependency.
The register should distinguish role dependency from person dependency. A critical role can be resilient when several trained people can perform it inside a controlled process. A non-executive founder can remain a major dependency when customers, lenders or staff continue to route decisions through that person. The board should challenge informal statements such as "the team knows" with evidence: who can execute, under which authority, using which information and within what time?
The output is a prioritised portfolio. Red exposure combines high consequence, short tolerance and weak substitution. Amber exposure has a capable deputy with missing authority, evidence or rehearsal. Green exposure has at least one authorised alternative, accessible knowledge, controlled credentials and a demonstrated test. The colour should describe evidence at the review date; it should not become a permanent label.
A critical outcome becomes resilient only when decisions, relationships, knowledge, access and authority each have a tested alternative.
4. Quantify revenue and cash at risk
The board needs an economic view of dependency. Revenue at risk is broader than annual sales owned by the person. It includes orders awaiting approval, renewals dependent on a relationship, work-in-progress that requires specialist acceptance, receivables whose collection needs intervention, and future pipeline whose conversion relies on one person's credibility. The model should also include margin, cash timing and recovery cost.
A practical model groups each exposure by customer, product and time horizon. Management estimates the gross value, contribution margin, probability of disruption under a defined absence, time to appoint an alternative, temporary revenue loss, collection delay and incremental cost. These inputs are management estimates and should be recorded as such. The model should show ranges rather than a single false precision.
Cash can deteriorate before revenue recognition changes. A missing signatory can delay payroll, supplier payment, bond issuance or facility drawdown. A founder's absence can make a customer pause an order without cancelling it. A technical principal's absence can delay acceptance and extend the cash-conversion cycle. The model should therefore connect the person to cash triggers, authorised limits and payment systems.
The board should review concentrated exposure in three views: immediate liquidity, twelve-month earnings and sale value. Immediate liquidity asks how much cash is trapped or required during the recovery period. Earnings asks how much contribution could be delayed or lost. Sale value asks how a market participant might adjust expected cash flows, risk, transition cost or deal terms when capability is not demonstrably transferable.
Table 2. Revenue-at-risk and cash-conversion diagnostic
| Exposure | Evidence to capture | Management estimate | Control response |
|---|---|---|---|
| customer renewal | contract, relationship map, renewal date, contact history and satisfaction | renewal value, margin, disruption range and alternate owner readiness | joint coverage, documented account plan and executive introduction |
| new-business pipeline | opportunity stage, decision criteria, proposal history and stakeholder map | probability-weighted contribution and transfer loss | team-selling, proposal library and delegated pricing |
| work in progress | milestones, technical dependencies, acceptance rights and responsible signatories | delayed billing, cost to complete and cash extension | deputy certification, peer review and objective acceptance evidence |
| receivables | ageing, dispute log, collection commitments and escalation route | collection delay and liquidity requirement | shared customer finance contacts and governed collection playbook |
| financing and guarantees | facility, bank mandates, tokens, covenants and expiry dates | inaccessible headroom and replacement time | dual authority, current resolutions and tested bank access |
| supply and procurement | critical vendor terms, exceptions, relationship ownership and alternatives | cost increase, lead-time delay and production effect | supplier team coverage, approved alternatives and contract record |
Values, probabilities and recovery periods are illustrative management assumptions until supported by company evidence.
5. Separate corporate authority from personal availability
Continuity fails when legal or operational authority is inseparable from a person. The company should map reserved matters, board powers, manager powers, bank mandates, powers of attorney, tender authorities, contract-signing limits, HR approvals, payment limits, regulator portals, company seals and beneficial-owner obligations. The map must reflect current legal documents and actual system permissions.
The ownership structure and management structure should be shown separately. Ownership determines economic and voting rights. Management authority determines who can act. Family relationships can influence both and should be captured through valid constitutional and governance documents. The UAE Family Businesses Law permits management structures and a family charter; it does not make an informal family understanding a substitute for a memorandum of association, board resolution or bank mandate.
The continuity design should establish ordinary authority and emergency authority. Ordinary authority applies to normal operations and should follow segregation of duties. Emergency authority becomes available after a defined trigger and for a limited period. It should identify who invokes it, what evidence is required, which actions are permitted, who reviews them and when the authority expires.
Digital access should follow the same principle. Shared passwords create security and accountability problems. The NCSC recommends privileged-access controls, least privilege, time-limited access, audit and a carefully protected emergency process. The company should use named identities, approved roles, strong authentication, dual control for sensitive actions and a tested break-glass route. A deputy needs lawful access and sufficient permissions; unrestricted standing administrator rights add risk.
Economic ownership, board oversight, executive delegation and system access require separate evidence and aligned escalation.
6. Institutionalise customer relationships without damaging trust
A relationship transfers through deliberate shared experience. Uploading contact details into a CRM is insufficient when trust rests on personal judgement, delivery history and mutual problem-solving. The objective is to broaden the customer's confidence in the company while preserving the value created by the original relationship owner.
Each strategic account should have a relationship map. It should identify economic buyers, users, technical evaluators, procurement, finance, legal, sponsors, detractors and succession risks on the customer's side. The account plan should record objectives, commitments, decision rules, pricing history, unresolved issues, service expectations and contact cadence. Sensitive information should be collected lawfully and access-controlled.
Transfer works through joint coverage. The primary owner introduces an accountable executive, operating lead and finance contact in a context that creates value for the customer. Meetings should include the team before the transition is announced as an exit. Follow-up actions should be completed by the incoming owner. Over time the customer experiences continuity of judgement and delivery from the institution.
Contracts should support the relationship. Objective service descriptions, change control, acceptance criteria, notice addresses, escalation, key-person clauses, confidentiality, data rights and assignment provisions should be reviewed. The company should understand whether customer consent is needed for a change in named personnel or control. Qualified counsel should confirm the position for each material contract.
Customer evidence also matters in a sale. IFRS material on customer-related intangible assets notes that relationships can arise through contracts and through regular contact by sales or service representatives. Prior purchases and contractual relationships can be important valuation inputs. A seller strengthens diligence when it can show contracts, retention, cohort performance, account records and multi-person coverage instead of asking a buyer to trust an undocumented founder relationship.
7. Transfer pricing, technical and commercial judgement
Procedures capture repeatable work; they rarely capture all judgement. Key-person continuity therefore requires decision architecture. The company should identify decisions where experience changes the answer: bid selection, pricing exceptions, credit limits, scope boundaries, technical acceptance, supplier substitutions, hiring, claims, quality release and dispute settlement.
For each decision, record the objective, inputs, thresholds, alternatives, failure modes, approval rights and examples. A decision log can show why management accepted a margin, declined a customer, changed a specification or escalated a risk. The record should be concise enough to use and detailed enough to teach. Confidential and legally privileged material needs controlled handling.
Apprenticeship turns the record into capability. The deputy observes the decision, prepares a recommendation, makes the decision under supervision and then makes it independently within a lower limit. The primary holder reviews outcomes and exceptions. Readiness should be evidenced by decisions completed to standard, rather than by time served or a nomination alone.
Committees can reduce concentration when designed carefully. A pricing committee, credit committee or technical-review panel can pool evidence and maintain consistency. The committee needs quorum, alternate members, delegated limits and a rapid path for urgent decisions. A committee that still waits for the founder has changed the meeting format without changing dependency.
8. Build deputies, successors and a leadership bench
A deputy maintains a critical outcome during absence. A successor is prepared to assume a role for a longer period. One person can perform both functions; the readiness tests differ. Deputies require immediate access, authority and operating competence. Successors also need leadership range, stakeholder legitimacy, strategic judgement and an acceptable long-term mandate.
The board should set readiness levels. Ready now means the candidate can assume the defined responsibilities under current conditions. Ready with support means the candidate can act with specified coaching, committee coverage or external capability. Developmental means gaps and milestones are explicit. External search means the role cannot currently be filled internally. The assessment should be based on evidence and refreshed after material change.
Family-business succession adds ownership, identity and fairness questions. Article 6 of the UAE Family Businesses Law permits a family charter to address education and qualification for family members working in the company. The board can use role criteria, experience requirements and independent assessment to distinguish family membership from executive readiness. The constitutional and family-governance documents should be aligned with applicable law.
Retention supports continuity. Critical people need clear roles, fair remuneration, development, information access and an understood transition. Incentives should reward institution-building: shared relationships, documented systems, capable deputies and stable outcomes. A payment that rewards the founder for remaining indispensable can work against continuity. Employment, incentive, non-compete, confidentiality and restrictive-covenant arrangements require jurisdiction-specific legal advice.
Readiness advances through observed work, supervised decisions, authorised execution and tested transition.
9. Convert knowledge into an accessible continuity system
Knowledge should be organised around critical outcomes. A large document repository can coexist with severe dependency when staff cannot find the current contract, model, drawing, password-recovery process or customer commitment. The continuity system needs a clear owner, controlled location, naming convention, version status, review date and recovery path.
The content should include operating procedures, decision records, customer and supplier account plans, contract abstracts, pricing models, financial calendars, bank and insurance details, technical drawings, regulatory filings, licences, recurring obligations, access instructions and key external contacts. The UK government BCM toolkit's emergency-pack example includes employee, customer, supplier, utility, financial, insurance, engineering, product and secret information. Digital implementation should use proportionate security and data governance.
Information must remain usable during the key person's absence. The deputy should be able to locate the current file, understand its purpose and execute the next action. A document is incomplete when it contains the steps and omits the trigger, authority, input, exception or evidence. Process maps should show decisions and hand-offs, not only activities.
Review follows business rhythm. Customer and pipeline information may need weekly refresh. Bank mandates, authorities and system access should be reviewed after role changes and periodically. Corporate documents change through formal action. Technical knowledge should be refreshed after design or product changes. The company should record the date, owner and evidence of each review.
10. Protect liquidity with insurance, reserves and facility design
Operational transfer is the first line of response. Financial protection funds the recovery period and residual loss. The company should estimate temporary profit loss, recruitment cost, interim leadership, customer retention expense, delayed collections, lender requirements and working-capital pressure under defined scenarios.
Key-person insurance can cover specified loss associated with death or critical illness, subject to policy terms. The UK government describes it as protection where a business relies heavily on one or more individuals; HMRC guidance discusses UK tax treatment for policies intended to meet loss of trading income. Those sources establish the product concept and jurisdiction-specific tax considerations. They do not determine UAE availability, cover, beneficiary, premium, tax or accounting treatment. A company should obtain current advice from a regulated insurer, broker, tax adviser and legal counsel.
Insurance is one component. The company may need a liquidity reserve, committed revolving facility, overdraft headroom, temporary cost plan, supplier support or shareholder facility. The board should test whether a covenant, guarantee, personal undertaking or change-of-control provision becomes relevant when the key person is absent or the company is sold. Lenders should be engaged before a trigger where consent or revised authority may be needed.
The funding plan should identify the first thirty, sixty and ninety days. It should show unavoidable cash outflows, expected collection, minimum service capacity and decisions that preserve enterprise value. The plan should avoid assuming that insurance proceeds arrive immediately or cover every commercial consequence.
Table 3. Financial protection and liquidity stack
| Layer | Purpose | Evidence and decision | Residual risk |
|---|---|---|---|
| operating transfer | keep products, services, decisions and collections functioning | deputy readiness, shared relationships, procedures and tests | lower productivity, judgement gaps and stakeholder caution |
| liquidity reserve | fund immediate payroll, suppliers and recovery actions | board-approved minimum cash and access authority | reserve may be insufficient for prolonged disruption |
| committed facility | provide working-capital headroom during delay | current facility, covenants, mandate and draw process | renewal, draw conditions, security and lender consent |
| key-person insurance | provide policy benefit after an insured event | insured person, amount, term, exclusions, beneficiary and claims process | uncovered events, waiting, exclusions and amount mismatch |
| interim capability | add leadership, finance, sales or technical capacity | pre-agreed provider or rapid procurement route | onboarding delay and company-specific knowledge gap |
| transaction protections | manage continuity through a sale | retention, transition services, warranties, earn-out and governance | negotiation cost, seller dependency and post-close execution |
Product availability, policy response, tax and legal treatment require current jurisdiction-specific advice.
11. Write an incident playbook that people can invoke
The playbook begins with triggers. It should cover expected absence, unplanned short absence, prolonged incapacity, death, resignation, misconduct, loss of trust, cyber credential compromise and sale transition. Each trigger should identify who determines that the playbook is active and what evidence is required.
The first twenty-four hours focus on safety, facts, authority and essential payments. The incident lead confirms the person's status without spreading unsupported information. The company activates the deputy, secures accounts and devices, confirms bank and system access, protects payroll and urgent supplier actions, and prepares controlled stakeholder communication. Legal, HR, insurance and regulatory notifications are handled by qualified owners.
The next seventy-two hours stabilise customers, employees, lenders, suppliers and projects. The company assigns account coverage, reviews commitments, validates critical deadlines and identifies decisions needing board escalation. Communications should be accurate, respectful and proportionate. Personal medical or family information should remain protected.
The next thirty days move from response to operating recovery. Management reviews revenue exposure, cash, workload, quality, complaints, staff risk and successor needs. The board decides whether the deputy arrangement remains appropriate, an interim leader is required or a permanent search begins. The playbook should be version-controlled and accessible off the key person's systems.
12. Rehearse the plan and close evidence gaps
A plan is a hypothesis until exercised. UK government guidance states that plans should be exercised to validate them, rehearse key staff and test relied-upon systems. NIST contingency-planning guidance also connects plans, procedures and technical measures to system, operation and data recovery.
Start with a tabletop exercise. Present a defined scenario and time. Ask the deputy and response team to identify customers, contracts, cash, authorities, credentials, deadlines and communications. Record every unknown, inaccessible item and decision bottleneck. The exercise should produce corrective actions with owners and dates.
Move to a controlled absence test. The key person steps away from selected decisions for a day or week while remaining available for emergency intervention. The team operates within approved limits. Management measures decision time, error, customer reaction, rework and escalation. Sensitive or regulated work should remain inside lawful permissions.
Test access separately. Confirm that named alternatives can obtain bank, contract, CRM, ERP, tender, regulator and technical-system access through approved methods. Test backup restoration and the protected break-glass process. Keep the exercise safe: production changes, payments and privileged actions should use controlled environments or approved limits.
The board should receive evidence of performance and corrective action. A failed test is useful when it reveals dependency before an actual incident or diligence review. Repeated failure without ownership indicates a governance problem.
13. Prepare customers, suppliers, lenders and staff for transition
Stakeholder communication should follow the operating plan. Customers need a responsible contact, continuity of commitments and confidence in service. Staff need reporting lines, authority and a safe route to raise concerns. Suppliers need order and payment clarity. Lenders need accurate information on signatories, guarantees, covenants and management coverage.
The communication matrix should identify the message owner, audience, timing, channel, evidence and escalation. A planned succession can use staged introductions and a published governance transition. A sudden event requires short, factual communication and controlled follow-up. The company should avoid promises that exceed the demonstrated recovery plan.
Internal legitimacy is important. An announced deputy will struggle when senior employees continue to seek approval from the absent founder or a family member outside the formal structure. The board and ownership group should support the authorised operating arrangement. Exceptions should be recorded and limited.
The company should also map reciprocal dependency. A strategic customer may depend on one buyer; a supplier may depend on one technical contact; a lender may rely on one covenant-reporting owner. Continuity includes clear counterparts on both sides of each critical relationship.
14. Build a continuity data room before a sale process
A buyer evaluates whether cash flow survives ownership and leadership change. The continuity data room should allow the buyer to trace revenue from contract and relationship through delivery, billing, collection and renewal. It should also show who can act, how the business is governed and which capabilities remain dependent.
Core evidence includes organisation charts, role descriptions, employment terms, remuneration and retention, successor assessments, customer concentration, contracts, pipeline governance, account plans, supplier dependencies, operating procedures, authorities, bank mandates, system access, licences, disputes, insurance, incident history, exercises and corrective actions. Personal information should be minimised, access-controlled and disclosed lawfully.
The seller should prepare a dependency narrative for each material exposure. It should state the current risk, evidence, mitigation, residual issue, transition action and owner. A credible disclosure recognises remaining dependency and demonstrates a funded plan. Unsupported claims that the business "runs itself" invite deeper buyer testing.
Continuity should also shape transaction documents. A buyer may seek founder retention, transition services, restrictive covenants, customer introductions, earn-out conditions, warranties or price protection. Early preparation gives the seller more options. Qualified transaction counsel, tax advisers and valuation specialists should design the final structure.
Table 4. Key-person continuity data room for succession or sale
| Workstream | Core evidence | Buyer question answered | Readiness signal |
|---|---|---|---|
| governance and authority | memorandum, charter, resolutions, reserved matters, mandates and powers | who can validly direct and bind the company? | documents reconcile with actual practice and systems |
| leadership depth | roles, deputies, successors, assessments, retention and development | who can operate after the principal steps back? | tested alternatives with clear limits and board support |
| customers and revenue | contracts, concentration, cohorts, account maps, renewals and pipeline | will customers, pricing and growth transfer? | multi-person coverage and evidence-backed retention |
| operations and knowledge | process maps, quality controls, technical files, licences and calendars | can products and services continue to standard? | current documents, trained owners and exercise results |
| finance and cash | reporting, collections, facilities, covenants, tokens and signatories | can the company fund and control the transition? | accessible cash systems and quantified recovery headroom |
| technology and data | applications, owners, privileged access, backups and recovery tests | can the business operate securely without personal credentials? | named access, least privilege, logs and restored backups |
| risk and assurance | dependency register, scenarios, insurance, incidents and actions | has management identified and tested the exposure? | closed actions, current review and transparent residual risks |
The list should be tailored to the transaction, confidentiality obligations and applicable data-protection law.
15. Translate continuity into defensible enterprise value
Continuity affects valuation through expected cash flow, risk and market-participant judgement. The 2025 IPEV Valuation Guidelines define fair value from the perspective of market participants at the measurement date. They call for reasonable current market data and inputs, expected cash flows or earnings, a risk-adjusted rate for discounted cash-flow analysis, and documented challenge of significant assumptions.
A company should avoid applying an arbitrary key-person discount. The better approach models identifiable transmission channels. Revenue may be delayed or lost; margin may fall while new capability is hired; working capital may increase; customer acquisition may slow; transition costs may rise; or the probability distribution of outcomes may widen. Evidence of transfer can improve those assumptions.
The valuation bridge starts with the operating case and shows the adjustment under a dependency case and a mitigated case. The model should separate recurring earnings from one-time transition cost. It should also distinguish market risk from company-specific execution risk. The selected valuation method and treatment must follow the purpose, basis of value, accounting standards and qualified valuation judgement.
Customer evidence is particularly important. IFRS 3 requires an acquirer to recognise identifiable intangible assets separately from goodwill when the relevant criteria are met. IFRS Interpretations Committee material notes that contractual relationships and prior purchases are important inputs in valuing customer relationships. The seller should therefore preserve contracts, contact history, purchase patterns, retention, service records and the evidence that several employees can sustain the relationship.
Dependency affects value through cash-flow timing, durability, transition cost and risk; mitigation must be evidenced.
16. Model scenarios and disclose assumptions clearly
Scenario analysis should make management judgement visible. A base case assumes normal availability and current performance. A continuity case assumes the key person becomes unavailable on a specified date and the tested deputy arrangement operates. A severe case assumes absence coincides with a customer renewal, facility action or sale process. A planned-transition case tests orderly handover over six or twelve months.
For each case, management should estimate revenue conversion, retention, delivery capacity, billing, collection, working capital, interim cost, recruitment time and recovery. The model should show the source and owner of each assumption. Historical evidence, customer contracts, exercised recovery times and signed employment or facility terms carry more weight than management confidence.
An illustrative management case can help. Assume a business generates AED 80 million of annual revenue, with AED 28 million from accounts whose senior relationship is concentrated in one founder. Management might test a ninety-day absence, a range of renewal deferral, an interim-leadership cost, a two-month collection extension and a six-month customer-transfer programme. These values are examples and do not describe any actual company or forecast.
The board should use the model to allocate effort. A low-revenue dependency can be urgent when it controls bank access or a licence. A high-revenue relationship can be manageable when several leaders are trusted, contracts are clear and service is delivered through a strong team. The model directs action; it does not replace judgement.
17. Execute a 120-day continuity programme
The first thirty days establish governance and exposure. The board appoints a sponsor, defines scope and confirms confidentiality. Management maps critical products, services, cash events, people, authority and access. It builds the first dependency register and selects the highest-priority outcomes. Legal advisers review corporate authority and employment boundaries where needed.
Days thirty-one to sixty build transfer mechanisms. Account teams are assigned, customer and supplier plans are updated, deputies receive authorised access, decision playbooks are drafted and critical documents are organised. Management validates bank mandates, contract limits, system roles and emergency invocation. Insurance and liquidity options are tested with regulated providers.
Days sixty-one to ninety exercise the design. The company runs tabletop, controlled-absence and access tests. It measures recovery time, decision quality, customer response, control exceptions and missing evidence. The board approves corrective actions and decides whether interim or external capability is required.
Days ninety-one to one hundred and twenty embed the system. Management closes high-risk actions, refreshes the data room, aligns succession and retention decisions, and integrates dependency metrics into the operating review. The board receives a residual-risk report and approves the next exercise schedule. For a sale, the transaction workstream converts the evidence into buyer-ready disclosure and transition options.
Each phase closes with evidence, an accountable owner and a board decision.
18. Govern the scorecard and the next decision
The board scorecard should report outcomes and controls. Outcome metrics include revenue retained through a transition, service levels, collection time, customer escalation, employee turnover, delivery quality and recovery time. Control metrics include critical roles with tested deputies, strategic accounts with multi-person coverage, current authority records, accessible procedures, exercised systems and closed corrective actions.
Metrics should retain the denominator. "Ninety percent documented" can hide the one bank mandate or regulator portal that controls survival. Report the number and value of red dependencies, the value of revenue covered, the amount of accessible liquidity and the recovery objective met. Separate tested capability from planned action.
The board should review key-person exposure quarterly and after a trigger: leadership change, acquisition, financing, major customer win, new jurisdiction, system migration, incident or sale preparation. A management owner should maintain the register. Internal audit or an independent reviewer can test selected evidence when the exposure is material.
The commercial objective is continuity of cash flow and confidence. The governance objective is lawful, accountable action. The transaction objective is evidence that a buyer can own the enterprise without purchasing permanent dependence on the seller. Those objectives reinforce each other when the company institutionalises customer trust, judgement, authority and knowledge.
Table 5. Board execution scorecard
| Metric | Definition | Owner | Board question |
|---|---|---|---|
| revenue under resilient coverage | annual revenue with at least two active relationship owners and current account evidence | commercial lead | how much cash flow can continue without the primary person? |
| critical outcomes meeting RTO | tested outcomes recovered inside the board-approved objective | operating lead | which product, service or cash event remains outside tolerance? |
| valid authority coverage | critical decisions with ordinary and emergency authority documented and operable | company secretary and CFO | can authorised people act today across legal and digital systems? |
| deputy readiness | critical roles demonstrated through supervised work and an absence exercise | people lead | which named deputies have evidence of competence and legitimacy? |
| knowledge accessibility | priority procedures and records found and used by an alternative owner | functional leaders | is the current evidence usable without the key person's help? |
| corrective-action closure | high-priority exercise and incident actions closed by due date | programme owner | are recurring gaps receiving accountable investment? |
| liquidity coverage | accessible cash and committed headroom relative to the defined recovery requirement | CFO | can the company fund the first ninety days of recovery? |
| sale-readiness evidence | completed continuity data-room items with transparent residual risks | transaction lead | can a buyer validate transferability efficiently? |
Targets should be calibrated to the company, reviewed after exercises and supported by dated evidence.
Table 6. The board decision agenda
| Decision | Evidence required | Approval | Follow-up |
|---|---|---|---|
| risk appetite | critical outcomes, MTPD, RTO, financial exposure and escalation thresholds | board | quarterly and after material change |
| priority dependencies | dependency register, revenue and cash impact, substitutability and control gaps | executive committee with board oversight | monthly until red items close |
| deputies and successors | role criteria, observed performance, authority, stakeholder feedback and development plan | board or authorised committee | after each exercise and performance cycle |
| authority architecture | constitutional documents, resolutions, mandates, limits and system roles | board and relevant authorised officers | after role or legal-structure change |
| liquidity and insurance | scenario funding need, policy terms, facility headroom and residual exposure | board | at renewal and after exposure change |
| transaction disclosure | data room, dependency narrative, mitigation, residual issues and transition options | deal steering committee | throughout preparation and diligence |
| residual risk acceptance | test results, open actions, accountable owners, cost and target date | board | documented until retired or reapproved |
The agenda converts the framework into accountable approvals.
Implementation conclusion
Key-person continuity is an enterprise-design programme. The board identifies which outcomes matter, how people support them, what authority and access they need, and how quickly the company must recover. Management transfers relationships, judgement and knowledge through observed work, governed delegation and evidence. Exercises reveal whether the design operates under pressure.
The programme supports succession and sale readiness because it addresses the buyer's central question: will cash flow, service and control remain with the company after the individual steps back? A defensible answer combines current corporate authority, tested deputies, shared customers, accessible information, protected systems, liquidity and transparent residual risk. The same evidence helps the company operate with greater confidence before any transaction begins.
References
- United Arab Emirates Legislation. Federal Decree by Law No. 37 of 2022 Concerning the Family Businesses. https://uaelegislation.gov.ae/en/legislations/1608
- UAE Ministry of Economy and Tourism. Federal Decree Law No. 37 of 2022 Concerning Family Companies, official English text. https://www.moet.gov.ae/documents/20121/0/family%2Bcompany%2Benglish%2Bversion%2Bexamined%2Band%2Bcorrecetd.pdf/5639a956-fe15-6de2-a04e-c8f8ecb6c2bf
- UAE Ministry of Economy and Tourism. Family Business. https://www.moet.gov.ae/en/family-business
- Abu Dhabi Global Market Academy and Abu Dhabi Family Business Council. Strategic partnership to advance family business excellence, 17 September 2025. https://www.adgm.com/media/announcements/adgm-academy-and-abu-dhabi-family-business-council-sign-strategic-partnership-to-advance-family-business-excellence
- OECD. G20/OECD Principles of Corporate Governance 2023. https://www.oecd.org/content/dam/oecd/en/publications/reports/2023/09/g20-oecd-principles-of-corporate-governance-2023_60836fcb/ed750b30-en.pdf
- International Organization for Standardization. ISO 22301:2019 Security and resilience; business continuity management systems; requirements. https://www.iso.org/standard/75106.html
- UK Government. Resilience in society: infrastructure, communities and businesses. https://www.gov.uk/guidance/resilience-in-society-infrastructure-communities-and-businesses
- UK Cabinet Office. Business Continuity Management Toolkit. https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/137994/Business_Continuity_Managment_Toolkit.pdf
- UK Government. Organisational Resilience Guidance for UK Government Departments, Agencies and Arm's Length Bodies. https://www.gov.uk/government/publications/organisational-resilience-guidance-for-uk-government-departments-agencies-and-arms-length-bodies/organisational-resilience-guidance-for-uk-government-departments-agencies-and-arms-length-bodies-albs-html
- National Institute of Standards and Technology. SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems. https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final
- UK National Cyber Security Centre. Use privileged access management. https://www.ncsc.gov.uk/collection/secure-system-administration/use-privileged-access-management
- UK National Cyber Security Centre. Introduction to identity and access management. https://www.ncsc.gov.uk/guidance/introduction-identity-and-access-management
- UK Government Business.gov.uk. Insuring your business; key person insurance. https://www.business.gov.uk/support/regulations-and-licensing/insuring-your-business/
- HM Revenue and Customs. BIM45525; insurance for employees and other key persons, updated 3 July 2026. https://www.gov.uk/hmrc-internal-manuals/business-income-manual/bim45525
- IFRS Foundation. IFRS 3 Business Combinations. https://www.ifrs.org/issued-standards/list-of-standards/ifrs-3-business-combinations/
- IFRS Interpretations Committee. Customer-related intangible assets, IFRS 3 and IAS 38, March 2009. https://www.ifrs.org/content/dam/ifrs/supporting-implementation/agenda-decisions/2009/ifrs-3-ias-38-customer-related-intangible-assets-march-2009.pdf
- International Private Equity and Venture Capital Valuation Board. International Private Equity and Venture Capital Valuation Guidelines, December 2025. https://www.privateequityvaluation.com/Portals/0/Documents/Guidelines/2025%20IPEV%20Valuation%20Guidelines.pdf
- International Valuation Standards Council. International Valuation Standards overview, including IVS 200 Businesses and Business Interests. https://ivsc.org/standards/
About the Author
Authored by Chennakeshav Adya, Independent Researcher
