Beyond the Bus Factor

Sector overlay

Bus factor for small teams and collectives

Where one person carries most of the operation and nobody has ever counted.

The bus factor audit is written to work anywhere. This adds what it cannot know about your setting: the vocabulary, the rows specific to small teams, and the failure this setting most often turns out to have.

This overlay is for groups of roughly two to fifteen people: a small business, a volunteer group, a collective, a band, a co-operative, a community organisation, a side project that other people now rely on. The defining feature is not the sector. It is that there is no spare capacity, and the answer to most of the audit is one person.

Start smaller than the audit suggests

The full audit assumes you have time. You do not. Run it in two passes.

Pass one, thirty minutes. Only two questions, and only about things that would stop you operating this week:

  1. What can only one person do?
  2. What can only one person get into?

Write both lists. That is a usable audit, and for most small teams it turns up the same three or four things every time.

Pass two, when you have an afternoon. Work through the full audit properly, with the rows below.

What things are called here

In the audit Here
Whoever decides Whoever it lands on, which is worth naming out loud
Direction and priorities What we are doing next, usually not written down
Whoever funds or pays you Customers, members, the grant, the one big client
Documentation Usually a shared drive, sometimes somebody's memory
Roles a regulator requires Depends entirely on what you do, and worth checking rather than assuming there are none

Rows to add to your audit

Area Who? Bus factor Risk level
The one big customer, member or funder      
Accounts in a personal name rather than the group's      
Anything paid for on somebody's personal card      
The shared drive, and who actually owns it      
Tools on a free tier tied to one login      
Insurance, and whether you have any      
Whatever legal form you have, and who understands it      
The unpaid work somebody does that keeps the rest possible      
Whether anybody outside the group could reach you in an emergency      

The failure this setting usually has

Everything is in one person's name, and it happened by accident.

Small groups do not decide to concentrate risk. Somebody sets up the account because somebody had to, on the card that was in their wallet, in the five minutes available. That is a reasonable thing to have done. Nobody revisits it, because it works, and revisiting it is nobody's job.

Years later the domain, the bank account, the software subscriptions, the shared drive and the mailing list are all attached to one individual, and the group has no way to reach any of it. Not because anybody hid anything. Because setting things up properly costs an hour that never existed.

The second failure is the invisible work. In a small group somebody keeps the rhythm going: chasing, reminding, noticing, smoothing over. It is not on any list, it is often not recognised as work at all, and when that person steps back the group frequently stops functioning for reasons nobody can name.

The third is no slack to recover with. Larger organisations absorb a loss badly. Small ones do not absorb it at all. This is why the cheap fixes matter more here than anywhere else: a second signatory and a shared password manager are an afternoon, and they are most of the difference between a difficult month and the end of the thing.

A worked example

A composite, built from patterns rather than one group. Treat it as a shape to recognise, not a case study.

A community group of six, running a monthly event for about a decade.

The thirty minute pass produced two lists. Only one person could take bookings, do the accounts, or post from the social accounts. Only one person could get into the email, the booking tool, the bank, the domain or the drive. It was the same person on both lists, and she had been saying for two years that she wanted to step back.

Nothing was written down, which everybody knew. What they had not registered was that the domain renewed to a card belonging to somebody who had left in 2019, and had been auto-renewing on a card that would expire.

What they did in thirty days: a shared password manager with three people in it. Moved the domain to an account the group owned. Added a second person to the bank. Put the renewal dates in a shared calendar, which cost about ten minutes and removed an entire category of risk.

What they did in ninety days: two others took a turn at taking bookings, one event each, with her available but not doing it. She wrote a page on how the accounts work, which took an hour and had been described as a big job for two years.

What did not happen: she did not step back. She has more time and the group has options, and the thing she said afterwards was that it was the first time anybody had asked what she actually did.

Scenarios worth running first

From the scenario cards:

Then