Most investment management firms have one – the person who built the reporting spreadsheets, who knows which cells reference which feeds, and who is the only one who can fix it when something breaks. The person whose holiday creates a minor crisis and whose resignation would create a major one.
This is key-person risk in investment reporting – and it is more common, and more serious, than most firms acknowledge until something goes wrong.
Why reporting is especially vulnerable to key-person risk
Reporting processes accumulate complexity over time. A spreadsheet model that started as a simple quarterly template grows to incorporate custom calculations for specific client mandates, bespoke benchmarks, regulatory disclosures added to meet successive compliance requirements, and workarounds for data quality problems that were never properly fixed.
The person who built this system understands it in a way that cannot be captured in a user guide. They know that the figure in row 47 only works if the custodian file arrives in a specific format. They know that the January production run needs a manual adjustment for the annual charge calculation. This knowledge exists in their head, but not necessarily in the documentation.
What actually happens when that person leaves
In the best case, there is a handover period and the departing person documents what they know. In practice, handovers are almost never thorough enough. The documentation covers the obvious steps but misses the institutional knowledge – the less common scenarios, the workarounds, the things the person does automatically without thinking to mention them.
The first reporting cycle after they leave usually reveals some of the gaps. A calculation produces a result nobody can explain. A client template breaks because a data field changed format. A report goes out late because nobody knows which part of the process is blocked.
How to assess your exposure
The simplest diagnostic is this question: if [name] left tomorrow, how long would it take your next reporting cycle to go out, and how confident would you be in its accuracy? And the cycle after that, and so on through a year. If the honest answer is “we’d struggle” – you have a problem worth addressing.
A more structured assessment maps every step in the reporting production process and asks, for each step: who can perform this, what documentation exists, and what would break if the primary person were unavailable. Steps where the answer to all three questions is “one person, none, and everything” are your highest-risk points.
Structural fixes: beyond documentation
Documentation helps, but it is not sufficient on its own. The underlying problem is usually that the reporting process is built around tools and workflows that are inherently fragile – spreadsheets, manual steps, and undocumented institutional knowledge.
The structural fix is replacing that fragility with a dedicated reporting platform that externalises the process logic. When the rules for how reports are produced are encoded in a platform rather than in someone’s head or spreadsheet, the departure of any individual does not take those rules with them. Once this is done, anyone can complete any or all of the reports – with no reliance on a single individual and their specialist knowledge.
The talent market argument
Key-person risk in reporting is also a talent retention issue. Skilled operations professionals do not want to spend their careers maintaining fragile spreadsheet models and acting as the irreplaceable custodian of a broken process. Firms with modern reporting infrastructure are, in practice, better placed to attract and retain good people than those still running on legacy systems.
Frequently asked questions
How much notice do you need to safely hand over a complex reporting process?
Realistically, months of structured handover is required for a complex reporting environment – and even that is only viable if the outgoing person is motivated to document thoroughly. Firms that discover the risk at the point of resignation rarely have enough time for a safe handover. The better answer is to remove the dependency before it becomes a resignation risk.
Is cross-training staff sufficient to address key-person risk?
Cross-training is valuable and should be part of any business continuity plan. But it does not address the underlying fragility of a reporting process that depends on undocumented manual steps and bespoke spreadsheet logic. A second person who can run the spreadsheet is still a person who can leave.
Does outsourcing reporting to a managed service remove key-person risk?
Yes – this is one of the most significant operational benefits of a Reporting as a Service model. When reporting infrastructure is owned and maintained by a specialist provider, the risk of individual departures – whether on your team or the provider’s team – is absorbed by the provider’s operational model rather than falling on you.