Every small business has one document nobody wants to write. Not the marketing plan. Not the employee handbook. The one that starts with the sentence: if the owner is suddenly gone, here is how the company keeps running.
It is uncomfortable, and it is also one of the most generous things an owner can do. Your employees have mortgages. Your clients have deadlines. Your family may inherit a business they have never logged into. A weekend of preparation is the difference between a manageable transition and months of people locked out of everything while they grieve. This is general information, not legal advice. The documents that grant authority, wills, powers of attorney, operating agreements, and buy-sell agreements, need an attorney, and the rules vary by state.
Start With the List Only You Can Access
Before you plan anything, take an inventory. Walk through a normal month and write down everything where you are the only person who can get in, approve, or sign. Most owners are surprised how long this gets.
- Banking and payments. Operating accounts, the credit card portal, the merchant processor, wire approvals, and anything requiring your signature.
- Payroll. The payroll platform, the approval step, and the tax filing login. Payroll runs on a schedule that pauses for nothing.
- Domain and DNS. The registrar account and where the website and email records point. If the domain lapses, company email stops, which stops nearly everything else.
- Email and identity administration. The Microsoft 365 or Google Workspace global administrator account. Whoever holds this can restore access to most other systems, which is why it needs a documented successor.
- Insurance and benefits. The general liability, cyber, key person, and health plan portals, plus the broker’s contact info.
- Key vendor and client accounts. The software subscriptions your operation depends on, the client portals, and any account tied to your personal email rather than a company address.
- The password manager. The vault itself, its recovery process, and any hardware security key that protects it. This is usually the single most important item on the list.
One specific trap: accounts registered to a personal email address or personal phone number. Those are hardest to recover, because the provider has no relationship with your company. Move them to company addresses now, while it is a five minute task. If hardware keys or passkeys protect your accounts, make sure backup keys exist somewhere a successor can reach. We compare the options in what is a YubiKey.
Who Steps In, and How They Get Access Legally
Naming someone is not the same as empowering them. Access without authority creates one set of problems, authority without access a different set. You need both, and they come from different places.
The authority side belongs to your attorney. Depending on entity type and state, that may involve an operating agreement naming a successor manager, a durable power of attorney for business matters, a buy-sell agreement funded by insurance, or provisions in your will. Do not improvise. An informal note saying “Dana should take over” is not an instrument of authority, and banks will not honor it.
One item people miss: the IRS says a responsible party is “someone who owns, controls or exercises effective control over a business,” and instructs businesses to use Form 8822-B to report a change of responsible party “to the IRS within 60 days.” That is a real obligation your successor needs to know about, and one your accountant can help with.
The access side is yours to arrange: a small number of named people who can reach the password vault through its documented emergency access process, a sealed envelope in a safe or safe deposit box for the few credentials that cannot live in a vault, and written instructions saying where those things are. Then tell the people involved. A plan nobody knows about is not a plan.
The Documentation That Turns Chaos Into a Handover
Credentials get someone in the door. Documentation tells them what to do inside. The SBA frames emergency preparedness as three steps, assess your risk, create a plan, and execute it, noting that “your response plan is your roadmap to recovery, so it should be tailored to your business’s specific needs and operations.”
- The calendar of obligations. Payroll dates, tax filing deadlines, insurance renewals, loan payments, and subscription renewals. What is due, when, and how it gets paid.
- The people list. Your accountant, attorney, insurance broker, banker, IT provider, and landlord, with direct phone numbers. Not just the main office line.
- Client commitments. Who you owe what, contract renewal dates, and anything with a penalty for missing it.
- How the work actually gets done. The two or three processes only you fully understand. Write them down, even roughly. Rough notes beat nothing by an enormous margin.
- The first week script. A one page note saying who to call first, what to tell employees, what to tell clients, and what can safely wait. This is the most comforting page in the binder.
Keep records where a successor can find them. The SBA notes that “you may be legally required to maintain tax and employment records, among other files” and that common guidelines advise keeping them three to seven years. A locked cabinet nobody has the key to does not count.
Emergency Plan Versus Succession Plan
These get confused constantly, and the difference matters because they solve different problems on different timelines.
An emergency plan answers the next 30 days. Who signs checks on Monday. How payroll runs Friday. Who tells the clients. Who has the passwords. It is operational, short, and written by you. Every owner-dependent business needs one, and you can draft the first version this month.
A succession plan answers the next five years. Who owns the company. Whether it is sold, transferred to family, or bought by a partner or the employees. How it gets valued and funded. That involves your attorney, accountant, and often a valuation professional, and it takes longer. Both are worth doing. The emergency plan is the one that keeps the doors open long enough for the succession plan to matter.
Reviewing It Once a Year
Plans decay quietly. Vendors change, passwords rotate, the person you named moved to Ohio. An out of date plan can be worse than none, because it creates false confidence. Put a recurring appointment on the calendar and give it an hour.
- Confirm the people. Is your designated successor still willing and still reachable? Are the emergency contacts current?
- Test the access. Have your successor actually run the vault’s emergency access process, or verify the sealed envelope is where it should be. Untested access is a guess.
- Update the inventory. New vendors, new bank accounts, retired systems.
- Re-read the first week script. Does it still describe your business?
- Check in with your attorney and accountant. Ownership changes, entity changes, and new debt can all affect the legal documents.
The SBA also recommends practicing your plan with staff so you are ready when something happens. That does not require a formal drill. Walking a trusted employee through the binder once a year does most of it.
The Bottom Line
Write the list of what only you can access. Name the people who step in, and have your attorney create the documents that give them real authority. Put credentials somewhere a successor can reach through a documented process. Write the one page first week script. Review it annually. That is a weekend of work, and it protects everyone who depends on the business you built. Start with the inventory. The rest gets easier once you can see it on paper.
We help owners map out the technical half of this: the account inventory, administrator succession, credential vaulting, and documentation a successor could actually use. It pairs with the coverage questions in what to look for in an IT partner. If you would like a hand getting started, we work with small and mid-sized businesses across Denton County. Contact us today.
Sources:
Comments are closed