Here is a scene we walk into often. A son or daughter has come back into the business with fresh ideas and a list of things that should have been fixed years ago. The founder, who built the whole thing from a truck and a phone book, is being asked to approve replacing a system that has worked fine since before the new ideas had a driver’s license. Both of them are right. That is what makes it hard.
Family businesses carry something most companies do not: methods shaped by real customers, real mistakes, and real years. They also carry a real risk, which is that all of it lives in one person’s head. Modernizing a family business is not a fight between old and new. It is a translation project. Get what the founder knows out of memory and into a system, then change things in an order that does not make anyone feel run over.
“We Have Always Done It This Way” Usually Contains Real Information
That sentence gets treated as resistance. Sometimes it is. More often it is a compressed answer to a question nobody asked. The odd invoice numbering exists because a large customer’s accounting system chokes on anything else. The paper log by the terminal exists because the software drops a field on Fridays. Rip that out without understanding it and the problem comes back in a month, louder.
- Ask why before you ask whether. Sit with the person who built the process and ask what happens if the step is skipped. The answer is usually specific and usually about a customer.
- Watch the workaround. Every manual step somebody does without thinking is a requirement in disguise. Write it down as a requirement before you shop for software.
- Map the exceptions. Family businesses run on exceptions: the customer who gets net 60, the job that gets priced differently. New systems break on exceptions, so collect them first.
When the Founder Is the Documentation
This is the quiet emergency in most family businesses, and it has nothing to do with anyone’s age. If one person is the only one who knows the bank login, which vendor to call about the compressor, and how the pricing spreadsheet calculates, that person cannot take a real vacation and the business cannot be handed over cleanly. Documentation is what makes a business worth something to somebody other than the person running it.
The National Institute of Standards and Technology’s Small Business Quick-Start Guide, published in February 2024, recommends a plain inventory of the software, hardware, systems, and services a business relies on, including who administers each one and what happens if access is lost. That table is a fine starting point for a handover even if you never think about cybersecurity again.
- Accounts and who controls them. Every login, the email attached to it, and who can reset it. Keep it in a shared password manager, plus the vendor account numbers and the real phone numbers behind them.
- The five things only one person knows. Ask directly. Most founders can name them in ten minutes if the question is asked with respect rather than alarm.
- How you get back up. Where backups live, who can restore them, and how long it would take. NIST recommends testing restores, not just scheduling backups.
Phase the Change So Nobody Gets Overruled
Most technology projects in family businesses do not fail on the technology. They fail because somebody felt handled. The way around that is a process where the founder sees the evidence and keeps a hand on the wheel.
- Pick a small, real pilot. One crew, one route, one product line. Big enough to prove something, small enough that failure costs a week.
- Agree what success looks like first. Write the number down before the pilot starts. Hours saved, errors avoided. Otherwise the debate afterward is about feelings.
- Run in parallel, briefly. Old way and new way at the same time for a defined period, with an end date. Parallel forever is how you end up with two systems and twice the work.
- Name who decides. NIST’s guide advises identifying who is responsible for developing and executing the plan. One named decision maker per project keeps the argument from becoming a family argument.
Security Conversations That Do Not Sound Like Accusations
“Everybody uses the same login” comes up in almost every family business we meet, and it is never said with embarrassment, because for years it was simply how a small trusted shop worked. The mistake is responding as if it were carelessness. It was reasonable when there were four people, all related, in one building. It stops being reasonable at twenty two people with a customer portal and a bank account reachable from anywhere.
- Blame the situation, not the person. The business changed and the controls did not keep up. That happens to growing companies. It is not a character flaw.
- Frame separate logins as protection for the innocent. Shared accounts mean nobody can prove what they did or did not do. Individual accounts protect good employees as much as they catch bad ones.
- Start with the accounts that move money. Banking, payroll, and email first. CISA’s cyber guidance for small businesses urges organizations to ensure all staff use multi-factor authentication on key systems, especially email, and to enforce it with technical controls rather than good intentions.
- Restrict by need, not by rank. NIST advises limiting sensitive information to the people who need it and removing access when they no longer do. That includes family members who moved on to other things.
For the business case rather than the technical one, see our piece on why cybersecurity is no longer optional.
Hand Over the Technology With the Ownership
Succession planning is on the U.S. Small Business Administration’s own list of challenges family businesses face, along with generational disagreements about how things should be done. The technology side of a handover rarely makes the lawyer’s checklist, and it should. A business whose domain name is registered to a personal email address does not fully belong to the company that depends on it.
- The domain name. Confirm the registrar account is in the company’s name, with a company email as the contact, and that more than one person can get into it.
- The primary email and phone. Recovery codes and password resets flow through these. If they point to a personal account, the whole chain of ownership runs through one individual.
- An access review on the handover date. Treat it like changing the locks. Not a statement about anyone, just a normal step at a normal moment.
The Bottom Line
The two generations are usually arguing about the wrong thing. The real question is not old versus new. It is whether the knowledge that made the company work can survive being written down, and whether change can happen at a pace that leaves everyone’s dignity intact. Extract the reasons, document what only one person knows, pilot before you commit, and put the accounts in the company’s name. Then the handover is a plan instead of a scramble.
An outside party helps here more than people expect, not because we know your business better than you do, but because we are not at Thanksgiving dinner. A neutral voice can ask awkward questions without them landing as family history. For what to look for in that kind of partner, see our guide to choosing an IT partner.
We work with family owned businesses across Denton County on exactly this: documenting what lives in one person’s head, phasing changes so nobody feels steamrolled, and making sure the accounts and the domain belong to the company. If a handover is coming, or you just want the business to survive a two week vacation, we would be glad to talk. Contact us today
Sources:
Comments are closed