A staffing agency with 35 employees loses its office manager to a competitor. The handover is friendly: two weeks of training, a folder of notes. Three weeks later the domain renewal fails because the reminder went to her old mailbox, closed on her last day. The website is down for a morning. Client emails bounce. Nobody can log in to the registrar, because the account was in her name, with the two-factor codes on her personal phone.
Nothing dramatic happened. Nobody was careless. The business never asked who could administer each of its tools, because every tool had always worked.
The scheduling system, the bank portal, the cloud storage, the email admin, the social profiles: each has an owner, and in most businesses under 100 people that owner is one person, often the founder himself. The accounts work. They keep working right up to the day that person is unavailable.
This guide names the problem, shows what happens when the only admin leaves, and gives you a five-column access inventory you can fill in with a pen. It ends with the four cheapest fixes and a one-page departure checklist. Nothing here needs an IT department.
What is access concentration, and why does nobody check for it?
Access concentration is the state where one person is the only one who can administer a critical business account. It is the most common risk in small businesses and the least examined, because it produces no symptoms. The account works every day. Nobody notices it works only through one person until that person is gone, and the login, the recovery email, and the phone with the codes go with them.
The kwapso definition: access concentration is the state where a critical system, account, or portal can be administered by exactly one person in the business, so that their absence, departure, or lost phone locks the company out of its own tools.
It accumulates one signup at a time. Someone sets up the first tools in year two because they are capable and nobody else wants to. Ten years later the business pays for twenty subscriptions, and the same person is admin on fourteen of them. Nobody decided this.
Nobody checks because the question sounds technical, so the founder assumes it belongs to IT, and the business has no IT. It also never produces a near miss. Most risks announce themselves with small failures first. Access concentration fails once, completely, and usually at the worst moment: an exit, a dispute, an illness, a holiday.
What actually happens when the only admin leaves?
When the only admin leaves, three things happen in sequence. First, the accounts keep working, so nobody acts. Second, a routine event hits an account: a renewal, a password reset, a new hire who needs access. Third, the business discovers it cannot get in, and the recovery route runs through a closed mailbox or a phone that belongs to someone who no longer works there.
The friendly exit is the common case and it still goes wrong. A handover covers tasks, not credentials. The replacement learns how to run payroll and gets the payroll login. Nobody checks who owns the registrar account or whose phone receives the bank portal codes. Those were never tasks. They were setup decisions from years ago.
The unfriendly exit is rarer and worse. A dismissed employee who is sole admin on the email domain can, in practice, read every inbox and lock out every colleague. No contract clause reverses a password.
Then there is the exit nobody planned: illness, accident, a lost phone on a Friday. A 2023 SHRM study found that 72% of companies have at least one employee whose sudden departure would significantly disrupt operations. In the businesses we work with, the stoppage CEOs describe most often is not lost knowledge. It is a login nobody else holds.
The wider picture on what one departure takes with it: If Your Best Employee Quits Tomorrow, What Breaks?
Access concentration fails once, completely, and usually at the worst moment: an exit, a dispute, an illness, a holiday.
How do you run an access inventory in one afternoon?
An access inventory is a single table with one row per critical account and five columns: the tool, the admin, the second admin, where the credentials live, and what happens on departure. You fill it in by opening each account's admin settings and reading what is there, not from memory. For a business with twenty tools it takes two to three hours and fits on one page.
Domain and DNS
Admin (role): Founder
Second admin: none
Where credentials live: Founder's phone
What happens on departure: Lockout, renewal risk
Bank portal
Admin (role): Founder
Second admin: Office manager
Where credentials live: Both phones
What happens on departure: Covered
Scheduling system
Admin (role): Office manager
Second admin: none
Where credentials live: Her browser
What happens on departure: Nobody can add or remove users
Cloud storage
Admin (role): Founder
Second admin: none
Where credentials live: Founder's laptop
What happens on departure: Files inaccessible
Email admin
Admin (role): External IT contact
Second admin: none
Where credentials live: Unknown
What happens on departure: Dependent on supplier
Social and review profiles
Admin (role): Former marketing hire
Second admin: none
Where credentials live: Unknown
What happens on departure: Already lost
Three rules for filling it in.
Check the account, not your memory. Open each tool's admin panel and read who holds administrator rights. In the businesses we work with, the founder's memory is wrong on roughly a third of the rows, usually because the account was set up by someone who has since left.
"Where credentials live" must be a place a second person can reach. "His phone" and "her head" are honest answers, and both mean the same thing: nowhere.
Fill in the last column without softening it. If the second admin cell is empty, the answer is "lockout". Writing it down is the point.
Most businesses find the same picture the first time: six accounts, one person, no backup. If the one person is you, the inventory is also the first page of your succession plan.
Which accounts matter most?
Six account types carry most of the access risk in a service business: the domain and DNS, the bank and payment portals, the scheduling or job system, cloud storage, the email admin, and the social and review profiles. These are the accounts where a lockout stops a client-facing function or cannot be recovered with a support ticket. Start with these six.
Domain and DNS. The most dangerous row and the least glamorous. Whoever controls the domain controls the website, every email address, and every tool that sends mail for the company. If the registrar account is in a person's name, the company does not own its domain in any practical sense.
Bank and payment portals. Usually the best-protected row, because banks force a second signatory. The gaps are in payment providers and card terminals, set up in a hurry by one person with their own phone for the codes.
The scheduling or job system. With one admin, nobody can add a new hire, remove a leaver, or change a setting while that person is on holiday. The work continues, but the tool slowly stops matching reality.
Cloud storage. A quieter lockout that lasts longer. Files set up under one person's account, with colleagues added as guests, become inaccessible when that account is closed. Many businesses discover years of client documents belonged to an employee's user account, not the company.
Email admin. Whoever administers the email domain can create and close mailboxes, reset any password, and read any inbox. Often this is an external IT contact, which is fine as long as the business holds a second admin login of its own.
Social and review profiles. The row most often already lost. A page created by a marketing hire years ago, with the login on their personal email. Recovery through the platform can take months.
Where the files behind these accounts actually live is its own question: Where Does Your Business Data Actually Live?
In the businesses we work with, the founder's memory is wrong on roughly a third of the access inventory, usually because the account was set up by someone who has since left.
How do you fix access concentration in a small business?
You fix access concentration with a second admin on every critical account, a shared credential vault, a renewal calendar, and a one-page departure checklist. Together these four take about one working day and remove nearly all of the risk. None requires new software beyond a vault, and none requires the founder to understand how any tool works.
Second admin on every critical system. About one hour. For every row with an empty second admin cell, add one, by role: typically the founder and the office manager. This single step turns a lockout into an inconvenience. It is the highest return on time of anything in this guide.
Shared credential vault. About half a day. One place where every shared credential lives, reachable by at least two people, with the recovery email pointing to a company mailbox. Which vault you choose matters far less than the rule that nothing shared lives in a browser, a notebook, or a phone.
Renewal calendar. About one hour. Domain, certificates, licenses, the one annual subscription nobody remembers until it lapses. One shared calendar, reminders sent to a role mailbox, not a person. Many lockouts are renewal problems that became access problems because the only admin was gone.
Departure checklist on one page. About one hour to write, then reused for every exit. The next section gives you the contents.
One working day. That is the whole cost of removing a risk that, when it lands, costs weeks. The reason most businesses have not done it is not effort. Nobody had the list.
If the inventory also revealed tools you forgot you were paying for: The Tool Stack Audit: Every Tool You Pay For, One Page, Four Decisions
How do you remove an employee's access when they leave the company?
You remove a leaver's access with a five-step checklist, run on their last day by whoever owns operations, whether the exit is friendly or a dismissal: transfer admin rights, rotate shared credentials, move owned documents, forward and then close the mailbox, and confirm each row in the access register. It fits on one page and takes under two hours for a typical leaver.
1. Transfer admin rights. Filter the inventory for every row where the leaver is admin or second admin and reassign to the role taking over. The founder handles the domain and bank rows.
2. Rotate shared credentials. Any password the leaver knew that others also use gets changed today, and the new one goes into the vault. This step is most often skipped because it feels like distrust. It is the same rule for every leaver, which is what makes it fair.
3. Move owned documents. Any file or shared drive owned by the leaver's user account is transferred to a company account before the user is closed. Closing first and transferring later is how businesses lose archives.
4. Forward, then close the mailbox. Forward the leaver's mail to a role mailbox for a fixed period, then close it. Before closing, search it for "renewal", "verify", and "account" to find any service still pointing recovery at that address.
5. Confirm in the access register. Walk the inventory once more and tick each row. The register is only true if someone updates it on the day.
Five steps, not an IT project. The checklist does its real work before anyone leaves: once it exists, the business notices which accounts it would struggle to transfer, and fixes them while everyone is still here.
Where does AI fit?
An AI assistant cannot reset a password it has no right to, and it cannot recover an account whose codes go to a phone that left the building. Access is a structural prerequisite, not something automation or AI can route around. Any assistant or integration you add in 2026 authenticates through the same accounts in your inventory, and inherits every gap in them.
The order is the same as everywhere else in operations. Structure first: the inventory, the second admin, the vault. Automation second: the renewal calendar that reminds a role mailbox, the offboarding checklist that triggers when HR marks a leaver. AI third, once every tool it reads from or acts in has a company-owned admin and a recoverable login.
The business that has done the access work has also laid part of the groundwork for AI readiness: it knows which systems it has and who owns them. For what AI actually needs from your operations: 95% of AI Projects Deliver Zero ROI. Here's Why, and What to Fix First.
Access is one of five dependencies that can stop a business. Want the other four? Read next: Your Business Has Five Single Points of Failure. Here Is How to Find Each One.
Is the one person on every row of the inventory you? Read next: The Two-Week Test: Could Your Business Run If You Took a Real Holiday?
Your Next Step
If there is one thing to take from this guide: until you have checked, you do not know which of your accounts only one person can administer. The risk is not that something dramatic happens. It is that someone ordinary leaves, and a login leaves with them.
You now have the access inventory, the six accounts to check first, the four fixes with their time estimates, and the one-page departure checklist. You can find your lockouts this afternoon and remove most of them this week. Here is the order:
Step 1: List every tool, portal, and account the business depends on. The full twenty, not the obvious five.
Step 2: For each, open the admin settings and record the admin, the second admin, and where the credentials live.
Step 3: Mark every row with an empty second admin cell or a credentials cell that reads "phone" or "head". Those are your lockouts.
Step 4: Add a second admin to each of those rows this week. Start with the domain.
Step 5: Set up the vault, the renewal calendar, and the one-page departure checklist within the month.
The harder part is keeping it true. Someone has to open twenty admin panels and record what is actually there. Someone has to move years of shared passwords into a vault. Someone has to run the checklist on a leaver's last day, when the day is already full. Each of these competes with running the business, which is why the inventory, once written, goes out of date by the next hire.
That is the work kwapso does. We build the access register into the client's operational system, sprint by sprint: a second admin on every critical account, a shared vault with company-owned recovery, a renewal calendar that reminds a role rather than a person, and an offboarding checklist that runs whenever someone leaves. We stay after the build.
We become the digital department your business does not have.
Want to know which of your accounts would go dark with one departure? Take the free Operational Audit here.
Whether you do this yourself or hand it to us, we hope this guide turns a question nobody asks into a list you can finish in a day.
FAQ
What happens to company accounts when an employee leaves?
When an employee leaves, company accounts keep working until a routine event exposes the gap: a renewal, a password reset, a new hire who needs access. If the leaver was the only admin, recovery runs through a closed mailbox or a personal phone. A five-step last-day checklist prevents it: transfer admin rights, rotate shared passwords, move owned files, close the mailbox, update the access register.
How many admins should a small business have on each tool?
A small business should have at least two admins, assigned to roles rather than people, on every account it cannot work a day without. One admin is a lockout waiting to happen. More than three on a critical account means nobody owns it. Founder plus office manager is the right pair for most companies under 100 people.
Where should a small business store shared passwords?
Shared passwords belong in one credential vault that at least two people can reach, with the vault's recovery email on a company mailbox. The product matters less than the rule: shared credentials never live in a browser, a chat thread, a notebook, or one person's phone, because each of those leaves with the person.
What is an access inventory?
An access inventory is a one-page table with one row per critical business account and five columns: the tool, the admin, the second admin, where the credentials live, and what happens on departure. It is filled in from each tool's admin settings, not from memory, and shows before anyone leaves which accounts only one person can recover.
Who should own a company's domain name?
The company should own its domain name as a legal entity, with the registrar account under a company role mailbox and at least two people able to log in. A domain registered to an employee, a founder's personal email, or an agency means the business does not control its website or its email in practice.
What should an IT offboarding checklist include when an employee leaves?
An IT offboarding checklist has five items for the last day: transfer every admin right the leaver held, change every shared password they knew and store it in the vault, move documents owned by their user account to a company account, forward their mailbox to a role address and then close it, and confirm each row of the access register.
What is access concentration in a business?
Access concentration is when a critical system, account, or portal can be administered by exactly one person in the business, so that their absence, departure, or lost phone locks the company out of its own tools. It is the most common operational risk in companies under 100 people and the least examined, because it produces no symptoms until it fails.
.jpeg)
