The single point of failure nobody plans for
In many small businesses the owner set up everything personally. The Microsoft 365 admin account is in their name, the domain is registered to their email, the bank portal only accepts their approval, and the authenticator codes for all of it go to their mobile. That works until they are on a long-haul flight, in hospital, or simply unreachable on a remote holiday when the website goes down or a supplier needs paying.
The risk is not only inconvenience. If the owner is seriously ill or dies, a business can spend weeks proving to providers that it has the right to regain control of its own systems, while staff can't reset passwords or change payroll details. Some providers have formal recovery processes, but they are slow by design.
Name a second administrator
The first fix is simple: give at least one other trusted person their own admin access to the critical systems. That might be a business partner, the general manager, the office manager or your IT provider, depending on the system. They should have a separate named account with its own password and MFA, not a copy of the owner's login.
For Microsoft 365 or Google Workspace, that means a second global admin. For the bank, ask about adding a second authorised user or approver; most NZ business banking platforms support multiple users with different permission levels. For Xero, MYOB and similar systems, add a second person with adviser or admin rights. For the domain registrar, add a technical or billing contact who can act if the main contact is unreachable.
The emergency account
Alongside named admins, keep one emergency administrator account for Microsoft 365 or Google Workspace that nobody uses day to day. Give it a long random password and a hardware security key or MFA method that does not depend on any single staff member's phone. Seal the details, for example in a password manager vault with restricted access or a sealed envelope in a safe, and record who may open it and when.
Set an alert so that any sign-in to the emergency account notifies the owner and the IT provider. That way it is available when genuinely needed, but any use of it is visible. Test it once or twice a year to confirm it still works, then reseal and change the password if it was exposed.
Spread the multi-factor methods
Multi-factor authentication is essential, but it creates its own single point of failure if every code goes to one phone. Make sure each admin has their own MFA method registered to their own device, and that important accounts have more than one method where the service allows it, such as an authenticator app plus a hardware key kept somewhere safe.
Watch for accounts that use text message codes to the owner's mobile number. If that phone is lost, or the number is ported, recovery gets hard. Where you can, switch those to an authenticator app or a key, and record which accounts still rely on the owner's number so someone knows to deal with them.
Use a password manager with emergency access
A business password manager lets you share credentials for systems that only allow one login, and most offer some form of emergency or delegated access. The owner can nominate a trusted person who can request access to their vault, with a waiting period during which the owner can refuse. If the owner is unreachable for the whole waiting period, access is granted. That arrangement is far safer than a spreadsheet of passwords on the owner's laptop or a list in a desk drawer. It also means that when the owner returns, they can see exactly what was accessed and change anything sensitive.
Write it down and rehearse it
Record who the admins are for each critical system, where the emergency account details live, and the steps a nominated person should take if the owner is out of reach. Keep that page with your business continuity notes and your will or shareholder arrangements, since your lawyer or accountant may need to know it exists.
Before the owner's next extended break, run a quick test: can the second admin reset a staff password, approve a bank payment, renew the domain and add a user to the accounting system without calling the owner? Anything that fails the test needs fixing while there is still time. A business that passes it has removed one of the most common and least discussed risks small firms carry.
In short
- Give a second trusted person their own admin access to critical systems.
- Keep a sealed emergency admin account with sign-in alerts.
- Don't send every MFA code to the owner's phone.
- Use password manager emergency access instead of a password list.
- Test the arrangement before the owner goes away.