The Access Nobody Wrote Down: Why Your Business's Most Critical Records Live in Accounts You Don't Control
Photo: Santeri Viinamäki, CC BY-SA 4.0, via Wikimedia Commons
Here is an exercise that unsettles nearly every founder who tries it: write down, from memory, every account, credential, vendor relationship, and system your virtual assistant touches. Not the ones you know about — all of them.
Most people get through a dozen entries before they hit a wall. The scheduling tool your VA set up eighteen months ago. The shared Dropbox with three years of client deliverables. The GoDaddy account where your domain renews. The Stripe login. The contact in the VA's phone who handles your IT issues. The email template archive. The vendor who invoices through a portal only your assistant knows how to navigate.
This isn't an indictment of delegation. It's the natural result of it. Delegation works precisely because information flows to the person doing the work. But it produces a quiet, structural vulnerability that almost no small business plans for: the operational memory of your company is distributed across accounts you may not control and knowledge that exists in exactly one head.
The Emergency You Haven't Priced
Founders insure against fire, flood, and liability. Almost none insure against the sudden unavailability of the person who holds the operational keys. Yet the scenarios are mundane and common: a medical emergency, a family crisis, an abrupt resignation, a laptop that dies with a local password vault on it, or — the scenario nobody enjoys discussing — a relationship that ends badly.
When it happens, the costs compound quickly. Missed vendor payments trigger late fees and service interruptions. Client inquiries go unanswered during response windows that contracts may specify. Renewals lapse — and a lapsed domain, for a services business, is functionally a lapsed company. In the worst cases, founders discover they lack the legal standing or documentation to access accounts their assistant opened under personal credentials, turning a logistical headache into a potential dispute.
There is a compliance dimension as well. Businesses handling client data have obligations regarding access control and records retention. 'It lived in my contractor's personal Gmail' is not a defense that plays well in an audit, an insurance claim, or a breach notification.
What a Real Digital Succession Plan Looks Like
A proper plan is not a sticky note with passwords. It has four components.
1. A business-owned credential vault. Use a team password manager — 1Password Teams, Bitwarden, or Keeper — where every business credential lives under company ownership, not personal accounts. Your VA uses it daily; you hold the emergency recovery key. Nothing critical should be accessible only through an account you can't reach.
2. An access inventory. A living document listing every system, its purpose, who owns the underlying account, and the recovery path. Review it quarterly. If an item's recovery path is 'ask Maria,' that's a finding to fix, not a fact to accept.
3. A documented continuity file. Beyond credentials: vendor contacts and terms, recurring payment schedules, client communication norms, and the location of every essential document. Your VA should help build this — it's a natural extension of process documentation, and involving them signals trust rather than suspicion.
4. A written emergency protocol. Who is contacted, in what order, with what authority, if your VA is suddenly unavailable? If you have a second contractor, an attorney, or a trusted peer with access to the vault's recovery key, name them in writing.
Addressing the Trust Objection
Some founders resist this, worried it signals distrust. Framing matters. The plan protects your VA as much as it protects you — it means their responsibilities continue seamlessly during their vacation, their family emergency, or their eventual departure, without a frantic scramble that burns goodwill. Strong assistants, the kind you want to retain, tend to be relieved by it. Operating as a single point of failure is a burden, not a perk.
Build It This Month
The barrier to entry is a weekend, not a project plan. Week one: deploy the password manager and migrate credentials. Week two: build the access inventory. Week three: draft the continuity file with your VA's help. Week four: write the emergency protocol and schedule the first quarterly review.
Your inbox is a business record. So is everything behind it. The time to write down where your business actually lives is before the day you need to know.
