The One-Page Handover: Who Runs the Office When the Wi-Fi Grown-Up Is in Benidorm

There is a particular kind of quiet in a small office when the person who knows everything is away. The Wi-Fi still works, mostly. The printer is doing its usual thing. Nobody has needed the domain registrar yet. Then someone tries to add a new starter to Microsoft 365, or the card machine drops offline, or a client asks for a small change to the website, and the room realises it has no idea where the keys are kept.

This is key-person risk, but it rarely feels dramatic. It feels like a colleague called Dave being in Benidorm for a fortnight with his phone on aeroplane mode. The business does not collapse. It just spends two weeks waiting, apologising and paying for workarounds. December is a good month to look at this honestly, because holiday cover exposes the gaps while there is still time to do something about them.

The problem is not passwords. It is the map.

Most small firms have some passwords written down somewhere. That is not the same as having a handover. The useful question is not “do we have the Wi-Fi password?” but “if the usual person is unreachable, can a sensible deputy find the broadband account number, the domain renewal date, the Microsoft 365 admin centre, the backup console and the phone number for the IT supplier without ringing anyone?”

That is a documentation problem, not a technical one. And it is fixable in about an hour if you keep the scope tight.

Run a 60-minute key-person audit

Book the time with the person who actually holds the keys — not the person with the most senior job title. Then work through five areas.

1. Access and admin accounts. List the places where an admin login exists: Microsoft 365 or Google Workspace, the domain registrar, website hosting, the broadband router, the Wi-Fi controller, the backup platform, the accounts package, the card payment portal and any industry-specific system. For each one, note who can get in, whether there is a shared admin account, and where the recovery method lives.

2. Recovery codes and second factors. A password is no use if the only authenticator app is on one person’s phone. Note where backup codes are stored, whether there is a spare security key, and who can approve a password reset. Do not collect the codes in a shared spreadsheet and call it done. Decide where they are held securely and who can reach them in an emergency.

3. Vendor contacts. Your ISP, IT support provider, web developer, phone system supplier, backup provider and anyone who looks after the till or card terminals. Include account numbers and the support phone number, not just a named account manager who left in 2023.

4. Domain and renewal records. For a UK business, this usually means the .co.uk registrar and any associated services. Note the renewal date, the billing contact and who can approve a transfer. Domain problems are rare until they are urgent, and then they are very urgent indeed.

5. The unwritten stuff. How does the office Wi-Fi guest network get changed? Which cupboard has the spare router? What is the name of the electrician who knows the comms cabinet? This is the knowledge that never makes it into a ticket.

Keep the output short. If the audit turns into a 20-page manual, nobody will read it in a crisis.

Turn it into a single “if I’m not here” sheet

The aim is one page. Not a policy document, not a binder, not a wiki that needs a login nobody has. One page that a deputy can pick up cold.

It should answer four questions:

• Who do I call first, and for what?
• Where are the admin logins and recovery methods held?
• Which services renew soon, and who approves spending?
• What should I not touch without advice?

The last point matters. A handover sheet is there to keep the lights on, not to encourage a deputy to rebuild the domain controller over Christmas. Make the escalation route obvious. If something is outside the sheet, the answer should be “call this person or supplier”, not “have a go”.

Store the sheet somewhere the deputy can actually reach when the usual person is away — not in the usual person’s OneDrive. Print a copy for the office safe if that is how your business works. Keep the sensitive access details in a proper password manager or sealed envelope held by a director, and keep the one-pager as the map to that vault.

Test it cold, with no phone-a-friend

This is the step most businesses skip. Once the sheet is written, ask a deputy to use it for a realistic but harmless task. Can they find the broadband account number? Can they log into the backup console using the documented procedure? Do they know which supplier to ring if the card terminal goes down? Can they explain what they would do if the domain renewal email arrived while the usual person was away?

The deputy is not allowed to text the usual person. That is the whole point. If they get stuck, write down where they got stuck and fix that line. A handover sheet that only works with a phone call is not a handover sheet; it is a phone tree with extra steps.

Run this test before the December break, not during it. It takes half an hour and it is far less awkward than the January conversation that starts with “so, nobody knew the domain password”.

Make it a small habit, not a big project

You do not need a perfect business continuity plan to reduce key-person risk. You need a named deputy, a one-page map, a secure place for the actual secrets, and a cold test that proves the map works. Review it when someone leaves, when a supplier changes or when a renewal notice lands. Put a date in the diary for the next holiday handover.

Then let the Wi-Fi grown-up go to Benidorm. The office should be able to cope without them — and, more importantly, without guessing.