The Bus Factor: a governance risk you’re probably ignoring

Boards talk a lot about financial risk (running out of money) and reputational risk (ending up in the paper for the wrong reasons). The “bus factor” gets far less attention.

It’s a blunt hypothetical: if your Secretary were hit by a bus tomorrow, would the organisation carry on? We don’t mean emotionally. We mean: does anyone else know the password to the bank account? Does anyone else know where the grant acquittal documents are saved? Or is that history locked in one person’s head, or worse, their personal laptop?

Governance isn’t just reading the Treasurer’s report. It’s building a system that survives the people who built it. If your organisation relies on “Susan just knowing how to do it”, that’s a risk to the organisation and an unfair load on Susan. It’s not about mistrusting her. It’s about respecting her work enough to make sure it lasts.

Your bus factor is the number of people who could leave before things stall

The bus factor is a simple idea borrowed from project teams. Count how many people could suddenly become unavailable before a critical job stops getting done. If the answer for any job is one, you have a single point of failure. Sick leave, a move interstate, a family emergency or plain burnout will expose it just as well as a bus.

Small organisations carry this risk more than large ones, because the same few people do the banking, the filing, the grants, the membership list and the bookings. It usually isn’t anybody’s fault. It’s what happens when volunteers and small teams get things done by being quietly reliable for years.

A 30-minute way to find yours

You don’t need a risk consultant for the first pass. Put the board, committee or leadership team in a room with a whiteboard or a shared document, and list the jobs the organisation can’t stop doing. For most groups the list looks something like this:

Paying bills, wages and super, and reconciling the accounts
Lodging statutory returns and keeping registered details current (for example with ASIC, the ACNC or your state regulator, depending on how you’re set up)
Acquitting grants and keeping the paperwork funders ask for
Running the membership list, mailing list and website or social accounts
Renewing insurance, licences and registrations
Booking venues, rostering volunteers or staff and keeping the keys
Looking after the logins, passwords and bank signatories

Next to each job, write two names: who does it now, and who could do it next week if the first person couldn’t. If the second column is blank, or says “we’d work it out”, that’s a bus factor of one. Mark it red. Most groups find a handful of reds in the first half hour, and that’s fine. The point is to see them.

Fix the reds in this order

Access first. Make sure at least two people can get into the bank, the accounting software, the email and website accounts, and the cloud drive. Use a proper password manager or the organisation’s own accounts, not one person’s personal login. Check that the bank signatories are current and that the organisation, not an individual, owns its domain name and social pages.
Write down the how. For each red job, ask the person who does it to write a one-page “how this works”: where the files are, the steps, the due dates, who to call. Rough is fine. Keep these in one shared folder that the whole committee can open.
Cross-train. Ask the backup person to do the job once, with the original person watching, before it’s needed. A checklist that has never been used usually has a missing step.
Put the dates in a shared calendar. Annual returns, insurance renewals, grant reports and the AGM shouldn’t live in someone’s memory. Set reminders for more than one person.
Review it once a year. Add “bus factor check” to the agenda for the first meeting after the AGM, when roles change.

Do it without making people feel replaceable

Done badly, this exercise lands as “we don’t trust you” or “we’re getting ready to replace you”. Say up front that the aim is the opposite: nobody should carry a job alone, and nobody should be unable to take a holiday or step back without the whole place wobbling. Ask the people carrying the load what they would want written down. They usually have a clear list, and often feel relieved that someone asked.

When it’s worth getting help

You can do this yourselves. If you’d rather not, or the list is long and the board isn’t sure where to start, this is the kind of job we do under governance and compliance support: sorting out who holds what, getting the key documents into one place, and writing the procedures in plain English so the next person can pick them up. If you want a quick view of where your organisation stands first, the Plain Sense Check-Up is built for that.

Next step

At your next meeting, run the 30-minute exercise and agree who will fix the first red item by when. Or book a free 30-minute call.

All notes · Related service: Governance & compliance · Book a call