Is your business at risk because critical functions or knowledge are vested in one person? What happens if this person wins the lottery and resigns, or worse still, hit by a bus? The bus test is a thought experiment for considering and exploring the consequences of losing a critical person. In some cases, a warning of impending change is available such as receiving a resignation letter. In situations such as personal injury or fatality, the changes are instantaneous, and businesses need to be resilient to such challenges.
In the case of small businesses, the death of one person can trigger the end of the company, and consequently, key-person insurance policies have become popular. Essentially the business takes out an insurance policy on key members of staff, pays the necessary premiums, and is the beneficiary in the event of death or injury, which prevents the key person from working.
Large businesses also have the option of taking out key-person insurance. However, the issue is that staff often become key persons over time. Undocumented activities and processes become ingrained into the daily routine, others become dependent on them, and it becomes business as usual without further consideration.
There are common signs which indicate a failed bus test:
- Unable to achieve something because someone has taken the day off. Make sure there are no dependencies on specific individuals.
- Requesting information from a department and being told ‘Joe is the expert, you will need to speak with him’. Knowledge critical to the day-to-day running of the business should always be shared between team members and thoroughly documented.
- Individuals within the business keeping crucial information to themselves and being evasive when asked, rather than openly sharing their knowledge with others. A misconception on the part of some staff that if they are the only person who knows something or able to do something specific within their working environment, that their employer must keep them or pay more for their work. In practice, the reverse is true; it is less risky to remove them than to be held over a barrel.
- Staff using a different approach, different tools, or additional software from everyone else to get the job done. Having a standard way of working and using specific software means that work is transferable between staff. One person choosing a different programming language from everyone else, for example, could make it impossible for other team members to make changes.
Avoiding scenarios that fail the bus test requires a different mindset:
- Adopt the notion that process is equal to, or more important than, the outcome
- Ensure that all actions within the business are documented and repeatable
- Remember that people follow processes, and processes deliver consistent results
- When you complete business recovery exercises, randomly remove people who have been ‘impacted’ by the scenario and see how the recovery progresses without them.
Robert is an information security professional with over 20 years of experience across a diverse range of organisations, both in the UK and internationally. Robert graduated in 1997 with an honours degree in software engineering for security and safety-critical systems. Robert is contactable directly through Telegram.