Only One Person Knows How It Works
You automated the busywork, then handed the whole machine to one employee's head and one personal login. That's not resilience. It's a hostage situation.
Here is a scenario I have watched play out more than once. A small business automates something that genuinely needed automating. Follow-up texts go out on their own. Quote requests land in the right inbox, tagged and sorted. Review requests fire the day after a job closes. It works. It saves real hours. And then one Tuesday the person who built it is out with the flu, something breaks, and the company discovers it has no idea how its own business runs.
That is the part nobody prices in. Not whether the automation works. Whether anyone besides one person can keep it working.
Let me show you what "it's automated" usually looks like under the hood at a five-person shop. There is a chain of tools nobody ever drew a diagram of. A form feeds a spreadsheet, which trips a thing in Zapier or Make, which calls an API, which texts the customer. The API keys live in somebody's notes app. The two-factor codes go to that same person's personal phone. Half of it is wired to a personal Gmail, because that was the account logged in the day it got built. There is no documentation, because the person who built it already knows how it works, and writing it down is the task that always loses to the next fire.
This is not negligence. It's physics. A five-person shop doesn't have an IT department. It has one person comfortable enough with technology to wire two tools together, and the second they do, they become the single point of failure for the whole operation. Nobody decided that. It just accretes. The owner is thrilled it works and never asks the boring question, which is the only one that matters: what happens when this person is gone.
You didn't buy automation. You hired one irreplaceable employee and gave them no backup.
There are really two failures hiding in here, and they're different sizes. One is knowledge: nobody else understands what the system does or why. That one is annoying but survivable, because a sharp person can usually reverse-engineer it given a day and a pot of coffee. The other is access: the logins, the keys, the 2FA, all tied to one human who is no longer in the building. That one is fatal. You cannot reverse-engineer your way into an account you don't control. When someone tells you "it's automated," they are usually describing a thing that will fail on both at once.
And "gone" doesn't have to be dramatic. It's a vacation. A sick week. A better offer. A falling-out. I have seen a business unable to stop its own appointment reminders, because the only account that could log into the tool belonged to a former employee's personal email, and that employee had stopped returning calls. The messages kept going out to customers who had already canceled. The company looked broken to the exact people it was trying to win, and the one person holding the keys had no reason left to pick up the phone.
Here is why I raise it as the guy who builds these systems. When a vendor sells you automation, this is explicitly not their problem. Their job ends when it works in the demo. The handoff, the access, the "what if the person who set this up walks," all of that lives on your side of the fence, and they have zero incentive to make you think about it before you sign. A good contractor brings it up for the same reason a good roofer points at the flashing you didn't ask about. It's the unglamorous part that bites you a year later, long after everyone forgot who built what.
So here is what I do, and what you should demand from anyone who touches your systems. Every account gets created under a company email the owner controls, never a personal one. Two-factor goes to a company phone or an owner-held authenticator, not an employee's pocket. Credentials live in one shared password manager the owner can open, not a notes app and not a sticky note on a monitor. And there's a one-page document, in plain English, that says what runs, where it runs, and how to switch it off. Not a technical manual. One page.
That last item is the real test, and it's brutally clarifying. Ask it out loud about every automation you already run. If the person who set this up vanished tomorrow, who can turn it off? If the honest answer is nobody, you don't own an automation. You own a liability with a green light on it, and the light stays green right up until the week it doesn't.
None of this costs money. It's an afternoon of boring hygiene that almost nobody does, because it isn't the fun part and no vendor gets paid to make you do it. But it's the whole difference between a tool that serves the business and a tool that holds it hostage. Automate everything you can. Just make sure the business owns the machine, and not the other way around.