What your team cannot do while one person is on leave

What is a capability map, and why not a task list?

A task list asks what one person does. A capability map asks what the team cannot do without them, which is a different and smaller set. Much of what a person does could be taken over by anyone with an afternoon's notice, and they are no gap at all. The gaps are the tasks that cannot be taken over, and some of them are not recognized as her tasks. They are things the team has never done without her, and so has never found out it could not.

Every gap we meet has one of four causes. Exhibit 1 sets them out. Access: a login, a permission, a key. Knowledge: how an exception is handled, where a file lives, what the unwritten rule is. Authority: a decision only she may take, whatever the policy says. Relationship: an outside party, such as a supplier, a landlord or a regulator's case officer, who will deal with her and with no one else. A single task often has more than one cause, which is why sorting matters. The knowledge may be written down, and still be useless until the access is shared.

How do you find the gaps by asking?

By asking four sets of people and one set of records, because each sees a different part. The team knows what they have waited for before. The person knows what they have been quietly doing. The people outside the team, customers and suppliers, know whom they call and whom they would not know how to reach. The system's own account list shows which logins are held by one name. None of them has the whole picture, and the differences between their answers are the useful part.

Ask in a way that makes it easy to answer. A question such as what would you have to chase her for puts the answer in the speaker's own experience and invites a specific reply. A question such as what are the risks invites a general one. And tell the person what the list is for before you gather it. People who think they are being inventoried for replacement give shorter and more careful answers than people who know they are being asked to say what the organization has been leaning on.

The list of accounts deserves its own look. NIST Special Publication 800-53, in control AC-2 on account management, expects an organization to specify, for each account, its authorized users and its group and role membership, and to change the authenticators of shared or group accounts when individuals leave the group. A shared password is therefore a second dependency, because it must be changed whenever the group changes, and it records no one's actual access. A named account in a defined role is the version that survives an absence.

What is the method, step by step?

1. 01

   Choose the person and say why

   Pick someone whose absence would worry you, and tell them the purpose. The exercise is about the organization's reliance on them, not about their performance. You leave this step with a person who agrees to take part.

2. 02

   Write two lists apart

   Ask the team to write what would stop or slow in this person's absence, without consulting them. Ask the person to write their own list, without seeing the team's. A manager collects both. You leave with two lists.

3. 03

   Compare the lists

   An item on one list and not the other is the finding. Either the person is holding something the team has not noticed, or the team believes a dependency exists that the person does not. You leave with a short list of differences, each with a question.

4. 04

   Sort each item by cause

   For each item ask what, exactly, would stop it: a credential, an unwritten rule, a decision only they may take, or an outside party who deals with them alone. Note when an item has more than one cause. You leave with the capability map.

5. 05

   Close one gap in each cause

   The owner of the team chooses one item per cause and names who will close it, with a date. Closing means the second person has done the work without asking, as Exhibit 2 describes. You leave with four named actions and a date to look again.

What does a filled-in map look like?

Take the head of finance at a hospitality group, whose leave is planned for next quarter. The team's list is short: month-end close, and payments. The head's own list is longer. It adds the release of the payroll file, which only her login can authorize, and the quiet rule that a particular owner's invoices are paid before the date on them. It adds the weekly call with the bank's relationship manager, who has never spoken to anyone else on the team. It also adds approval of changes to a supplier's bank details, which policy says any director may give and which, in fact, nobody gives but her.

Sorted, the picture is plain. Payroll release is access. The early payment rule is knowledge. The bank call is a relationship. The bank detail approval is authority, and it comes first, because a delay there is a delay in paying someone. None of these is hard to fix. All of them were invisible, because the person had always been there. That is what the comparison of lists shows: the dependencies the team did not know it had.

How do you know a gap is closed?

By watching it done, not by finding a document. Exhibit 2 shows the stages. A gap that exists only in one person's head sits at the bottom. The first move, writing it down, is the step at which effort usually stops, because a document looks like cover and is never tried. A second person then needs the access, set up through the system's own controls. After that the second person does the work while the first watches, and the gap is closed when the second does it, and decides, without asking.

The idea that authority and records are named in advance is not new. NIST Special Publication 800-34 Revision 1, a contingency planning guide, lists among the standard elements of a continuity of operations plan an order of succession, a delegation of authority and the management of vital records. A written delegation with a stated limit and a route for escalation is the ordinary way of closing an authority gap, and the guide treats it as something an organization prepares before it is needed.

What closes each kind of gap?

Access is closed with a second named holder, given the permission through the system and not by passing on a password. It is the quickest remedy and the one that is usually left until the day it is needed. Knowledge is closed by watching the work and writing what the watcher saw, because a person asked for a manual describes the rules and omits the exceptions. Authority is closed by delegation: a named person, a limit on what they may decide and a route for what exceeds it.

Relationship is the slow one. The outside party has to come to trust a second person, and that cannot be arranged by memo. The remedy is a joint call or visit, made while the first person is available, in which the other side hears the first person say that the second now acts for them. Start there, since it takes longest.

Choose one item in each cause and close it this month. A visible gain in each is worth more than a finished answer to one.