# Key Person Risk Assessment — Acme Inc

> Auto-generated by Codepliant on 2026-03-19.
> Identifies single points of failure in compliance knowledge and provides cross-training recommendations.
> Review with leadership and HR to validate role assignments and implement mitigations.
> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19

## Executive Summary

| Metric | Value |
|--------|-------|
| Key Compliance Roles | **7** |
| Critical Roles | **3** |
| Unassigned / Needs Assignment | **5** |
| Single Points of Failure | **6** |

> **Action Required:** 5 role(s) need immediate assignment to avoid compliance gaps.

## Key Person Risk Matrix

| Role | Risk Level | SPOF | Assigned | Backup |
|------|-----------|------|----------|--------|
| Data Protection Officer (DPO) | 🔴 Critical | Yes | Yes | No |
| Security Lead / CISO | 🔴 Critical | Yes | No | No |
| Incident Response Lead | 🔴 Critical | Yes | No | No |
| Privacy Champion / Consent Manager | 🟠 High | Yes | No | No |
| AI Governance Lead | 🟠 High | Yes | No | No |
| Vendor Management Lead | 🟠 High | Yes | No | No |
| Compliance Training Coordinator | 🟡 Medium | No | No | No |

## Role Details

### Data Protection Officer (DPO) 🔴

**Description:** Responsible for GDPR compliance oversight, DSAR handling, DPA review, supervisory authority liaison, and privacy impact assessments.

**Risk Level:** Critical  
**Single Point of Failure:** Yes  
**Current Assignment:** Jane Mueller (dpo@acme-saas.com)  
**Backup Assignment:** [Assign backup DPO]

**Cross-Training Recommendations:**

- [ ] Train at least one backup team member on GDPR Articles 12-23 (data subject rights)
- [ ] Document all supervisory authority contacts and ongoing correspondence
- [ ] Create runbook for DSAR handling that any team member can execute
- [ ] Share DPA templates and vendor review procedures with legal team
- [ ] Schedule quarterly knowledge-sharing sessions on regulatory updates

**Regulatory Implications if Unavailable:**

- GDPR Art. 37-39: DPO must be accessible to data subjects and supervisory authorities
- If DPO is unavailable, DSAR response deadlines (30 days) may be missed
- Supervisory authority communications cannot be delayed — fines up to 4% of global revenue

### Security Lead / CISO 🔴

**Description:** Owns security policy, vulnerability management, penetration testing oversight, and security incident triage.

**Risk Level:** Critical  
**Single Point of Failure:** Yes  
**Current Assignment:** [Not formally assigned]  
**Backup Assignment:** [Assign backup security lead]

**Cross-Training Recommendations:**

- [ ] Document all security tool access credentials in a shared vault
- [ ] Train backup on vulnerability scanning and patch management procedures
- [ ] Create incident classification guide that any engineer can use for initial triage
- [ ] Share penetration test scope and vendor contacts with at least two team members
- [ ] Maintain a security architecture document accessible to the engineering team

**Regulatory Implications if Unavailable:**

- SOC 2 Trust Service Criteria require documented security leadership
- ISO 27001 A.5.1 requires management commitment through security policy ownership
- Security incident response cannot wait for a single person to become available

### Incident Response Lead 🔴

**Description:** First responder for data breaches and security incidents. Coordinates containment, notification, and remediation.

**Risk Level:** Critical  
**Single Point of Failure:** Yes  
**Current Assignment:** [Assign incident response lead]  
**Backup Assignment:** [Assign backup — must be available 24/7]

**Cross-Training Recommendations:**

- [ ] Conduct quarterly tabletop exercises with rotating team members as lead
- [ ] Document step-by-step breach notification procedures (supervisory authority + data subjects)
- [ ] Maintain up-to-date contact list for all sub-processors' security teams
- [ ] Train at least three team members on forensic evidence preservation
- [ ] Create pre-approved communication templates that any responder can send

**Regulatory Implications if Unavailable:**

- Breach notification timelines vary by jurisdiction
- Delayed incident response increases breach severity and regulatory exposure
- Multiple jurisdictions may require simultaneous notifications — single person cannot manage alone

### Privacy Champion / Consent Manager 🟠

**Description:** Manages consent management platform (CMP), cookie compliance, and tracking consent workflows.

**Risk Level:** High  
**Single Point of Failure:** Yes  
**Current Assignment:** [Assign privacy champion]  
**Backup Assignment:** [Assign backup]

**Cross-Training Recommendations:**

- [ ] Document CMP configuration and how to update cookie categories
- [ ] Train marketing team on consent requirements before launching new campaigns
- [ ] Create checklist for adding new analytics or advertising services
- [ ] Share CMP admin access with at least two team members

**Regulatory Implications if Unavailable:**

- ePrivacy Directive: Invalid consent can result in immediate enforcement action
- GDPR Art. 7: Consent must be demonstrable — records must be maintained

### AI Governance Lead 🟠

**Description:** Oversees AI system classification, risk assessment, transparency obligations, and EU AI Act compliance.

**Risk Level:** High  
**Single Point of Failure:** Yes  
**Current Assignment:** [Assign AI governance lead]  
**Backup Assignment:** [Assign backup]

**Cross-Training Recommendations:**

- [ ] Document AI system inventory with risk classifications
- [ ] Train engineering team on AI transparency requirements (Art. 50)
- [ ] Create checklist for evaluating new AI service integrations
- [ ] Share AI model documentation procedures with ML and product teams
- [ ] Conduct workshops on AI bias detection and fairness testing

**Regulatory Implications if Unavailable:**

- EU AI Act: High-risk AI systems require ongoing conformity assessment
- Colorado AI Act: Deployers must complete impact assessments
- AI governance decisions affect product roadmap — delays are costly

### Vendor Management Lead 🟠

**Description:** Manages relationships with 8 detected third-party services. Owns DPA negotiations, vendor risk assessments, and sub-processor monitoring.

**Risk Level:** High  
**Single Point of Failure:** Yes  
**Current Assignment:** [Assign vendor management lead]  
**Backup Assignment:** [Assign backup]

**Cross-Training Recommendations:**

- [ ] Maintain a shared vendor contact database (see VENDOR_CONTACTS.md)
- [ ] Document DPA status and renewal dates for all vendors
- [ ] Train procurement team on security assessment requirements before onboarding new vendors
- [ ] Create vendor exit plan templates that any team member can execute

**Regulatory Implications if Unavailable:**

- GDPR Art. 28: Controller must ensure processor compliance
- Vendor incidents become your incidents — you need someone who can act immediately

### Compliance Training Coordinator 🟡

**Description:** Schedules and tracks mandatory compliance training for all employees. Maintains training records for audit evidence.

**Risk Level:** Medium  
**Single Point of Failure:** No  
**Current Assignment:** [Assign training coordinator]  
**Backup Assignment:** [Assign backup]

**Cross-Training Recommendations:**

- [ ] Use a shared calendar with training schedule visible to all
- [ ] Automate training completion reminders
- [ ] Maintain training records in a shared, auditable system (see TRAINING_RECORD.md)
- [ ] Document the training curriculum so anyone can deliver sessions

**Regulatory Implications if Unavailable:**

- GDPR Art. 39(1)(b): DPO must assign awareness-raising and training
- SOC 2: Security awareness training must be documented for audits

## Bus Factor Analysis

The "bus factor" measures how many team members must be unavailable before a compliance function stops working.

| Function | Current Bus Factor | Target Bus Factor | Gap |
|----------|-------------------|-------------------|-----|
| DSAR Handling | 1 | 3 | Train 2 additional team members |
| Breach Notification | 1 | 3 | Rotate incident response lead role quarterly |
| Vendor DPA Management | 1 | 2 | Share vendor contacts and DPA templates |
| Privacy Policy Updates | 1 | 2 | Document update procedure |
| AI Compliance | 1 | 2 | Cross-train product and engineering leads |
| PCI DSS Compliance | 1 | 2 | Train backup on PCI requirements |

## 90-Day Action Plan

### Month 1: Assign and Document

- [ ] Assign all unassigned compliance roles
- [ ] Assign backup for every critical role
- [ ] Document all role responsibilities in an accessible location
- [ ] Create shared credential vault for compliance tools

### Month 2: Cross-Train

- [ ] Conduct first round of cross-training sessions
- [ ] Run tabletop exercise with backup responders
- [ ] Create runbooks for all critical compliance procedures
- [ ] Verify backup team members can access all required tools

### Month 3: Test and Validate

- [ ] Simulate DPO unavailability — can backup handle DSAR?
- [ ] Simulate security lead unavailability — can backup triage incident?
- [ ] Review and update all cross-training materials
- [ ] Schedule recurring cross-training (quarterly recommended)

---

*This assessment is generated from automated code analysis and regulatory requirements. Actual key person risks depend on your organization's structure and team composition. Review with HR and leadership to validate.*
