Every business carries a set of costs that read as zero on the books right up until the moment they read as catastrophic. Key-person risk is the clearest example: the veteran employee who leaves and takes a decade of undocumented knowledge with them. Add the breach, the regulatory penalty, and the auto-renewing contract nobody has reviewed since 2019, and the pattern becomes clear. These are contingent costs, off the books today, potentially existential tomorrow.
Because they have not happened yet, they are the easiest costs to ignore and the most dangerous to leave unpriced. A CFO’s job is to drag them into the light and give them an expected value, so the business can decide, deliberately, how much risk it is actually carrying.
The Exposures Nobody Has Priced
Key-person risk and other risk costs are invisible because they are probabilistic rather than transactional. Accounting records what happened. It has no natural home for what might happen.
Institutional knowledge loss tops the list. A veteran walks out and there is zero balance sheet entry for the hole they leave behind. Cybersecurity exposure is a contingent cost that stays off the books until a breach makes it the only line that matters. Regulatory and compliance drift carries no cost at all until the penalty lands. Contract blind spots, including auto-renewals and unfavorable terms, quietly overpay without anyone monitoring them. Vendor over-reliance and single-source risk create supply fragility with no reserve set against it. Undocumented processes create audit and continuity risk that compounds silently over time.
Pricing Key-Person Risk
Key-person risk gets priced the way an insurer prices any contingent exposure: probability times impact.
Suppose there is a 25 percent chance in a given year that a critical employee leaves, and replacing them plus the lost knowledge and ramp time costs about $120,000. That works out to 25 percent times $120,000, or $30,000 in expected annual cost. That $30,000 is the amount worth spending on documentation, cross-training, or retention to neutralize the risk.
Run the same logic on a 10 percent breach probability against a $150,000 impact, and cybersecurity exposure comes to $15,000 a year in expected cost. Add unreviewed contracts quietly overpaying, and the risk bucket becomes a real, defensible number instead of a vague worry that keeps getting deferred.
What a CFO Does About Key-Person Risk
Expected-value pricing does two things. It shows which risks are worth mitigating now, since anything where a cheap fix costs less than the expected loss is an obvious yes. And it converts a founder’s low-grade anxiety into a rational budget decision. Document the key processes becomes spend $10,000 to retire a $30,000 annual exposure.
This is also, quietly, an enterprise value story. Buyers and lenders price key-person risk relentlessly. A business with documented processes, diversified vendors, and reviewed contracts commands a premium and closes faster. Retiring this exposure does not just protect the business from a bad day, it makes the business worth more on a good one.
Accrual accounting captures transactions, not friction, opportunity cost, or risk. The businesses that win are the ones that build a shadow P&L for everything the real one ignores, and then manage it.
