Governance · Technology due diligence · 05
Key-person and vendor dependency review
A key-person and vendor dependency review identifies the individuals, suppliers, platforms and licenses without which the organization’s technology would stop working or could not be maintained, and assesses how exposed the business is to each. It is needed in diligence, when a buyer wants to know what walks out the door or expires at closing, in insurance and lending reviews, and in the organization’s own continuity planning when it suspects that one engineer, one vendor or one contract holds everything together. The review produces a dependency map of people, vendors, platforms and licenses against the services they support, a rating of each by consequence and substitutability, the mitigations available, and the plan to reduce the dependencies that matter most.
Scope
What the review covers.
- Key-person dependencies: knowledge, access, credentials, relationships
- Vendor and platform dependencies, including concentration risk
- Licenses, contracts and renewals that could lapse or change
- Substitutability and time to replace for each dependency
- Mitigations: documentation, cross-training, escrow, contract terms, alternatives
- Reduction plan for the most consequential dependencies
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Dependency map | People, vendors, platforms, licenses against services |
| Risk rating | Consequence and substitutability per dependency |
| Mitigation options | With cost and effort |
| Reduction plan | Sequenced actions with owners |
Prerequisites
What we need from you.
- Access to technical leadership and to vendor, license and HR records
- The service and system inventory
- The purpose of the review: diligence, lending, insurance or continuity
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Is this about replacing people?
No. It is about not being hostage to the absence of any one person. Documentation and cross-training are the usual answers.
Do you review source code escrow?
Where critical software comes from a small vendor, escrow and its terms are in scope.
How does this fit into due diligence?
It is one section of buy-side diligence and often the one that changes deal terms. See Buy-side technology and security diligence.