What SPOFs are and why you cannot see them
A single point of failure is the only element that a critical flow passes through: payments, shipping, data, decisions. While the element works, it is invisible, and the system looks reliable. A failure turns it into the bottleneck of the whole company. Then it turns out that there is no backup, no replacement, and the instructions exist only in one person’s head.
Points of failure stay hidden for two reasons: they have grown into the routine (“that is how it has always been”), and nobody is tasked with finding them. Searching for SPOFs gives the fastest return of any work in business continuity.
Where to look: 6 typical places
- IT: a single server/channel/data centre, a database with no replica, an in-house system that only one developer understands, a single admin with full rights.
- People: an irreplaceable chief accountant, the only person who holds the relationship with a key customer, a process engineer who keeps “everything in their head”.
- Suppliers: the sole supplier of a critical raw material or service, one logistics route, one bank for all payments.
- Sites: one production facility, one warehouse, an office without which the call centre cannot work.
- Data and documents: a key file on a local drive, licences and access rights registered to one employee.
- Customers and channels: one customer bringing half the revenue, one marketplace as the only sales channel.
A one-week search method
Take 5–7 critical processes (from the critical process register). For each one, walk through the chain asking: “What happens if this element disappears for a week? Is there a replacement, and what does the downtime cost?” Everything where the answer is “no replacement” goes on the SPOF list with two attributes: the cost of one day of downtime (how to calculate it) and the cost of the fix. Sort by the ratio of the two and you have a ready work plan: the gaps you can close almost for free rise to the top.
For a single site, this search is part of the drone strike readiness check; for the IT landscape, it is part of the ransomware readiness check.
Fixing them: diversification, redundancy, documentation
Three strategies, in order of rising cost. Documentation is almost free: instructions, knowledge sharing, handover of access rights. Diversification means a second supplier, a second bank, a second sales channel. It is cheaper than it seems if you start before a crisis. Redundancy means a second site, a database replica, a backup channel. It is the only strategy that needs a budget, and this is where it is important not to overdo it: redundancy should follow the cost of downtime, and fear is not a measure. A significant share of SPOFs can be removed by organisational measures within existing salaries. This is the “smart spending” in which resilience grows with no new costs.
People: a special case
Human SPOFs are the most common and the most delicate: backing up a person looks like distrust. Approaches that work: pair work on critical operations, mandatory holidays (the best test of irreplaceability), and documentation built into the role instead of a one-off chore. A detailed review is in the article on the risk of losing a key employee.
Frequently asked questions
A single point of failure, or SPOF, is an element whose breakdown stops the whole process or business because there is nothing to replace it with: the only server, the only supplier, the only employee who knows the system. Two other Russian variants of the term, literally “point of single failure” and “single point of collapse”, mean the same thing.
Go through each critical process and at every step ask: what happens if this element is unavailable for a week, and is there a replacement for it? The six typical places and the one-week search method are covered above. The points you find go into the continuity risk register, with a plan to remove them or a backup.
How is a SPOF different from an ordinary risk? It is a risk with a binary profile. An ordinary risk means things “may get worse”. A SPOF means things “stop completely”. That is why points of failure deserve a separate flag in the risk register.
How many SPOFs are normal? Zero is neither achievable nor necessary. The goal is to know all your points of failure and make a conscious decision on each one: remove it, back it up, or accept it with your eyes open.
How do you keep the list up to date? Review it at every change: a new product, a move, a change of supplier. We make this part of the annual BIA cycle, and it shows on the dashboard in the weak spots block.
Check your recovery numbers
The assessment shows where the recovery times the business needs do not match what the technology can deliver. After that, either your specialist calculates these numbers, or we do.