Small organisations often have very capable technology suppliers. A family office may work with the same provider for years because the arrangement is reliable, responsive and personal. There is no reason to distrust that relationship simply because it has lasted.
But there is a difference between trusting a provider and being unable to operate without it.
That difference becomes visible when somebody asks a deceptively ordinary question: if the provider were unavailable tomorrow, who could get into the systems, recover the records and keep the important work moving?
An assured answer cannot depend on the provider being there to explain it.
The problem is usually not the contract
Contracts may describe notice periods, service levels and the return of information. They rarely tell the whole story of operational dependence. The provider may control the domain name, the administrator accounts, the password manager, the backup configuration or the knowledge of how several systems fit together. Some of these arrangements may have been made sensibly at the time. Years later, nobody may remember which choices were temporary and which became permanent.
I would begin by mapping what the organisation relies upon and who can exercise control over it. An office may own the licences but not the account through which they are managed. It may receive regular backup reports without knowing who can restore the data into a usable environment. It may have copies of its files but no practical means of recreating the workflows, permissions and connections that make those files useful.
The right question is not “Do we have the passwords?” It is “Could an appropriately authorised replacement team take responsibility without depending on the outgoing provider's goodwill or availability?”
Ownership and access are not the same thing
There are several points where that distinction matters:
- Identity: who controls the main administrative identities, recovery methods and emergency access, and whether that access has been tested under supervision.
- Infrastructure: who controls hosting, domains, DNS, certificates and the accounts needed to maintain or replace them.
- Information: whether records can be exported with their meaning, structure and required history intact, rather than merely downloaded as disconnected files.
- Recovery: whether usable backups exist outside a single provider's failure path, and whether a restoration has actually been demonstrated.
- Knowledge: whether another competent party could understand essential processes, integrations, exceptions and responsibilities from the available documentation.
This is not an argument for distributing sensitive credentials casually. Emergency access should be protected, tightly authorised and tested without undermining normal security. The point is to ensure that control remains with the organisation even when day-to-day administration has been delegated.
Try to leave before you need to
An exit plan is easy to describe in a meeting and much harder to prove. A modest rehearsal can reveal the distinction without changing supplier or disrupting normal operations.
Choose one important but bounded service. Ask for the current configuration and ownership record. Obtain an export through the agreed process. Have someone other than the incumbent verify what the export contains, what it omits and whether it could be used. Check who can authorise a transition, what notice and cooperation would be required, and which dependent systems would need to change.
For backups, arrange a controlled restoration exercise where appropriate. Do not confuse a successful backup job with a working recovery. For identity, confirm that an emergency change of administrator does not lock out the organisation or compromise sensitive records. For business-critical applications, establish whether data portability also includes the context needed to use the data.
A rehearsal need not be dramatic. Its value lies in turning assumptions into evidence.
Some dependencies are worth keeping
The objective is not to eliminate every dependency or replace a trusted provider as a precaution. A small office cannot, and should not, reproduce every specialist skill internally. Concentration can be efficient when accountability, access, recovery and alternatives are understood.
The question is whether the organisation has a choice. A provider that knows the estate intimately may be its best option for years. The same provider may also be the only person who knows how a critical approval process works. The first is a strength; the second is a risk that deserves attention even if the relationship is excellent.
This also affects supplier selection. The cheapest bid can become expensive when exit requires rebuilding what should have been transferable. Equally, demanding elaborate documentation for every minor service may cost more than the risk justifies. Proportion matters: the more critical the service and the harder it is to replace, the stronger the evidence one should expect.
The question for the person responsible
I would not begin a supplier review by asking whether the provider is good. I would ask what happens if the arrangement changes without warning, and whether the office can show how it would respond.
Sometimes the answer is a better contract. Sometimes it is a separate administrator identity, a tested restoration, cleaner documentation or one sensible alternative. Sometimes the existing arrangements prove adequate. That is a useful finding too.
Continuity is not having no dependencies. It is knowing which ones are essential, who holds the keys and whether the organisation can still make its own decisions when circumstances change.