One key person, one major customer, one critical supplier, one technology platform—or one unresolved family dispute can expose a weakness that years of growth and profitability may have concealed.
By CA Surekha S Ahuja
A business can report rising turnover, healthy margins and a strong order book—and still be dangerously vulnerable.
What happens if its key decision-maker is suddenly unavailable, its largest customer stops ordering, a critical supplier fails, its systems are compromised or a family disagreement paralyses decisions?
These are not merely operational inconveniences. They can threaten cash flow, customer confidence, contractual commitments and, ultimately, the value of the enterprise.
The real risk is often not visible in the balance sheet. It lies in the dependencies the business has allowed to become indispensable.
1. A global reminder: no business should depend on one individual
NVIDIA offers a timely illustration of why leadership continuity and institutional resilience matter.
On 8 November 2026, NVIDIA announced that its Board was initiating an independent investigation following reports that founder and CEO Jensen Huang had been targeted by a foreign intelligence effort. The Board stated that it had no reason to believe national security or NVIDIA secrets had been compromised.
On 12 November 2026, NVIDIA announced Huang's resignation as President, CEO and a Board member, effective immediately. CFO Colette Kress was appointed Interim CEO, and the Board began searching for a permanent successor. Harvey C. Jones was appointed the company's first-ever Chair of the Board, separating the Chair role from the CEO role. NVIDIA stated that operations, customer commitments and its product roadmap were expected to continue without interruption.
The announcements do not establish that the investigation caused the resignation. The business lesson is broader: leadership transitions require institutional capability, clear authority, an experienced second line and continuity arrangements.
A company should not have to discover its succession plan on the day it needs one.
Official sources: NVIDIA Board statement, 8 November 2026 | NVIDIA CEO transition announcement, 12 November 2026
2. Identify the weakest links in your business
Promoters should examine whether the enterprise has become excessively dependent on any one person, relationship, asset or system.
| Critical dependency | What can go wrong | What needs protection |
|---|---|---|
| Promoter or key executive | Decisions and relationships stop functioning | Delegation, succession and documented authority |
| Major customer | Sudden loss of revenue or delayed collections | Customer diversification and receivables |
| Critical supplier | Production or delivery disruption | Alternative suppliers and inventory cover |
| Cash and banking | Profits exist but liquidity is inadequate | Cash forecasting and funding arrangements |
| Technology and cyber systems | Data loss, fraud or operational shutdown | Access controls, backups and recovery |
| Family ownership | Disputes block decisions or succession | Ownership, management and exit arrangements |
| Compliance | Missed obligations create financial and legal exposure | Responsibility, review and evidence |
The objective is not to eliminate every dependency. It is to identify which ones could seriously damage the business, understand the consequences and establish a workable alternative.
3. The promoter risk: can the business function without you?
In many owner-managed enterprises, the promoter remains the principal salesperson, negotiator, financier, approver and problem-solver.
This may work during the early years. As the business grows, it can become a structural weakness.
If only the promoter can approve major purchases, negotiate with banks, resolve customer disputes or authorise exceptional payments, the organisation may have employees but lack the authority to operate independently.
Practical safeguards
Delegate financial and operational authority through written limits.
Develop a capable second line for finance, operations, sales and compliance.
Document key customer relationships, contracts, banking arrangements and critical processes.
Ensure authorised access to essential records and systems.
Identify who can take urgent decisions if the promoter is unavailable.
The 15-day absence test: If the promoter cannot attend work or respond to calls for 15 days, can the business continue to deliver, collect money, pay employees and meet statutory obligations?
If not, the enterprise has a continuity problem—not merely a delegation problem.
4. Customer and supplier concentration: protect the commercial lifeline
A large customer may contribute substantially to turnover, while a single supplier may provide a component essential to production. Both can create hidden vulnerabilities.
The risk cannot be assessed merely by looking at percentages. A customer contributing 30% of revenue may be manageable if alternative demand exists. A supplier accounting for only 10% of purchases may be critical if no replacement is available.
Promoters should examine:
Top five customers by revenue, contribution margin and outstanding receivables.
Customer-specific inventory, tooling and production capacity.
Contract termination, price revision and payment terms.
Critical suppliers, alternative sources and switching time.
Inventory cover and the time needed to qualify replacement suppliers.
The financial impact of losing a major customer or supplier.
Practical safeguards: Maintain a customer-concentration dashboard, identify alternative suppliers for critical inputs and periodically test whether those alternatives can actually deliver. Diversification should be based on commercial risk, not an arbitrary percentage.
5. Profit is not protection: cash flow determines survival
A profitable business can still face a liquidity crisis because money is blocked in receivables, inventory, advances or capital expenditure.
A promoter should insist on a rolling 13-week cash-flow forecast, covering:
Expected collections and realistic payment dates.
Supplier payments, payroll and statutory dues.
Interest, loan instalments and committed capital expenditure.
Available bank limits, actual utilisation and drawing-power constraints.
Minimum cash required to maintain essential operations.
Run a combined stress test: the largest customer delays payment, inventory moves slowly and a critical supplier demands an advance. Can the business still meet payroll, taxes, debt obligations and essential operating costs?
A sanctioned bank limit is not the same as available liquidity. A profitable order book is not a substitute for cash.
Practical safeguards: Establish a minimum liquidity threshold, identify early-warning triggers and decide in advance who can approve emergency funding or defer discretionary expenditure.
6. AI, technology and cybersecurity: efficiency must not create new vulnerabilities
AI and digital systems can improve productivity, forecasting and decision-making. But excessive dependence on technology without adequate controls can expose the business to data leakage, incorrect decisions, fraud and operational disruption.
| Risk | Essential safeguard |
|---|---|
| Confidential information entered into AI tools | Approved tools and data-use restrictions |
| AI-generated financial or legal conclusions | Human review and source verification |
| Voice or email impersonation | Independent verification of payment instructions |
| AI agents connected to ERP or financial workflows | Restricted permissions and approval limits |
| Cloud or software platform failure | Data portability, protected backups and recovery plans |
| Cyberattack or unauthorised access | Multi-factor authentication and access monitoring |
India's AI Governance Guidelines, released by MeitY on 5 November 2025, adopt a principle-based approach to safe, inclusive and responsible AI innovation. They emphasise human-centricity and the use of existing legislation wherever possible. They do not replace applicable legal obligations, including those relating to data protection, information technology and intellectual property.
Official MeitY announcement, 5 November 2025
Every business should have an AI-use policy, role-based access, protected backups and a tested system-restoration process. Supplier bank-detail changes should always be independently verified.
A backup that has never been tested is an assumption, not a recovery plan.
The governing principle: AI should make the business more capable, not less accountable.
7. Family governance and compliance: prevent avoidable disputes and defaults
In a family-owned enterprise, continuity can be threatened by unresolved questions of ownership, management, remuneration, succession and inheritance.
Equal ownership does not necessarily mean identical management roles, equal remuneration or unanimous control over every business decision. These matters should be addressed separately.
A workable family-business framework should clarify:
Who owns the business and in what proportion.
Who manages it and how performance is assessed.
How family members working in the business are remunerated.
How succession, exit and valuation will be handled.
How disagreements will be resolved without paralysing operations.
Depending on the structure, this may require a family constitution, shareholders' agreement, appropriate Articles of Association, family settlement and succession documents.
Compliance responsibilities also need clear ownership. Income tax and TDS, GST, Companies Act filings, labour obligations, licences, contracts and regulatory notices should each have an identified person responsible, a due date and an independent review mechanism.
A compliance calendar without accountability is not an effective control.
8. The promoter's business-protection test
Ask the management team to answer these six questions with evidence, not reassurance.
Can the business function for 15 days without the promoter?
What happens if the largest customer stops ordering or delays payment for 60 days?
Can production continue if the most critical supplier fails tomorrow?
Can the business meet essential obligations during a 30-day collection disruption?
Can operations be restored if the principal technology system becomes unavailable?
Can important decisions still be taken if the principal family stakeholders disagree?
Any answer that depends on "we will manage somehow" is an unresolved risk.
9. A practical 30-day protection programme
| Timeline | Action | Expected outcome |
|---|---|---|
| Days 1–7 | Identify critical people, customers, suppliers, systems and obligations | Business dependency map |
| Days 8–14 | Quantify concentration, cash exposure and replacement time | Risk and liquidity assessment |
| Days 15–21 | Test promoter absence, customer loss, supplier disruption and system failure | Documented stress-test findings |
| Days 22–30 | Assign responsibility, approve alternatives and establish review mechanisms | Action plan with accountable owners |
Review the key indicators monthly: customer concentration, overdue receivables, critical suppliers without alternatives, projected cash balance, key roles without trained backups, tested system recovery and unresolved compliance or governance issues.
The exercise should not become another document prepared and forgotten. Every identified risk needs an owner, a deadline and evidence that the corrective action works.
CA Surekha S Ahuja's Perspective
Growth creates opportunity. Profitability measures performance. But neither, by itself, proves that a business is resilient.
A promoter's responsibility extends beyond building a successful enterprise. It includes ensuring that the enterprise can withstand the absence of a key person, the loss of a major relationship, a technology disruption, a liquidity shock or a difficult family decision.
The strongest link may create the opportunity. The weakest link determines how much of that opportunity survives.
The real strength of an enterprise is not how successfully it operates when everything goes right. It is how effectively it responds when something important goes wrong.








