Two dependencies, one single risk, two departments that don't talk to each other

Constructed figure, assumptions listed

Two items sit in the risk register, on two different pages, held by two different departments.

Page one, the vendor you can no longer leave. Page two, the person without whom a system stops. The two sentences describe the same thing.

The same exposure, seen from two sides

The last two lines are the subject of this article. Two different departments monitor, one pays, and none of the three sees the total.

What truly distinguishes the two

There is only one, and it favours the vendor.

A vendor dependency is sometimes addressed through law. The European Commission’s decision of 9 July 2026 on maintenance contracts illustrates this: binding commitments for ten years opened exit doors that didn’t exist before, without any client having to negotiate anything.

A dependency on a person is never addressed through law. No clause obliges anyone to stay, and a clause that tried to would have no effect. It is addressed only by what the company wrote down before they left.

In other words, whichever of the two dependencies you monitor least is the one you have the least recourse on.

What you will be told, and what to answer

“She won’t leave, she’s been here ten years.” That is exactly the profile that produces the dependency, and seniority is no guarantee. The question isn’t whether the person will leave, it’s how much the month costs when they’re absent, for a reason that’s none of your business.

“Switching vendors would cost more than staying.” That may be true, and it’s costable. Ask for the amount, including migration, data recovery and dual operation during the transition. An uncosted exit cost isn’t an argument, it’s an impression.

“We’ll document it when we have time.” Two to five days of guided work are enough to cover the essentials: what the system does, what breaks it, who to call, where the access credentials are. At 360 euros for an internal working day, full coverage costs less than a month of position vacancy.

“These are two different subjects.” They share the same signal, the same effect and the same payer. Handling them in two different committees guarantees that neither will be arbitrated at the right level.

To check for yourself, in twenty minutes

The list of systems that stop if a specific person is absent for a month. Write down the names. The discomfort of writing a name down is itself the information.

The list of vendors whose exit cost you can’t state. Same exercise, same discomfort.

The overlap between the two lists. In a company of 20 to 200 people, the same person often holds the relationship with the critical vendor. You then have a double dependency on a single point.

The committee where both lists will be presented together. If it doesn’t exist, that’s the first decision to make, and it costs nothing.

The sentence to remember

A single vendor and a single person produce the same bill. Only the page in the register changes.

Open in a spreadsheet · The comparison scale, as a spreadsheet (951 bytes)