You measure institutional knowledge risk by asking a specific question of every critical function: if this person left tomorrow, who else could do what they do, and how long would it take them to get there? When the honest answer is "no one" or "months," you've found a concentration risk - and most organizations have more of these than they realize, because the risk is invisible until someone actually leaves.
We wrote about a related moment recently: the point, usually somewhere around fifty employees, where a founder or a few long-tenured people can no longer hold the whole business in their heads, and informal knowledge-sharing quietly stops scaling. The deeper version of that problem is specific roles, not just general company context - the one person who knows why a legacy system is configured the way it is, or the one person every new hire gets routed to with the question nobody else can answer.
Why this risk stays invisible until it's expensive
Institutional knowledge concentration doesn't show up in a headcount report. It shows up in a project delay, a client relationship that wobbles, or a six-week scramble to reconstruct a process that lived entirely in one person's head. By the time it's visible, it's already a crisis, not a risk you could have planned around.
It's also easy to misdiagnose. A sudden departure that stalls a team often gets treated as a one-off bad-luck event - "we lost a great person" - rather than what it usually is: a structural risk that existed long before the resignation, and would have existed regardless of who left.
What the data actually looks like
Research on people-leader reporting in 2026 points to the same underlying pattern executives are increasingly asked about: whether critical knowledge sits with a handful of people, what the cost and delivery impact of a sudden exit would be, and whether there are early, forward-looking indicators before it happens - not just a post-mortem after someone resigns.
That's a different question than standard attrition reporting, which usually looks backward at who left and why. Concentration risk is a forward-looking question: who could leave, and what would it cost us specifically, not just in headcount but in capability.
How to actually measure it
Start with critical functions, not everyone. Identify the roles where a gap would stall delivery, not just create inconvenience - this is usually a short list, not the whole org chart.
For each one, ask three things: how many people could currently step in, how long would it realistically take someone to get there, and is there any documentation or cross-training already in place, or does the knowledge exist only in one person's head.
Track tenure and backfill history alongside this. A role that's been hard to fill before, or where the current person has unusually long, unbroken tenure, is a stronger signal of risk than tenure alone would suggest.
Turning the measurement into action
The fix usually isn't "hire a redundant person for every critical role" - that's rarely realistic. It's targeted: documentation for the highest-risk roles, deliberate cross-training before a departure is imminent, and treating succession planning as an ongoing practice for a defined list of concentration-risk roles, not an annual exercise limited to the executive team.
The organizations that handle this well aren't the ones with the most process. They're the ones who caught the concentration risk early enough to do something about it before a resignation letter forced the question.
FAQ
What's the difference between institutional knowledge risk and normal attrition risk?
Attrition risk asks who's likely to leave. Institutional knowledge risk asks what it would cost if a specific person left, regardless of how likely that is - it's a concentration question, not a prediction question.
How many people need to share a skill before the risk is considered low?
There's no universal number, but if only one person can perform a critical function with no documented backup, that's a high-risk concentration regardless of company size.
Is this only a concern for small companies?
No. Concentration risk shows up in companies of any size wherever a function hasn't scaled its knowledge-sharing alongside its growth - it's about documentation and redundancy, not headcount.
What kind of tool surfaces concentration risk like this automatically?
A platform that connects workforce data across tenure, role, and backfill history - the category Illoominus operates in - is built to surface concentration risk like this proactively, rather than requiring someone to run the three-question exercise manually for every critical role.
