The Emergency Folder: What Happens When the Owner Is Absent

Why is the owner’s absence the underestimated risk?

Ask about risks in a small company and you hear about key customers, supply chains, and cyberattacks. You rarely hear about the owner. Yet the owner is often the person on whom the most depends: they sign contracts, approve payments, know the passwords to the bank account, lead the conversations with the most important customers, and know which commitments were made verbally. The guide to organizing deputy coverage calls this the blind spot of many coverage plans.

Sickness is no rare case. For 2025, the German health insurer AOK counted an average of 23.3 sick days per insured employee. Owners are no less susceptible; they often just keep working until they can no longer do so. This leads to the guiding question of this guide: What must an emergency folder contain so that a small company remains able to act if the owner is suddenly absent for weeks or permanently?

To answer it, we first clarify the terms and distinguish three types of absence. Then we introduce the business impact analysis as a thinking model, review what research knows about planning and improvisation in crises, and describe the contents of the folder in six parts. At the end there are a four-week setup plan with a test run and a step for this week.

The best time for an emergency folder is a perfectly ordinary Tuesday on which you feel fine.

What is an emergency folder, and what kinds of absence are there?

An emergency folder is an organized collection of information, authority, and instructions that allows named people to keep the company running if the owner cannot be reached or cannot act. It can be on paper or kept digitally; what matters is that those authorized know where it is and how to access it in an emergency.

The size of the risk is shown by the bus factor. It indicates how many people must drop out before a task or project can no longer be continued. A bus factor of one means the task depends on a single person. For the owner, this is often the case for bank access, approvals, and signatures.

The folder must cover all three cases, but to different depths. For a short absence, it is enough that daily operations continue. With permanent absence, ownership, inheritance, and corporate law are at stake, and that is a matter for legal and tax advisors. This guide does not replace them.

The thinking model: the business impact analysis

In business continuity management, the business impact analysis is the first step. The international standard ISO 22301 and BSI Standard 200-4 from Germany’s Federal Office for Information Security describe it in detail. Its basic idea is simple: for each important function of the company, you ask how long it may be down before serious damage occurs. This period is called the maximum tolerable downtime.

The answers determine the order of precautions. Whatever causes damage after three days must be arranged so that it continues without the owner. Whatever can wait three months is enough as a note in the folder. As with a spare key at the neighbor’s: you rarely need it, but when you do, you need it immediately, and then it has to be in the agreed place.

For a small company, a lean form is enough. The full analysis according to the standard, with dependencies, recovery plans, and exercises, is meant for corporations. The guiding question per function stays the same and can be answered in an hour.

Plan or improvise? What research shows

There is an obvious objection to any emergency plan: the real emergency always turns out differently than expected. Small companies are good at improvising, and no folder foresees everything. Mafimisebi, Obembe, and Ogunsade (2025) examined exactly this question. They note that research has two camps: one recommends strengthening planned responses; the other finds evidence for the value of improvisation.

The authors analyzed cases of 16 small businesses in Nigeria, an environment with frequent crises, and spoke with their owners. Their finding connects both camps: it was most valuable when planning, improvisation, and resilience worked together over the course of a crisis. According to their analysis, how severe a crisis felt to owners depended mainly on three things: scarce financial resources, little time to respond, and the feeling of losing control. They also observed that pronounced risk awareness among owners went along with more planning.

The study comes from an environment very different from Germany’s Mittelstand, the country’s small and medium-sized business sector, and is based on few cases. Its message can still be transferred, because the three severity factors fit the owner’s absence exactly. Whoever lacks authority loses time. Whoever cannot see the account does not know the financial situation. And whoever does not know what the owner promised loses control over customer relationships.

I therefore consider both views justified. An emergency folder is not a script that prescribes every scene. It ensures that those who have to improvise have the necessary facts and authority. Improvising without access to the bank account is not improvising but waiting. The analysis of business resilience describes this connection from the perspective of the whole company, with the three phases of recognizing, coping, and adapting according to Duchek (2020).

What belongs in the emergency folder? Six parts

The most important part is the second. Information is useless if nobody may act. Which form of authority fits depends on the legal form and the situation. Under German law, a Prokura, a broad commercial power of attorney, must be entered in the commercial register; an ordinary commercial power of attorney need not be. An account mandate is agreed with the bank, and many banks require their own forms. Settle these questions with your legal and tax advisors and with the bank. What shareholders should arrange for a partner’s absence is discussed in the article on what shareholders should settle early.

For the third part, the same rule applies as in the guide to basic IT security for small businesses: each person gets only the rights needed for their task. That is why no passwords belong openly in the folder. It says where they are, for example in a password manager with emergency access or in a sealed envelope at the tax advisor’s, and who may open them under what condition.

• A named person may approve wages and supplier invoices, with a defined limit.
• The bank knows this person and has the mandate on file.
• Emergency access to accounts and programs is set up and has been tested once.
• The ten most important customers are written down with contact person and open commitments.
• The tax advisor and family know that the folder exists and where it is kept.
• Shareholder agreement, will, and lasting power of attorney are up to date, and where they are kept is noted.

An emergency folder in four weeks, with a test run

1. Week 1: functions and downtimes

   List everything only you do or approve, and estimate the maximum tolerable downtime for each function. Anything under two weeks needs a deputy with authority.

2. Week 2: clarify authority

   Discuss with the bank, tax advisor, and legal advisor which powers of attorney are needed, and have them issued. Name the people who will lead temporarily in an emergency.

3. Week 3: fill the folder

   Fill in the six parts. One or two pages per part are enough. Decide who has access and set up emergency access.

4. Week 4: test run

   Be deliberately unreachable for one working day. Your deputy works only with the folder. The next day, you collect together what was missing.

5. Afterward: review twice a year

   Twice a year and after every major change, the folder is reviewed, for example after a new loan, a new key customer, or a staff change.

The test run is the step most often skipped, and the most valuable. Only when someone actually tries to work with the folder does it become clear that a power of attorney has expired, an access does not work, or an important commitment is written down nowhere. As with daily coverage: what is not practiced does not work when it counts.

What follows beyond the emergency

The emergency folder has a side effect that many owners notice only while writing it. Whoever writes down what only they know and only they may do sees how much the company depends on them. The folder thus becomes an honest inventory of one’s own role. Many items that would have to go to a deputy in an emergency could also be handed over permanently in daily operations.

The folder is also the first stage of succession planning. Permanent absence is the unplanned version of what the guide to planning your own exit describes for the planned case. Whoever has maintained the folder does not start a later handover from scratch. In the risk register from the guide to risk management for small businesses, the owner’s absence should therefore always be a separate entry.

The limits must be stated clearly. A folder can provide facts and authority, but it can neither transfer customers’ trust nor replace missing leadership. And the legal questions around powers of attorney, inheritance, and corporate law differ from company to company. They belong in the hands of professionals.

Conclusion: what keeps the company able to act?

The question at the start was
an emergency folder must contain so that a small company remains able to act if the owner is suddenly absent. The answer follows the business impact analysis: first, the functions that may be down for only a few days are arranged, above all payments, approvals, and customer contact. This requires named people with authority, set-up access, and a few pages on finances, contracts, and commitments.

As research on small businesses in crises shows, such a folder does not replace improvisation; it makes it possible in the first place. For it to hold in an emergency, it must be rehearsed once and reviewed regularly afterward. The sober observation is: an emergency folder is the only document in the company that you hope will never be needed and that must nevertheless be correct.

What you can do this week

1. Write down what only you do, sign, or approve in your company.
2. Mark everything that cannot wait longer than two weeks.
3. Name a person for these items and schedule a meeting with your bank about an account mandate.
4. Create an emergency sheet with the most important phone numbers and where all documents are kept.
5. Tell your family and your tax advisor that this sheet exists and where it is.