She’d been planning this trip for six months. Two weeks in Sardinia, the first proper break in three years. By day three, her operations lead had sent a message: the renewal proposal was stuck because only she had the login for the pricing tool, and the client wasn’t going to wait. She sorted it from the pool in twenty minutes and knew, from that moment, that the holiday was effectively over.
That situation has a name in business operations. It’s the holiday test, and the result told her something many founders already suspect but haven’t formally diagnosed.
What is a holiday test in business?
The holiday test is a practical diagnostic. If you step away for two weeks and the business keeps running, your decisions are documented, your key tasks are delegated, and no single person is a bottleneck. If things stall or your team messages you on the beach, you have a concentration risk. The test doesn’t fix anything. It tells you where to look.
The framing comes from operational resilience thinking, where the question is whether a firm’s services hold up when a key person is unavailable. The FCA has formalised that question for regulated firms: they must map all the people, processes, technology, facilities, and information needed to deliver each important business service, then test whether those services survive severe but plausible disruptions.
For owner-managed service firms outside regulated sectors, the holiday test does the same diagnostic job informally. A business that cannot run without its founder for a fortnight has a resilience problem that will surface eventually, whether through illness, a family emergency, or a buyer’s due diligence process. The holiday is just the first opportunity to find it on your own terms.
Why does it matter for your firm?
Founder dependency carries a cost that runs deeper than a disrupted holiday. A business that stalls when you step away is operationally fragile, commercially discounted, and difficult to exit or hand over. Buyers routinely apply a valuation discount for founder dependency, and the FCA has formalised the same principle by requiring regulated firms to remain resilient when critical personnel are unavailable.
The FCA’s 2025 observations on operational resilience made the point directly: some firms were focusing too narrowly on technology resilience and missing dependencies on location and critical personnel. For a ten to fifty person services firm, that personnel concentration usually sits with the founder. When key client relationships are personal rather than documented, or when only the founder knows which supplier to call or how to approve a payment above a certain threshold, those are operational single points of failure.
The Pinsent Masons analysis of the FCA’s 2025 findings highlighted another dependency that many smaller firms overlook: third-party contracts. Delivery that depends on cloud software, outsourced payroll, or specialist subcontractors creates dependencies that may not be visible until the founder steps away and a supplier can’t be reached or a renewal decision stalls. Mapping those relationships is what makes the next absence survivable.
What does the holiday test actually expose?
The holiday test tends to reveal three categories of gap. The first is decisions that only the founder can make. The second is work that lives in the founder’s head rather than in written steps. The third is access, systems, passwords, and approval rights that only one person controls. Each of these is fixable, but you can only fix what you have first named.
On the people side, the practical question is whether staff can handle a client complaint, approve a routine invoice, or respond to a suspicious email without escalating to you. The NCSC’s small business guidance makes a point that applies directly: a founder’s absence shouldn’t be the moment the business discovers that only one person knows how to reset admin access or manage a potential security incident. If that person is you, the dependency is real.
On the process side, the test reveals whether your documented procedures are usable or just policy folders that nobody has opened in practice. The NCSC is clear that backups should be tested, not merely made. The same principle applies to delegation: a written checklist that nobody has ever followed in a real situation is a theory, not a handover.
On the access side, the ICO’s breach guidance is relevant even to firms that don’t think of themselves as data-intensive. If you are the only person who understands how personal data is handled in the business, a holiday reveals a compliance bottleneck as well as an operational one. A qualifying personal data breach must be reported to the ICO within 72 hours of becoming aware of it. If awareness depends on you being available and reachable, that’s a gap worth closing before you board the flight.
When is the holiday test not enough?
The holiday test is a useful informal diagnostic, but it has real limits. A short absence or a quiet week reveals only day-to-day admin gaps, not the dependencies that surface at billing peaks, onboarding bursts, or under genuine pressure. The FCA requires resilience testing covering severe but plausible scenarios of varying nature and duration, and a fortnight on the beach doesn’t automatically simulate those conditions.
For FCA-regulated firms, the holiday test should be understood as a starting observation rather than a substitute for formal resilience work. The FCA’s transition deadline for mapping and testing against impact tolerances was 31 March 2025, and its 2025 observations noted that many firms still need more work on third-party vulnerabilities and full dependency mapping. The holiday test may surface useful data, but it doesn’t constitute the programme the regulator expects.
Even outside regulated sectors, the test can mislead if the firm is highly seasonal or project-based. A founder who steps away in a quiet August may conclude everything is running smoothly. The pressure points, billing cycles, client onboarding peaks, and deadline crunches may all be invisible during that window. To get a representative read, the test should run during a normal trading period, not a week chosen precisely because it’s known to be calm.
If the founder’s personal involvement is a deliberate quality signal rather than a default that accumulated over time, the test will surface that design choice rather than a failure. The distinction matters: some founder involvement is intentional and appropriate. The question is whether it’s a considered decision or something that happened without being examined.
What’s the practical move from here?
The holiday test tells you what to fix. The practical move is to write down the five recurring decisions that only you currently make, assign each a named deputy with a simple checklist, and test whether that person can actually execute them. Testing means running the scenario, not writing it down. Do this before you book the holiday, not after you return and patch whatever went wrong.
Start with the highest-risk gaps: payment approvals, key client responses, access to essential systems, and incident handling. On that last point, if your deputy doesn’t know where the incident log lives or what the 72-hour ICO breach clock means in practice, they aren’t ready. Brief them explicitly and make sure they’ve used the process at least once in a low-stakes situation before it matters.
For FCA-regulated firms, align this exercise to your important business services and impact tolerances. The FCA’s expectation is that scenario testing becomes part of business as usual, not a periodic event prompted by a leave request. If your firm relies on third-party suppliers for delivery, check that the contracts give you the audit and information rights needed to include those suppliers in your dependency mapping. The Pinsent Masons analysis of the FCA’s 2025 findings flagged contractual information rights as an area where many smaller firms still need strengthening.
A basic cyber security review is worth running alongside the holiday test. The NCSC’s small business guidance covers password hygiene, multi-factor authentication, and backup testing in practical terms suited to firms without dedicated IT resource. These aren’t additions to the exercise. They are part of the same question: can this business keep running securely when you’re not in the room?
