Owner Out of Office: The 4 Handoffs Every Small Business Should Test First

June 14, 2026 • Business IT

Skits here, with the second of our June posts. This one's for the owner-operator finally taking a real week off — or the office manager whose boss is about to, and isn't sure they're ready.

Seventeen years of doing this and the call we get every July sounds the same. "Jerry, the owner's in Bermuda, the credit-card terminal stopped, nobody knows the admin password, what do we do." We unwind it. It costs a day of business. It was preventable.

Four handoffs. Test them BEFORE you leave, not from the beach.

Handoff #1 — The backup admin

Pick one person who's covering. Tell them they're covering. Write down what they're authorized to do and what they're NOT authorized to do.

"Surprise, you're admin" is the worst handoff in small business. Marsha in accounting will be a hero IF she knows she's the one. She'll be a panicked hero if you didn't tell her until the phone call from the lobby.

Real authorization items to think through:

• Can they approve a wire transfer? (Suggested answer: no.)
• Can they reset an employee's password? (Suggested answer: yes, with confirmation.)
• Can they buy gift cards if "you" email them and say it's urgent? (Answer: NO. Pre-agree on this. See Handoff #4.)
• Can they call the IT person (us)? (Yes. Pre-introduce them by name so we know they have authority when they call.)

Handoff #2 — The password manager

If you use a password manager (and you should — we cover the basics in Password Security 101), schedule a 15-minute walk-through with your backup admin. Their desk. Their machine. Their login. Make sure they can:

1. Sign into the manager themselves
2. Find the credit-card processor password
3. Find the payroll login
4. Find the Microsoft 365 admin account

If you don't use a password manager yet — this is your sign. The CISA news this spring was a $15 billion Salesforce breach traced to a single set of AWS keys an engineer pasted into a public GitHub repo. The single control that would have stopped it: a password manager + key rotation hygiene. Small Winchester businesses don't have $15 billion at stake, but the mechanic is the same: ONE careless paste, hours of pain.

Handoff #3 — The restore test

"We have backups" and "we have backups that actually work" are two different sentences. The difference is whether you ever tested.

Pull one file off the backup. Open it. Make sure it's the right version. Do it from your office network. Then do it from a different network (try your phone's hotspot). If both work, you have a real backup. If either fails, you have a hopeful filing cabinet.

We walk through the 3-2-1 rule (3 copies, 2 different media types, 1 off-site) in Backing Up Your Business Data. 10 minutes.

Handoff #4 — The out-of-office that doesn't help a thief

Here's a real-looking auto-reply. Read it like you're a scammer:

"Hi! I'm out of the office June 8–22 on family vacation. I won't be checking email and my phone will be off. For anything urgent, please contact my assistant Marsha at marsha@ourcompany.com or 540-555-0123."

What it gave away: you're gone for 14 days, you can't be reached to verify anything, the person who CAN approve things is Marsha, here's her direct email and phone. CEO gift-card fraud writes itself from here.

Better:

"Hi — I'm out of the office and will respond when I return. For anything urgent, please contact our team at info@ourcompany.com."

No dates, no reasons, no direct names. The team inbox covers it; the team knows internally who's covering. We launched Out-of-Office Done Right at the start of June for exactly this. 10 minutes, covers Outlook, 365, Gmail, Apple Mail, the calendar OOO, and delegation vs auto-reply.

The pre-agreement that prevents the CEO scam

Sit your office manager down before you leave. Tell them: "If you get an email from me asking you to do anything unusual — buy gift cards, wire money, send tax forms — you don't reply. You call my cell. If I don't answer, you call Jerry. Don't do it. If I'm actually in trouble I'll find a way."

That single conversation kills CEO-impersonation fraud before it starts. Most of it dies the moment someone picks up a phone.

The seasonal-staff angle (June bonus)

If you're bringing on summer help — pool company, landscape crew, summer-camp office, retail tourist season — two things to button up before vacation:

• Each seasonal hire gets their own login. Not a shared one. When they leave Labor Day, you disable ONE account.
• Write the offboarding now — not in September. Five lines, taped to the inside of the personnel folder: disable email, remove from password manager, collect the key fob, change the alarm code, revoke building access.

If you want help

This is what we call "managed IT" when we do it for clients. It's not about owning fancy equipment. It's about somebody else carrying these checklists so you can actually unplug for a week. If that sounds like what you've been needing — 540.303.2410. Ask for Jerry.

— Skits