{"id":44959,"date":"2026-08-31T19:25:47","date_gmt":"2026-08-31T17:25:47","guid":{"rendered":"https:\/\/smartfense.com\/?p=44959"},"modified":"2026-08-31T19:25:54","modified_gmt":"2026-08-31T17:25:54","slug":"awareness-program-continuity-when-the-owner-leaves","status":"publish","type":"post","link":"https:\/\/smartfense.com\/en\/blog\/awareness-program-continuity-when-the-owner-leaves\/","title":{"rendered":"What breaks in your awareness program when the person running it leaves"},"content":{"rendered":"

There is a conversation that keeps coming back in implementations, and it always starts in more or less the same way. On the other end is someone who has just inherited an awareness program, asks for access to a platform they did not configure, and finds out the administrator account is under the name of a person who no longer works at the organization.<\/p>\n

The background is familiar. Whoever held the program up resigned, finding a replacement will take a few months, and in the meantime someone has to decide what happens to the plan. Nobody decides to suspend it. It simply stops showing up on anyone\u2019s task list.<\/p>\n

The cost surfaces later. When the audit arrives and the period\u2019s activity is requested, there is a stretch with nothing in it. That gap cannot be explained with an org chart, and it is exactly what the auditor will flag.<\/p>\n

Awareness program continuity is the ability to keep assigning activity and producing records even when nobody is pushing it. A three-month vacancy is the most honest test there is of whether your program has it.<\/p>\n

What actually falls apart when the person running the program leaves?<\/h2>\n

It helps to separate three layers, because they break at different moments and they are fixed in different ways.<\/p>\n

The first one is operations. Someone builds the campaigns, checks who has not completed, answers the email from the business unit asking for an extension. It is the most visible layer and the one everybody assumes gets solved by splitting the work among whoever is left.<\/p>\n

The second one is technical ownership. The administrator account, the token the integration with the leadership dashboard uses, the application registered in the identity provider, the address the program\u2019s emails are sent from, the recipients of the automated reports. All of that got tied to one person at some point during the implementation, and nobody has reviewed it since.<\/p>\n

The third one is the evidence series. Every month the program assigned something leaves a record, and every month it assigned nothing leaves one too, by absence. That series is the only thing a third party can read without listening to the explanation.<\/p>\n

Splitting operations across the team, which is the first thing anyone tries, addresses the first layer. The second one goes unnoticed until something fails. And by the time it fails, the third one already has its gap.<\/p>\n

Why does splitting the work across the team last two weeks?<\/h2>\n

Informal sharing works while the subject is still fresh. After that it starts competing with work that does have an owner, and it loses every time.<\/p>\n

A security incident has someone chasing it. An audit requirement has a date. An awareness campaign that was not sent this month generates no phone call. Nobody in the business notices the difference, the unit that was going to receive it is quietly grateful, and the indicator only moves two quarters later. It is the one task in the team whose non-delivery makes no noise in the short term.<\/p>\n

What gets lost with the split is not only activity. It is the reasoning. The person who left knew why that group had a different campaign, what they agreed with operations so as not to clash with month-end close, and why an exception was in place. Whoever steps in finds a period with no activity and, above all, with no reasons. Reconstructing that takes longer than running the original plan.<\/p>\n

The plan does not fall because of a decision. It falls because it stopped being on someone\u2019s list.<\/p>\n

Which part of the awareness program can keep going with nobody behind it?<\/h2>\n

The part that was already automated before the vacancy. An automated awareness program<\/a> is a set of pre-sequenced campaigns that assign themselves to an audience over a period of one to three years, with general and specific settings defined once. As long as there is an audience, it keeps assigning, with or without anyone watching the console.<\/p>\n

That is the practical difference from a hand-built calendar. The manual calendar needs someone to run it every month. The automated program needs someone to have decided it once. Once that decision is made, the vacancy affects supervision, not delivery. At SMARTFENSE that is also the mechanism behind the compliance plan that runs itself every day<\/a>, which answers the same question from the regulatory side.<\/p>\n

There is one dependency worth looking at, and it is where the audience comes from. A program that assigns itself over a list somebody used to update by hand becomes, within a few weeks, a program running flawlessly against last quarter\u2019s organization. Anyone who joined during the vacancy shows up in no assignment, and the indicator stays green because the denominator went stale too.<\/p>\n

If user import is automated against the corporate directory, that risk leaves with the vacancy. If it depended on a file someone uploaded every month, continuity lasts as long as that file does. It is the same mechanism by which new hires move your compliance all year round<\/a>, made worse by having nobody watching it.<\/p>\n

It is worth saying what this does not solve, because presenting it as a complete answer would be selling smoke. Automation does not negotiate with a unit asking to move an activity, does not interpret an odd result, does not decide to change the approach when the context changed, and does not handle the exception for the person who was on leave for six months. All of that comes back when the replacement arrives. What automation guarantees is that it comes back to a continuous series instead of a void.<\/p>\n

\"A<\/p>\n

What was left under a person\u2019s name instead of the organization\u2019s?<\/h2>\n

This is the layer almost nobody reviews before needing it, and the one I see fail most often as a CTO. During an implementation things get created fast, with whichever account was at hand, and that account is usually the one belonging to whoever is leading the project.<\/p>\n

What is worth reviewing, ideally before there is a resignation on the table:<\/p>\n