What Happens to Your Business If Your Only Accountant or Bookkeeper Disappears Tomorrow?

A finance continuity checklist for founders

The short answer: If one person holds your BIR eFPS login, your filing calendar and your books, their resignation is not an HR problem. It is a compliance problem with a price tag. Deadlines do not pause while you recruit, penalties accrue from the original due date, and restoring access to government portals is a documented process that takes days, not an afternoon.

In this article

• The base rate: how likely this actually is, using current turnover data
• What it costs when a filing slips, using current BIR, SSS, Pag-IBIG and SEC figures
• What the fraud research says about one-person finance functions
• Why digital filing and the new e-invoicing mandate make this worse, not better
• A 7-question checklist you can run in ten minutes
• Three ways to close the gaps, with the trade-offs of each

The two-day problem

A bookkeeper hands in a resignation letter on a Monday. The quarterly VAT return is due Friday. She is the only enrolled user on the company’s eFPS account, the only one who knows which vendors are still unreconciled, and the only one who has ever prepared the withholding tax schedule.

Nobody did anything wrong. She gave proper notice. She was good at her job. And yet by Friday the business has a live compliance exposure nobody planned for.

The question worth asking is not whether this could happen to you. It is how likely it is, and what it would cost. Both are measurable.

First, the base rate: how likely is this?

Start with the structure of Philippine business. Of the 1,241,476 registered business establishments in the Philippine Statistics Authority’s 2024 count, 99.63% are MSMEs, and the large majority of those are micro enterprises with fewer than ten employees. A finance function of one is not an oversight in this market. It is the default.

Now the turnover side. Aon’s 2025 Salary Increase and Turnover Study, which surveyed more than 700 organisations across six Southeast Asian countries between July and September 2025, projects an attrition rate of around 20% for Philippine firms, the highest in the region, ahead of Singapore at 19.3% and Malaysia at 18.2%. Separately, Aon’s 2025 Human Capital Employee Sentiment Study found that 64% of Filipino workers were either actively looking or considering a move within 12 months.

A caveat worth stating plainly, because the number is easy to misuse: 20% is an economy-wide projection, not a finance-specific one, and it is not a prediction about your bookkeeper. Treat it as a rough base rate. What it tells you is that in a typical Philippine company, roughly one in five people will leave in a given year. If your entire finance function is one person, that is the probability you are carrying, and you are carrying it without a backup.

That combination, a market where one-person back offices are structurally normal, and turnover is the highest in Southeast Asia, is why this risk is so widely held and so rarely on anyone’s risk register.

Why this is a continuity risk, not an HR problem

The instinct when someone resigns is to think about hiring. That is the slowest lever you have, and the clock you are racing is set by regulators.

The penalties do not pause while you look for a replacement

Philippine compliance penalties run from the original deadline. A vacancy is not a recognised excuse, and the amounts stack rather than substitute.

Four agencies, four schedules, four penalty formulas, all running whether or not you currently have someone to file.

Access recovery has a queue, and you cannot jump it

This is the part that surprises founders most, and it is the single most useful fact in this article.

If the only enrolled user on your BIR eFPS account leaves, you cannot reset it from your side. Per the BIR’s own eFPS guidance, revoking a deactivated user’s access requires a board resolution or similar written request submitted to the BIR, naming the newly authorised user. Only once that request is processed can the company enrol the new user through the “Enroll More Users” facility. BIR procedure indicates a status response from the RDO or LTAS within 3 to 10 working days.

Set that against a filing calendar. If your return is due in four days and your access request sits in a five-to-ten-day queue, urgency on your side does not change the arithmetic. You are now managing a late filing rather than preventing one.

The same logic applies to your bank’s corporate portal, your accounting software admin seat, your payroll system and your SEC eFAST credentials. Access recovery is a documented process everywhere, and documented processes take time.

Your records are legally yours; they may not be physically yours

Under Revenue Regulations No. 17-2013, businesses must preserve books of accounts, subsidiary books, invoices, receipts, vouchers and supporting records for ten years, counted from the day following the filing deadline of the return for the taxable year in which the last entry was made. The rules also expect those records to be kept at the place of business and produced on demand for inspection.

Now ask where your records actually sit. If the working files, reconciliations and schedules live on a personal laptop or a bookkeeper’s personal cloud drive, the business does not hold its own records. It holds a promise that someone will hand them over. Most people do. Some hand over files nobody else can interpret. And when a Letter of Authority arrives two years later, the difference matters.

One person doing everything is a recognised control weakness

This is not a matter of opinion, and it is worth separating from any question of trust.

The ACFE’s Occupational Fraud 2026: A Report to the Nations analysed 2,402 cases across 143 countries, closed between January 2024 and September 2025, representing more than $3.4 billion in losses. Three findings are directly relevant to a one-person finance function:

• Smaller organisations lose more per case. Organisations with fewer than 100 employees recorded a median loss of $126,000 per case, above the $104,000 overall median. Leaner teams mean fewer controls, not smaller consequences.
• Missing controls are the dominant cause. A lack of internal controls contributed to 33% of cases, override of existing controls to 19%, and lack of management review to 18%, around 70% between them. Most fraud in the dataset happened because a safeguard was absent, not because someone was unusually devious.
• The specific control that addresses this risk works. Organisations with job rotation and mandatory vacations in place recorded median losses roughly 49% lower; those with management review in place, roughly 55% lower. (These are comparisons between organisations with and without each control, so read them as strong association rather than proven causation.)

Job rotation and mandatory vacation are, in plain language, the requirement that someone else must be able to do this job. That is the same thing continuity planning asks for. The control that protects you when your bookkeeper resigns is the same control that protects you while they are still there.

None of this implies your bookkeeper is doing anything wrong. It means the structure around them is doing less work than it should.

The replacement market is tighter than most founders assume

Recruiting your way out is harder than it was five years ago. In the May 2026 CPA Licensure Examination, released by the PRC on 2 June 2026, 3,004 of 9,745 examinees passed, a rate of 30.83%. PICPA has noted that the country has produced roughly 199,000 CPAs in a century, that local firms began hiring non-CPAs years ago to cover the gap, and that accountancy enrolment has been falling.

You are also no longer competing only with other Philippine employers. PICPA’s leadership has pointed to Filipino CPAs migrating abroad or working online for foreign companies as a direct driver of the domestic shortage. A capable bookkeeper in Manila can now be recruited by a firm in Sydney or Chicago without leaving home, at rates set by that market rather than yours.

The knock-on effect is measurable. In Robert Half’s research, 86% of finance and accounting leaders reported challenges hiring and retaining accountants, and 61% said finding skilled professionals is more difficult than a year ago. Most usefully for this article, the same research connects staffing gaps directly to compliance exposure: 30% said the shortage had significantly increased compliance risks, 27% reported compliance delays tied directly to staffing gaps, and 26% had outsourced compliance tasks simply to keep up. (These are US-based surveys, so read them as evidence that vacancy-driven compliance failure is a documented pattern in the profession, not as a Philippine statistic.)

“We’ll just replace them” is a plan with a timeline attached, and the timeline is longer than your next deadline.

Digital filing has made single-person access more fragile, not less

It is tempting to assume that moving compliance online reduces key-person risk. In practice it concentrates it, because every digital system adds another credential that one person holds.

The clearest current example is the BIR’s Electronic Invoicing System (EIS). Under Revenue Regulations No. 11-2025, as amended by RR No. 26-2025, covered taxpayers must issue structured electronic invoices by 31 December 2026, a deadline moved back from the original 14 March 2026 to give businesses time for system reconfiguration.

Scope matters here, so be precise about whether this applies to you. The first wave covers taxpayers engaged in e-commerce or internet transactions (small, medium and large), taxpayers under the Large Taxpayers Service, large taxpayers under the Ease of Paying Taxes Act, and users of Computerized Accounting Systems or Computerized Books of Accounts with electronic invoicing. Micro taxpayers are exempt, though they may opt in. If you sell online, that first category likely includes you.

Compliance is not a settings change. Covered taxpayers must generate structured invoice data in the BIR’s schema, complete EIS Certification, obtain a Permit to Transmit, and test transmission before going live. That is a technical integration with its own credentials, its own certification record, and usually one person who understands how it was configured.

Add it to the list of things that walk out the door with a resignation. The more of your compliance runs through APIs and portals, the more Question 1 in the checklist below matters.

Thirty days is a legal floor, not a handover guarantee

Under Article 300 of the Labor Code, an employee resigning without just cause gives at least 30 days’ written notice. That period exists so employers can reassign work and supervise a turnover. But Article 300 also lists just causes permitting immediate resignation, and employers can waive the notice period.

Even in the best case, 30 days of overlap only helps if there is somewhere for the knowledge to go. With no second person and no documentation, a 30-day notice buys you 30 more days of the same dependency.

The Finance Continuity Checklist

Run this now. It takes about ten minutes, and it works better if you answer from what you personally know or can personally access.

Answer Yes, No, or Not sure. Treat “Not sure” as “No”, because in a real handover it behaves like one.

How to read your score

Count your No and Not sure answers.

• 0 to 1, Contained. You have real redundancy. Worth documenting what you already do informally so it survives your own absence too.
• 2 to 3, Exposed. You would survive a resignation, but the first month would be expensive in time, penalties, or both.
• 4 or more, Single point of failure. Your finance function depends on one person’s continued availability.

Weight Question 1 heaviest. If the answer there is No, treat your score as one band worse. Access is the gap with the longest documented recovery time, the 3-to-10-working-day eFPS re-enrolment queue above, and the least room to improvise. Every other gap on this list can be closed in a hurry. That one cannot.

This is a practical diagnostic, not a validated risk instrument. The weighting reflects recovery time, not a statistical model.

What the checklist usually reveals

Four patterns account for most of what this checklist surfaces, and each maps to a control weakness the ACFE data already identified.

Access sits with the person, not the company. Portals were enrolled under the bookkeeper’s name because that was fastest at the time. Nobody revisited it.

The calendar is undocumented. The business is compliant because one person remembers. There is no written schedule showing what is due, when, who prepares, who reviews, and who confirms filing.

Process knowledge was never written down. Which vendors need a 2307. How the payroll accrual is computed. All correct, all in someone’s head.

Preparer and reviewer are the same person. This is the “lack of management review” weakness that appeared in 18% of ACFE cases, and the absence of the segregation of duties the report identifies as a core defence. It is a control weakness even when the person is excellent, which is exactly why it tends to surface only during an audit.

Worth saying plainly: none of these mean your bookkeeper is doing a bad job. They usually mean the opposite. A capable person absorbed more and more of the function because they could, and nobody built structure around them.

Closing the gaps: three realistic paths

Option B is worth doing this month whichever direction you choose: enrol yourself or a director as an eFPS user, add a second bank signatory, move working files to a company-owned drive, and write the filing calendar into a shared document with named owners.

If you are weighing Option C, the question to ask any provider is not “how experienced are you.” It is: “If the person assigned to my account resigns next week, what changes for me?” A team-based model should answer with specifics: documented procedures, shared knowledge, a named reviewer, access held at company level. If the answer is vague, you are buying the same single-person risk in a different wrapper.

A 30-day continuity sprint

Week 1, Reclaim access. Enrol a director or owner as an additional eFPS user. Prepare the board resolution now, before you need it urgently. Add a second bank signatory. Check who holds admin rights on your accounting and payroll systems.

Week 2, Write the calendar. One page. Every recurring obligation, its deadline, preparer, reviewer, and where the supporting file lives. Include the annual items people forget: AFS, GIS, renewal of books, business permit renewal.

Week 3, Move the records. Everything into a company-owned cloud folder with a consistent structure. Ten years of retention is a long time to trust a personal device.

Week 4, Document the non-obvious. Sit with your bookkeeper and write down the five things only they know: chart of accounts logic, recurring journal entries, vendor withholding treatment, payroll cut-off rules, and any manual workaround they have built. This is a conversation, not an audit, and most bookkeepers are glad to be asked.

You will not eliminate the risk in 30 days. You will move it from “the business stops” to “the business is inconvenienced,” which is the point.

Frequently asked questions

What happens if my bookkeeper resigns in the Philippines?
They owe you at least 30 days’ written notice under Article 300 of the Labor Code, though immediate resignation is allowed for specific just causes and employers may waive the period. Your actual exposure depends on whether access, records and the filing calendar sit with the company or with that individual.

Who should have access to our BIR eFPS account?
At minimum an owner, director or officer, in addition to whoever files. For corporations, eFPS enrolment is made by officers authorised through a board resolution, so build that authorisation into your setup rather than treating it as an emergency step.

How long does it take to change the authorised eFPS user?
Replacing a corporate eFPS user requires a board resolution or written request naming the new authorised user, submitted to your RDO, before the new user can be enrolled. BIR procedure indicates a status response within roughly 3 to 10 working days.

What are the penalties for late BIR filing?
A 25% surcharge on tax due, 12% annual interest from the deadline, and a compromise penalty scaled to the amount involved under RMO 7-2015. The surcharge rises to 50% for wilful neglect. Micro and small taxpayers receive a 10% surcharge and halved interest under the Ease of Paying Taxes Act.

How long do we have to keep our books of accounts?
Ten years under Revenue Regulations No. 17-2013, counted from the filing deadline of the return covering the last entry. Records must be kept at the place of business and produced on demand.

Is outsourced accounting safer than an in-house bookkeeper?
Not automatically. A one-person outsourced arrangement carries the same concentration risk as a single hire. What reduces risk is structure: several people familiar with the account, documented procedures, a named reviewer separate from the preparer, and system access held by your company.

Run the checklist this week

You do not need to decide anything about your finance setup today. You do need to know where you stand, and the checklist above will tell you in ten minutes.

If the gaps are bigger than expected, better to know while things are calm than during a notice period. CloudCFO’s model is built around teams rather than individuals: access sits with your company, processes are documented and tracked in our web app, and no single person carries your whole finance function.

For a second read on where your exposure sits, talk to our team or email hello@cloudcfo.ph.
Talk to Our Team

DISCLAIMER: This article is strictly for general information purposes only. Nothing in this article constitutes or intends to constitute financial, accounting, regulatory or legal advice and must not be used as a substitute for professional advice. Penalty rates, deadlines and filing procedures change; verify current requirements with the BIR, SEC, SSS, PhilHealth and Pag-IBIG or with your adviser before acting.