Contractor Dependency Risk Scorecard for Your Critical Systems
Four questions per system show where contractors hold the code, the pager, the knowledge and the keys.
No email needed. Your answers stay in this browser unless you choose to send them.
Score each critical system on how much of its code, on-call and undocumented knowledge sits with contractors, plus the access they hold. Then act on the high scores by converting, pairing or documenting.
Last updated: November 1, 2026
Contractor dependency risk is easy to feel and hard to show. Ask a VP of Engineering whether contractors hold too much and you’ll get a shrug, a name, then a long pause. So show me the data.
That’s what this does. I’d rather see one honest number per system than a warm feeling about the whole org, because the risk never spreads evenly, and the two people you trust most may be sitting on the same payment service. Conversion is a real way out, too. About 37.5% of KORE1 contract-to-hire placements convert to permanent employment (n=552), and a KORE1 contractor can convert with no fee after 1,040 hours. If you need people for the fix, start with contract engineering teams.
Score Your Critical Systems
Pick the systems that would stop revenue or a regulated process if they broke. Each one takes about a minute.
Sample answers are loaded so you can see a result.
Payments API scores 10 of 12. Convert.
Your systems as one span
- 110
- 25
- 33
Contractors lead 6 of the 13 members on this span.
- Employees lead
- Contractors lead
- One contractor holds it
What to do with each system
2 of 3 systems need action, and 2 are fracture critical.
Payments API
10 of 12
ConvertFracture critical
This is run work that is not going away, so make the person part of the team. Start here, put an employee on every change, as reviewer first and then as author.
Data pipeline
5 of 12
PairFracture critical
Sit an employee beside the contractor until the employee can run it alone. One answer sits at the top of the scale, which moved it up a band. Start here, move admin and vendor accounts to employee ownership this week.
Customer portal
3 of 12
Leave it
Nothing here depends on one contractor. Check it again before the next extension.
Your score, your systems and the date carry into the message box, and you can edit them there. Writing it down instead? Use the contractor handoff template.
How Does the Scoring Work?
It measures bus factor, system by system. Bus factor is the number of people who could disappear before a system stalls. Usually it’s low. When researchers estimated it across 133 popular GitHub projects in 2016, 65% of them came in at two people or fewer, and those are public repositories where anyone can read the code, which is a kinder setting than your billing system. The open source community now tracks the same idea under the name contributor absence factor.
Those studies count commits. Commits miss the pager. Google’s SRE book puts a healthy single-site on-call rotation at eight engineers, so one contractor with a phone isn’t a rotation. So this asks four questions, each worth 0 to 3 points, for a maximum of 12 per system.
List the critical systems
Name up to six systems that would stop revenue or a regulated process if they broke.
Answer four questions for each
Score who wrote the code, who gets paged, what is written down and who holds the accounts, from 0 to 3 points each.
Check for a 3 on any question
A single answer of 3 means one contractor holds that piece alone, so move the system up one band.
Act on the band
Leave it, document it, pair on it or convert the person, starting with the highest score.
Step three matters most. Sums hide things. A system can score 5 and still have one person holding every admin login, and no amount of good documentation elsewhere on that system will get you back into the cloud console on the morning that person stops answering. Bridge inspectors have language for this. Federal rules define a nonredundant steel tension member as one “whose failure may cause a portion of or the entire bridge to collapse.” Inspectors used to call that fracture critical, and the old name still earns its keep here. Data teams have the same failure under a different name, and it’s covered in when one person is the database.
| Score | Action | What it means | What you do this quarter |
|---|---|---|---|
| 0 to 3 | Leave it | Employees can run this without the contractor. | Nothing. Score it again before the next extension. |
| 4 to 6 | Document | Employees could run it, slowly, with a lot of phone calls. | Write the runbooks, then have an employee run a release from them. |
| 7 to 9 | Pair | The contractor leads and employees watch. | Sit an employee beside them until the employee takes primary on-call. |
| 10 to 12 | Convert | The contractor is the system, and the work isn’t going away. | Make an offer, or fund a second person and pair for a full quarter. |
The bands are my judgment, not a measured benchmark. Move the lines if your risk tolerance differs, but don’t drop the rule about a single 3.
When Is a Long-Tenure Contractor Fine?
Often. Tenure isn’t the risk. Plenty of contractors stay for years on work with a budget and a finish line, and a clean score at year three beats a messy one at month three. What matters is what the money is buying.
“If they’re CapEx, that’s wonderful. If they’re OpEx and they’re sitting on your budget, I’m not sure if they’re the greatest contractor to keep.”
Devin Hornick, Partner at KORE1
That’s the fifth question in the scorecard. It doesn’t change the score. It changes the advice, since a project that closes should pair and hand over, while run work that never ends is a seat you’ve quietly decided to keep without ever approving the headcount.
Do the arithmetic. Across 16 KORE1 software engineer placements from 2023 to 2026, mostly in Southern California, the median bill rate was $105 an hour, so a full year of 2,080 hours comes to $218,400. Fine for a build you’d capitalize as a development project. A harder conversation for keeping the lights on, and your controller decides what qualifies. Not me. For how long is too long on the legal side, read contractor tenure limits.
37.5%
of KORE1 contract-to-hire placements convert to permanent employment, counted over 552 placements
1,040 hours
of work after which a KORE1 contractor can convert to your team at no fee
116 days
the median length of a KORE1 contract assignment, counted over 1,887 assignments
3 days
the median wait from offer to first shift, counted over 1,997 starts
KORE1 engagement data from contract placements as of October 2026, refreshed quarterly, from the records behind the Contract Rate Index 2026-Q4. The 1,040-hour threshold is our conversion policy and not a measurement.
What Converting, Pairing and Documenting Actually Fix
Each one moves a different member, and that’s why you can’t pick your favorite and call it done.
Documenting fixes the diagonal. It’s cheap. It’s also the one everyone claims to have done. A runbook nobody has tested is a rumor, so have an employee run a release from it while the author sits on their hands. The knowledge transfer plan gives you the sequence.
Pairing fixes the chords. Code and on-call only move when a second person does the work, usually across a full quarter, and for code that has turned into load-bearing spaghetti it can take longer, because nobody can safely change the part everything else is quietly leaning on.
Converting fixes the whole panel, at once, for as long as that person stays. Check the contract-to-hire conversion rates before you assume they’ll say yes. Not everybody wants a W2 from you. And if you’d like fewer high scores next year, sort the work by how long its knowledge has to stay before you staff it.
Access is the easy one. Move the accounts this week. It costs almost nothing. Nobody needs a budget. And I’ve never understood why it waits.
How KORE1 Sources, Vets and Places the Contract Engineers This Model Assumes
This part is us, not Kris. Pairing only works if the second engineer can carry the load, so here is our side of it.
Searched by your stack
We search on the stack in your req, so the engineers you meet have already worked in it.
Software engineer staffingA recruiter speaks to them first
A KORE1 recruiter talks with every candidate before you do, so your first call is never their first conversation about the role.
Contract engineering teamsW2, with a way to convert
KORE1 is the W2 employer of record, and after 1,040 hours the contractor can join your team at no fee.
Contract-to-hire staffing
The offer-to-start median is 3 days (n=1,997), which helps when a high score has a date attached. The broader model lives on our contract staffing page.
Common Questions
How do I know if contractors hold too much of our critical system knowledge?
Ask who could run a release and recover from an outage if the contractor left on Friday. If the honest answer is nobody, they hold too much. The scorecard turns that into a number per system by adding code authorship, on-call coverage and account access to the same question, so you can compare a payment service with a data pipeline on one scale.
What is a bus factor?
It’s the number of people who could vanish before a system stalls. Nobody needs an actual bus. A better offer or a closed contract works fine. A bus factor of one is the same thing as a key person dependency.
How do you reduce bus factor without adding headcount?
Start with access and runbooks, since neither needs a new hire. Move accounts to employees, test the runbooks with an employee driving, then rotate employees onto on-call, which is usually the moment you learn what the runbooks left out in the first place. Code authorship moves last. It may take a second person eventually.
Should we convert every contractor who scores high?
No. Convert when the work is permanent and the person wants the job. Project work with an end date should pair and hand over, and a conversion that keeps one person holding everything has moved the risk onto your payroll without removing it. You still need a second name.
Can a KORE1 contractor convert without a fee?
Yes, after 1,040 hours, which is about six months of full-time work. About 37.5% of KORE1 contract-to-hire placements convert to permanent employment (n=552). Talk to us before that point if a high score is forcing the timing.
Scored High on More Than One System?
Tell us which systems and when the contracts end. A KORE1 recruiter will talk through who to convert and where a second engineer would help.
Talk to KORE1Not yet? Go back to the scorecard.
