Vacant critical role: how to assess the position before deciding who fills it

When a key role falls vacant, the first useful question is not “who do we put in their place?” It is “what does the organisation need from that position today?” Assessing a critical role means establishing what results it must deliver, which decisions belong to it, who it works with, what legal obligations it carries, what each week of vacancy costs and how to cover it in the meantime. The outcome is a role profile written with management. It becomes the yardstick for judging candidates, internal or external. It is often also a chance to redesign a position that grew by accretion.

Why isn’t it enough to find someone just like the person who left?

Over the years, the real role takes the shape of the person who holds it. Tasks pile up that no one decided on, delegated powers are never formalised, and some activities are done only because that person knew how. Looking for a copy means copying these distortions too.

Meanwhile the company has changed, with new markets, new systems and new obligations. The profile that worked ten years ago may not be the one needed now.

A typical scenario. At a distribution group, the head of IT leaves. Over the years he had also taken on the telephone contracts, software purchasing, the relationship with the ERP vendor and data protection matters. The job advert management was about to publish asked for all these skills at once, a profile that barely exists on the market. After the assessment, the role is split. The systems stay with a technical specialist, and purchasing goes back to the purchasing department. Data protection passes to someone with the right expertise and no conflict of interest.

What makes a role critical?

A role is critical when a vacancy, or a wrong choice to fill it, quickly causes significant damage that is hard to repair. This is not only about senior managers. The only specialist on a system, or the quality manager at a plant, can be critical too.

For each criterion, a rating of high, medium or low is enough. Management gives it, together with people who know the work. The roles with the most high ratings go to the top of the list. That includes the role vacant today, and also those that could become vacant tomorrow.

How do you describe the role before thinking about names?

You write a short role profile that answers eight questions.

1. Purpose. Why the position exists, in one sentence.
2. Expected results. What it must achieve in the first twelve months, in verifiable terms.
3. Decisions. What it decides alone, what it proposes and what it carries out, with which signatures and powers of attorney.
4. Relationships. Who it reports to, whom it coordinates, and which functions and external contacts it works with.
5. Essential skills. Keep them few, and separate them from those that are merely useful. A shared vocabulary helps. The European Commission provides ESCO, the multilingual classification of skills, competences and occupations.
6. Conditions. Location, travel, languages and confidentiality.
7. Legal or contractual requirements.
8. Review. How, after six months, you will know whether the choice was right.

The profile is written with management and with the people who will work alongside the new hire. That means the line manager, a peer, and someone from a function that depends on the role. It is about the position, not about people. When candidates are assessed later, the rules on data processing and on the limits to what an employer may investigate apply. They are summarised on our page on critical roles.

Which roles have requirements set by law?

Some positions cannot be filled by just anyone, nor left empty without consequences. Here are some examples from Italy and the European Union.

• Data protection officer. The GDPR requires the data protection officer to be chosen on the basis of professional qualities and expert knowledge of the field (Article 37). The officer may carry out other tasks, provided they do not create conflicts of interest (Article 38).
• NIS point of contact. For entities that fall under the NIS rules (Italy’s implementation of NIS2, the EU directive on network and information security), Italy’s National Cybersecurity Agency (Agenzia per la Cybersicurezza Nazionale, ACN) states that the role can be held by the legal representative, by a person with their general power of attorney or by a delegated employee. It also provides for a deputy. If this was the vacant role, the designation must be updated.
• Leadership of listed companies. The Italian Corporate Governance Code (Codice di Corporate Governance) recommends that, in the larger listed companies that adopt it, the board of directors draw up a succession plan for the chief executive and the executive directors. The plan should at least set out the procedures to follow if they leave office early. The board should also make sure that adequate procedures exist for the succession of top management.
• Regulated sectors. Banks, insurers and other supervised sectors have their own requirements for various positions. Check them with your lawyers before making the appointment.

There is also a general rule. The Italian Civil Code requires anyone running a business through a company to have organisational arrangements adequate to the nature and size of the business (Article 2086). A key position with no cover and no plan is one of the gaps that a review of those arrangements can expose. For San Marino companies the framework is different and needs to be assessed case by case.

How do you cover the role in the meantime?

Whatever the solution, three things happen in the first week. Signatures, powers of attorney and access rights are updated, and those of the person who left are revoked. Customers, suppliers and authorities are told who the new contact is. A date is set by which the interim cover ends. When the vacant role is technical, the choice between an internal hire and an external service follows the reasoning set out for the in-house or external Oracle DBA.

When should you redesign the role instead of replicating it?

Redesign it when you see at least one of these signs.

• Incompatible tasks in the same position, such as authorising payments and reconciling the accounts, or administering the systems and checking their security.
• A profile that does not exist. The sum of the skills required matches no real career path.
• A changed strategy. The role was designed for a company that no longer exists.
• Decisions already moved elsewhere. The role signs, but someone else actually decides.

Redesigning does not necessarily mean splitting. Sometimes two positions merge. Sometimes part of the work moves outside the company. Sometimes the role moves up a level and reports directly to the top.

In brief

• Assess a vacant role before thinking about names. Ask what it must achieve today, not what the previous holder did.
• Impact, urgency, cover, availability, powers and obligations show how critical it is.
• The role profile, written with the people who will work alongside the role, becomes the yardstick for every candidate.
• Some positions have requirements set by law, and a vacancy can also raise questions about whether the company’s arrangements are adequate.
• Interim cover has written powers, updated access rights and an end date.
• A vacancy is often the best moment to redesign the role.

Frequently asked questions

Who should write the role profile?

Management should write it, with the position’s line manager and the people who will work alongside it. External support helps to ask the right questions and to keep essential skills separate from merely useful ones.

Is it worth promoting someone from inside?

It can be, if they meet the requirements in the profile. They should be assessed by the same yardstick as external candidates, and you need to consider the gap they leave in their current position.

How often should the list of critical roles be updated?

Update it at least once a year, and at every major change, such as a reorganisation, an acquisition, a new market or new regulatory obligations.

Identifying the roles you cannot afford to get wrong, writing their profiles and preparing successors in good time is the work Strategic does in its critical roles and succession practice, together with management and the people who manage staff within the company.

Sources

Consulted on 16 September 2026.

• Italian Civil Code, Article 2086, Management of the business, Normattiva (in Italian)
• Corporate Governance Committee, Corporate Governance Code, January 2020, Article 4, Recommendations 19 and 24
• Regulation (EU) 2016/679 (GDPR), Articles 37 and 38, EUR-Lex
• Italy’s National Cybersecurity Agency (ACN), NIS frequently asked questions: roles and procedures (in Italian)
• Law 300 of 20 May 1970 (Workers’ Statute), Article 8, Normattiva (in Italian)
• European Commission, What is ESCO?