Your bus factor is one. Fix it without hiring anyone.
One person set up the bank account, registered the domain, configured payroll, and knows which of the three email addresses the insurance actually goes to. That is not negligence. That is what a small company looks like.
The two bad options
Share the passwords with someone, and you have doubled the number of people who can empty the bank account. Do not share them, and the company stops functioning the week that person is in hospital.
A quorum is the third option. Set 2-of-3 across two founders and the accountant: no individual can open anything alone, and any two can open everything. Nobody has to be trusted unilaterally, and nobody is a single point of failure.
What this costs you
Two responder seats are free forever, which is enough for a real 2-of-2 between two founders. Adding the accountant as a third holder costs one seat. Everyone you might need to notify — staff, the landlord, the IT contractor — is free at any number.
Also: your insurer will ask
Cyber insurance questionnaires increasingly ask how privileged accounts are controlled and whether MFA exceptions exist for break-glass accounts. “Split under a two-person quorum, with an audit trail and a documented quarterly test” is a materially better answer than the one most companies your size can give, and it is about twenty minutes of setup.