What this protects
The access that outlives the employment
Offboarding is not an admin chore. It is the moment you decide how much of your business a former employee can still reach.
Client data and systems
A live account is an open door. A former employee with a working password can read files, email clients and move money.
Audit and compliance evidence
Frameworks and insurers expect a documented leaver process. A half-finished checklist is not a defence.
Client confidence
The real cost is having to explain why someone who left in March still had access to a customer's file.
The leaver who never quite left
When someone hands in their notice, most businesses are good at the visible part. They collect the laptop, they say the goodbyes, they take the key fob back. The invisible part, the accounts, the access, the files shared with a personal email address, is where the trouble tends to live.
The insider threat most businesses worry about is the malicious employee. The one they actually suffer is duller: a forgotten account with a valid password, still working months after the person who owned it has moved on.
What usually gets left behind
The old user account
Disabled on the day they leave, sometimes deleted, and sometimes not touched at all because the person doing it was on holiday.
Their mailbox and files
A mailbox still forwarding to a personal address, or a shared folder only they could open, both outlive the employment.
The API token from last year
The credential they set up for a one-off integration, saved somewhere sensible and never needed again, until someone else finds it.
Software they signed up for
A service a manager trialled with a company card, tied to their personal login, holding business data you did not know you had.
Their mobile and its logins
Phones keep sessions alive. A device handed back at 5pm still holds access to email, files and the password manager until someone wipes it.
Remote access and VPN
Certificates and VPN profiles are easy to issue and easy to forget. A valid certificate does not know that its owner has left.
Why this keeps happening
Offboarding is not hard, but it is tedious, it happens under time pressure, and it lands on whoever is least busy at that moment. Nobody owns it, so on the busy weeks the checklist gets half-finished and everyone moves on.
The problem is rarely malice. It is that access is granted generously and revoked reluctantly, and there is seldom one place that lists everything a person can actually reach.
What a proper offboarding covers
- Identity: disable the account, sign out every session and revoke the tokens
- Devices: wipe and re-provision laptops, phones and any removable storage
- Data: transfer or archive the mailbox, files and shared links they owned
- Third-party services: list and close everything the person signed up for
- Access review: confirm no shared passwords or team credentials were known only to them
- Documentation: record when each step was done, and by whom
A leaver checklist you can actually follow
- Give one person responsibility for the whole process, with a deadline of the last working day
- Suspend rather than delete the account at first, so nothing is lost, then delete once the data is transferred
- Reset every shared password the person may have known, as well as their own login
- Check the out-of-office and forwarding rules on their mailbox for anything pointed the wrong way
- Search your records for services and subscriptions registered in their name
- Review any remote access certificates or VPN profiles issued to them
The awkward one: a leaver who is not going quietly
Garden leave, a disagreement, an immediate dismissal, these are the moments when access must close the same day, not the end of the week. The polite version of offboarding waits for the last day. The right version for a difficult leaver happens before the conversation has finished.
It is worth deciding in advance who can pull that lever at short notice, so that nobody is trying to work it out during the event itself. A little unpleasant planning here saves a great deal of unpleasantness later.
Joining is the same problem in reverse
Everything that makes leaving messy also makes joining messy. Accounts created for a role that later changed, permissions granted for convenience and never tightened, a temporary login that quietly became permanent.
The simplest fix is to treat access as something borrowed rather than owned, reviewed on a regular schedule and removed the moment the reason for it goes away. It is unglamorous work, and it is the difference between a shut door and a closed one.
What to do about it
- Give one named person ownership of offboarding, with a deadline of the last working day.
- Suspend the account first, transfer the data, then delete it once the transfer is confirmed.
- Reset shared passwords and revoke API tokens and remote access, alongside the leaver's own login.
- Have a same-day plan ready for a leaver who is not going quietly.
Questions we get asked about this
How quickly should we remove someone's access when they leave?
On their last working day at the latest, and immediately if the departure is on difficult terms. A disabled account costs nothing and can be re-enabled; a live one for a departed employee is an open door.
We use Microsoft 365. Does offboarding there cover us?
It covers the account itself, but not the wider picture. Mailbox forwarding rules, shared passwords, API tokens and services signed up in their name all sit outside it, and that is where most residual access hides.
How do we find accounts and services we have forgotten about?
Start by listing every service that holds company data and who can log into it, then check that list against your recent leavers. Most businesses find at least one thing nobody remembered paying for.