We ask one question in nearly every first conversation with a business: when someone leaves, who turns off their accounts, and how would you know it was done?
Almost everyone hesitates. The hesitation comes from structure rather than carelessness. Hiring has a checklist because payroll forces one. Departures get a goodbye card. Meanwhile the accounts stay on, and every one of them is a working set of keys to your business, held by someone who no longer works for you.
Why Offboarding Deserves More Attention Than It Gets
Most businesses picture the risk as a bitter ex-employee. That case is real but rare. The common cases are quieter:
- An unwatched account gets compromised. A former employee reuses their old work password on a shopping site. The site gets breached, and attackers try the same credentials everywhere. Nobody notices the sign-in because nobody expects that account to be used at all.
- Data walks out slowly. The synced laptop folder, the personal phone still receiving company email, the shared drive still reachable from home. This is rarely malicious. It is never controlled.
- An audit finds the stale accounts first. Cyber insurance forensics teams and compliance auditors look for stale accounts early, because attackers look for them early.
We onboarded a law firm with ten full-time staff and found several active accounts belonging to people who had left, some years earlier. Nobody had decided to keep those accounts. Nobody had decided anything. Each one was a licensed, internet-reachable path into a firm that handles privileged client information. The fix took an afternoon. The exposure had lasted years.
The Same-Day Offboarding Checklist
Offboarding security has one rule: access ends the day employment ends. Here is the sequence:
- Disable sign-in first. Delete later. Disabling preserves the mailbox and files for handover while ending access instantly. Deletion can wait for a deliberate decision.
- Revoke sessions and app passwords. Modern email keeps people signed in on every device they ever used. Force sign-out everywhere, and revoke app-specific passwords and OAuth grants.
- Reroute the mailbox deliberately. Decide who receives their email, for how long, and when the auto-reply ends.
- Recover or wipe devices. Take back the company laptop. If you allow personal devices for work, wipe the company data from them. Mobile device management makes this a button. Without it, this step becomes a negotiation.
- Rotate what they knew. Change shared passwords they had access to, the wifi key, door codes, and the admin password taped inside the server cabinet that everyone pretends not to know about.
- Remove them from the quiet systems. Most offboarding failures happen here, so it gets its own section.
The Accounts Everyone Forgets
Email gets disabled because everyone thinks of it. These survive:
- Financial access: banking portals, payment processors, payroll, and the company card saved in their browser
- Cloud tools that grew up around the edges: the CRM, the project board, the scheduling app, social media accounts, and the file-sharing service someone set up in 2021
- Vendor portals: your insurance broker, suppliers, and state filing portals
- Anything they personally registered: the domain, the website host, an analytics account. Check ownership, not just access
- Recovery contact status: the departed office manager whose personal cell is still the reset number for your bank account
Memory will not find these. A living list will. Track what each person is granted, starting the day they are hired. A business password manager does most of this automatically. Grants become visible, shared credentials become revocable in one action, and the offboarding question changes from “what did they have?” to “press the button.”
Someone leaves on Friday. By that evening, one person can show you on screen that every account is disabled, every session is revoked, and every shared credential is rotated. A dated record of it exists. If your current process cannot produce that, the missing ingredient is ownership. Give the checklist a named owner and most of the problem disappears.
How to Make Offboarding Automatic
Mature offboarding runs on three standing habits rather than departure-day heroics. Grant access through defined roles instead of one-off favors, so what each person has is knowable. Hold a fifteen-minute quarterly review asking who still has access to what. Keep the offboarding checklist itself owned by a named person, with a dated record each time it runs.
For our managed clients, offboarding is a ticket. HR tells us someone is leaving, and the checklist above runs the same day, documented. For everyone else, it is one of the nine areas an assessment examines, and the first question on the self-assessment. It earned that position. Of everything in security, offboarding is the control that costs the least and gets skipped the most.