Why offboarding matters
When someone joins a small business, they usually receive accounts, devices and keys quickly. When someone leaves, the reverse often gets forgotten or happens slowly. The result is old accounts that stay active, shared passwords that the former employee still knows, company files on a personal phone, and a laptop that never comes back.
Most departures are friendly, and most former employees mean no harm. But leftover access is still a risk. Accounts that nobody watches can be misused if the former employee’s password is stolen, and mistakes such as accidentally deleting files can happen. Careful offboarding protects the business, and it protects the departing person too, by drawing a clean line.
Prepare in advance
Offboarding is far easier if you did the groundwork when the person arrived.
- Keep a list of every account and system each person can reach.
- Maintain an inventory of devices, keys, cards and other equipment assigned to them.
- Prefer individual logins over shared ones, so you can close one person’s access without changing everyone else’s.
- Make sure at least two people know where the critical accounts are administered.
If you do not have this information, the first offboarding is a good opportunity to start building it.
A practical checklist
Adapt this to your business and keep it as a reusable document.
Before or on the last day
- Agree the timing. For a friendly resignation, you might keep access until the end of the final working day. For a sudden or contentious departure, access may need to be removed immediately and handled carefully, and it is sensible to seek advice on employment law in your area.
- Transfer ownership of work. Identify who takes over projects, customer relationships, recurring tasks and files. Ask the departing person to document anything only they know, such as where things are saved or how a regular task is done.
- Move files. Make sure documents saved in personal folders or on their laptop are copied to shared business storage. Do this before the account is closed.
- Handle email. Decide who will read incoming messages for a period and whether to set up an automatic reply that points people to a new contact. Forwarding a mailbox to a manager is common, but consider privacy and any personal messages.
Closing access
- Disable, don’t delete, at first. Suspend accounts rather than deleting them immediately. This keeps data available if you need it and makes mistakes reversible. Delete later, according to your retention rules.
- Cover every account. Work through your list: email, file storage, accounting, payroll, customer systems, project tools, messaging, social media, supplier portals and remote access. Do not forget software where the person may have created their own login separately.
- Change shared credentials. If they knew any shared passwords, such as for a social media account, a Wi-Fi network, or a shared mailbox, change them. Avoid sharing passwords by email or chat in the future.
- Check recovery options. Make sure the departing person’s phone number or personal email is not attached as the recovery method on any business account. This is where account recovery settings become an access route you might not expect.
- Sign out sessions and revoke tokens. Disabling a password may not end sessions already open on other devices. Use the “sign out of all devices” option where available, and remove the person’s access to connected apps.
- Remove two-factor authentication links. If a business account was protected with the employee’s own phone, move it to another method.
- Review other access. Remove the person from mailing lists, shared calendars, group chats, building access systems, VPN accounts and any external services where they were listed as a contact or administrator.
Devices and equipment
- Recover company equipment. Collect laptops, phones, security keys, access cards, keys and any other items on your inventory list. Record the date and condition.
- Protect data on the device. Back up anything the business needs, then wipe and reset the device before reassigning it. If company data was on a personal device, ask the person to remove it, and use remote removal of business data if you have set up the means to do so under your device policy.
- Check for unauthorized copies. For routine departures, a conversation and a reminder of confidentiality obligations is usually adequate. If you have specific concerns, get advice rather than acting on suspicion alone.
Afterward
- Keep records. Note what was done and when. This is helpful if questions arise later and gives you something to improve.
- Review for a few weeks. Watch for unexpected sign-in attempts to the closed accounts, and for requests that still arrive for the old contact.
- Update documents. Change organization charts, contact lists, supplier records and anything else that names the person.
Handling sensitive situations
When a departure is unfriendly, the order of events matters. Access is often removed while the person is in a meeting, and their belongings and equipment are dealt with respectfully. Keep the process factual and consistent, and treat everyone the same way so it never appears personal. Where there are legal or contractual questions, consult a qualified adviser.
Do not read personal content in a mailbox or on a device without a clear reason and the right to do so. Rules vary by location, and respect for privacy builds trust with your remaining team.
Contractors, volunteers and temporary access
Offboarding is not only for employees. Freelancers, interns, volunteers and outside providers often receive access and should be treated in the same way. Better still, give temporary access an end date at the start, and review it periodically. The same applies to suppliers and agencies that held accounts on your behalf; this overlaps with wider third-party risk.
A quick routine for a small team
- Keep one master checklist and a list of accounts.
- Assign a named person to run it each time.
- Complete the access removal on or before the last day.
- Confirm devices are returned and wiped.
- Record it as done.
The first time takes effort, mainly because you discover accounts nobody remembered. After that, the process becomes routine, and the business is left with a tidier and safer set of accounts.