Why departures create risk
When someone leaves a team, whether as an employee, contractor, volunteer, or collaborator, they usually still hold access to many things: email, shared folders, project tools, customer records, and sometimes shared logins that several people use. Most departures are amicable and nothing goes wrong. The risk is less about bad intent than about leftovers. Forgotten accounts stay active for months, files remain stuck in a personal storage space, and a shared password stays unchanged long after it should have been.
A simple, repeatable offboarding checklist handles this without drama. It is also kinder to the departing person, because it makes the process routine and not personal.
Before the last day: build the inventory
The hardest part is knowing what the person had. Small teams often discover this only after they leave. Keep a living list, ideally a few lines per person, covering:
- Accounts in their name across all the tools the team uses.
- Shared logins they know, such as a social media account or a vendor portal.
- Files and folders they own or are the only editor of.
- Devices, keys, badges, and other equipment.
- Subscriptions or domains registered under their personal email or payment method.
- Responsibilities that only they handle, like a recurring report or a customer relationship.
Reviewing sharing permissions periodically makes this list easier to produce, because you will already know who can see and change what.
Offboarding checklist
Order matters. A sensible approach is to secure what is critical first, and tidy up afterward.
1. Decide timing and communicate. Agree on the exact moment access ends, and who is told. For routine departures this might be the end of the last day; in sensitive cases it may be immediate. Be clear and respectful in how it is communicated.
2. Protect files and knowledge first. Before closing anything, move work out of personal spaces. Transfer ownership of documents and folders, hand over customer conversations, and ask for notes on any task in progress. A handover document, ideally kept in the team wiki, preserves what the person knew. Closing an account too early can delete or lock content that nobody else can reach.
3. Remove or suspend accounts. Suspend first where the tool allows it, rather than deleting. Suspension cuts off access while keeping data intact; deletion can be permanent. Cover email, chat, storage, project and customer tools, and any financial or admin systems.
4. Handle email carefully. Forward or redirect incoming messages to a colleague for a period, and consider an automatic reply naming a new contact. Set up access to the mailbox for whoever needs to retrieve old messages, according to your policies and applicable law.
5. Change shared credentials. If the person knew a shared password, change it, and update the people who still need it. This is a strong argument for password managers with shared vaults, where access can be removed from one person without rotating everything manually, though secrets they have already seen may still need changing. Also review two-factor authentication on shared accounts, since a code may be tied to the departing person’s phone number.
6. Revoke other access routes. Check for remote access, network connections, API keys or tokens they created, connected apps, and integrations that run under their identity. App integrations that authenticate as a specific user can stop working or, worse, keep working, when that person’s account is closed.
7. Recover devices and property. Collect laptops, phones, drives, keys, and badges. For devices with company data, plan how to wipe them safely, after copying anything the team needs.
8. Review financial and external ties. Remove them as a signer, contact, or administrator on vendor accounts, domain registrations, and payment tools. Make sure no recurring services are billed to their personal accounts.
9. Update records and responsibilities. Reassign recurring tasks, and update contact lists, calendars, and the standard operating procedures that named them.
10. Check after a short while. A week or a month later, look at sign-in logs where available, and confirm no active sessions or unexpected activity remain.
Contractors, volunteers, and part-time helpers
People with limited access are easy to forget because they are not on a staff list. Give outside collaborators access that expires, or review them on a schedule, and include them in the inventory. Grant access to what is needed, nothing broader, which also keeps offboarding quick.
Make it easier next time
- Use individual accounts instead of shared ones wherever possible, so each person’s access can be removed independently.
- Grant least access needed for the job, and review it when roles change, since role changes create the same leftover-access problem.
- Keep one central list of tools and who administers them. It prevents the situation where the only administrator is the person who just left.
- Add onboarding and offboarding steps to one checklist. Setting up a new person well, as with remote onboarding, makes later removal straightforward.
- Keep backups, so that if something is deleted in the transition, it can be recovered.
Handling difficult departures
If a departure is contentious, move quickly on credentials and access, keep a record of what was done, and avoid actions that could cause disputes, such as reading personal messages without a clear policy. Legal and employment rules differ by location, so consider asking a qualified adviser if the situation involves sensitive data or disagreements.
A good offboarding process is mostly unglamorous: a list, a few hours of care, and the habit of using it every time.