This post is written in Markdown and uses the post-standard-md layout, to show that Markdown posts get exactly the same treatment as HTML ones.
When someone joins, three people make sure they have what they need, because otherwise they cannot work and they will say so. When someone leaves, their access simply carries on. Nobody is inconvenienced, so nobody notices. We routinely find accounts that have outlived their owners' employment by years.
Why it gets missed
Offboarding falls between HR, who know the person is leaving, and IT, who know what the person could reach. Neither is told to talk to the other. In a small organization both roles may be the same overworked office manager, who was also organizing the leaving drinks.
The checklist
On the last day, before the leaving drinks:
- Disable the main account. Disable, not delete. You will want the mailbox.
- Sign out every session. Disabling an account does not always end sessions already open on a phone.
- Forward or delegate the mailbox to a named person, with an end date.
- Remove them from shared vaults in the password manager, and rotate anything they could see.
- Collect the hardware. Laptop, phone, door fob, the USB drive.
- Go through the list of everything else.
That sixth item is the hard one.
The list of everything else
Every organization has systems that are not connected to the main login: the bank, the payroll portal, the domain registrar, the social media accounts, the alarm company. The only defense is a list, kept current, of who has access to what.
| System | Typical owner | Usually forgotten? |
|---|---|---|
| Email and files | IT | Rarely |
| Accounting software | Finance | Sometimes |
| Banking | Directors | Often |
| Domain registrar | Whoever set it up in 2012 | Almost always |
| Social media | Whoever was youngest at the time | Almost always |
If the list does not exist, the best time to write it is during a calm week. The second-best time is during the exit interview, with the person who knows.
When the departure is not friendly
Do steps one and two before the conversation, not after it. It feels distrustful. It is also the single piece of advice on this page that people most regret not having taken.
If you would like us to build the list with you, that is part of onboarding.