Offboarding is a same-day checklist, not a week

The claim

When someone leaves your company, every account they could reach should be closed or transferred before the end of their last day — and for an involuntary departure, within the hour. Most small businesses take one to three weeks, not out of negligence but because nobody can produce the list of what the person had access to. The control that matters is therefore not the revocation procedure. It is maintaining the list before you need it.

Why the gap is dangerous even with good people

Set aside malice; it is rare. The ordinary failures are worse because they are certain. A former employee's laptop still syncs the shared drive, so a folder they delete while tidying their own files disappears for everyone. Their phone still receives customer email through an app nobody thought about. Eight months later, their reused password from an unrelated breach unlocks your CRM, and nobody notices because the account is active and its activity looks normal. None of these require a hostile actor — only an account that outlived its owner.

The access register

One shared document, four columns: person, system, permission level, how access was granted (SSO, direct account, shared credential, API key). Update it when access is granted, which is the only moment anyone actually remembers. Thirty minutes to create, two minutes per change to maintain, and it converts offboarding from an investigation into a checklist.

While building it you will find the real problems: the shared "info@" mailbox password known to six people, two of whom left last year; the payment processor with a single owner login; the API key created in 2023 that three integrations depend on and no one dares rotate.

The same-day sequence

1. Identity provider first. Suspend the SSO account and every session dies with it. This is the argument for putting every service behind SSO that supports it: one action covers forty systems. Order matters — do this before the exit interview for involuntary departures.
2. Direct accounts second, from the register: the tools that never got behind SSO, the registrar, the bank portal, the courier account.
3. Rotate what cannot be revoked. Shared passwords the person knew, API keys they could read, the Wi-Fi passphrase if you still run one network for everything. Rotation, not hope, is the control for shared secrets.
4. Redirect, do not delete, their mailbox. Forward to their manager for 90 days, set an auto-reply naming the new contact, then archive. Deleting the mailbox on day one orphans every customer thread and every password reset tied to it.
5. Recover or wipe devices. A remote-wipe capability you set up in advance — built into every major fleet management tool — is the difference between "the laptop is somewhere" being an errand and being an incident.
6. Check the invisible grants: OAuth applications authorised on the company workspace, mailbox delegation rules, calendar delegations, and forwarding rules the person created. These survive password changes and are the most commonly missed item on this list.

Verify, because revoked is a claim

The day after, run the check rather than trusting the checklist:

# Any sign-in activity on the suspended account?
# Any mail forwarding rules pointing outside the domain?
# Any active sessions or app passwords remaining?

Every major identity platform exposes these as admin reports or API calls. Ten minutes, and twice a year you will find something — usually a forwarding rule or a mobile session that survived.

The quarterly review closes the loop

Once a quarter, pull the user list from your five most important systems and diff it against the payroll list. Every mismatch is either a departed person with live access or a service account nobody owns, and both deserve a ticket. The first review typically finds three to six of these; later ones find one or none, which is the point.

What this costs and what it replaces

The register, the checklist, and the quarterly diff amount to perhaps ten hours a year for a fifty-person company. Set against it: the average departed-but-active account persists undetected for months, holds the same permissions its owner had on their busiest day, and is exactly what an auditor, an insurer, or a privacy regulator will ask about first after any incident. This is the cheapest risk reduction available to a business your size, and it requires no new software — only the admission that memory is not an access control system.