When someone leaves your company, their paycheck stops that day. Their access frequently doesn’t — the email that stays live for weeks, the VPN profile nobody remembered, the design-tool login that wasn’t on anyone’s list. Every one of those is a working key in the hands of someone who no longer works for you, and it’s among the most common, most preventable exposures in small business. The fix isn’t technology; it’s a checklist, run the same day, every time, no matter how friendly the departure. Here it is.

First, before touching anything: preserve

The most common offboarding mistake isn’t leaving access open — it’s the opposite: deleting the account promptly and vaporizing the mailbox and files the business still needed. So step zero, before any access is cut: decide what to keep, and keep it. Preserve the mailbox and their OneDrive/Drive contents (in Microsoft 365, licenses and deletion timers make this a real deadline — a departed user’s data enters a countdown once the license is pulled), reassign ownership of any shared documents, sites, or systems they owned, and set a sensible auto-reply or forwarding for a transition period so client threads land with a live human. Preserve, then revoke — in that order.

The same-day list

Identity first — it’s the master key. Disable their Microsoft 365 / Google account and force sign-out of all sessions. This one move kills email, most SaaS access (if you’ve routed sign-ins through company identity — this checklist is the argument for doing so), and mobile mail. Then:

  1. Rotate what they knew. Any shared or privileged credentials they had — Wi-Fi if it’s a shared key, admin passwords, service accounts, the password manager vaults they could see. Shared credentials are exactly why shared accounts shouldn’t exist; departure day is when that policy pays or costs.
  2. Cut every remote path. VPN profile, remote gateway, remote-desktop entitlements — remote access is the classic lingerer because it’s invisible in daily life.
  3. Sweep the standalone SaaS logins. Every app not behind company sign-in: the industry tool, the shipping portal, the social accounts, the vendor sites. This is where your SaaS inventory sheet earns its keep — you can’t close accounts you never listed.
  4. Check the quiet persistence tricks. Mailbox forwarding rules and delegate access (a rule quietly forwarding to a personal address is a known move), app passwords, and any OAuth grants to personal apps.
  5. Collect and account for hardware. Laptop, phone, tablet, keys/badge, and any hardware security keys — checked against the inventory. For mobile devices with company data, remote-wipe the company portion.
  6. Update the humans and systems around them. Phone system and directory, distribution lists, building access, the client-facing contacts they owned, and any vendor accounts naming them as the authorized contact — including the bank, if they had payment authority.

Timing, and the two kinds of departure

For a routine, friendly departure: preservation prepped in advance, access cut by end of last day. For an involuntary or contentious one: access cut during the exit conversation, not after — coordinated quietly between the manager and IT beforehand. That’s not paranoia; it’s symmetry. The moment employment ends is the moment authorization ends, and doing it identically every time is what keeps it from being personal. (Contractors and vendors get the same list — temporary access has a documented habit of becoming permanent — and seasonal staff turnover is where industries like construction and accounting feel this most.)

Make it a system, not a memory

Three things convert this from good intentions into a control: a written checklist with named owners — HR triggers, IT executes, someone verifies; ambiguity about who does what is how items get skipped; a same-day service-level expectation, because offboarding lag is one of the seven numbers worth reporting to leadership — measured in hours, not “soon”; and a quarterly stale-account sweep as the safety net: pull the list of accounts that haven’t signed in for 30+ days and ask why each exists. The sweep reliably catches the one that slipped — and the vendor login from 2022 that nobody ever owned.

The bottom line

Offboarding is the rare security control with no product to buy and no gray areas: when employment ends, access ends — same day, from a written list, with the data preserved first. Businesses that run it as a checklist never think about it again. Businesses that run it from memory find out which kind of departure tests the difference.