Offboarding an Employee Securely in a Small Business

A bookkeeper leaves a seven-person firm on good terms. Four months later, the owner notices that her login to the accounting software still works, the shared mailbox still forwards to her personal address, and she is still an admin on the company's social media page. Nothing bad happened. But for four months, the business was trusting that it would not.

Offboarding an employee securely is one of the cheapest security wins a small business can make, and one of the most skipped. Large companies have identity systems and IT teams that switch everything off on the last day. A small business usually has a spreadsheet, a few shared passwords and good intentions. This guide gives you a practical checklist that takes about an hour per departure, whether the person is leaving happily or not.

Why Former Staff Accounts Are a Real Risk

Most former employees never misuse their old access. The bigger risks are quieter. An account that nobody watches is an easy target for attackers, because unusual activity goes unnoticed. If the former employee reused that password elsewhere and it leaks in a breach, criminals can walk straight into your systems.

There are also practical problems. Invoices keep going to an inbox nobody reads. A supplier portal is locked because the only admin has left. A domain registration expires because the renewal emails go to someone who no longer works there. Offboarding protects against all of these at once.

Start With an Access Inventory Before Anyone Leaves

You cannot remove access you do not know about. The best time to build an inventory is before you need it, and it only takes one afternoon.

Create a simple table for each person with every system they use. Include the obvious ones and the forgotten ones:

Email, calendar and file storage
Accounting, payroll and banking
Customer management, booking or point-of-sale systems
Website, domain registrar and hosting
Social media and advertising accounts
Supplier and wholesale portals
Physical items: keys, alarm codes, door cards, company laptops and phones

Mark which accounts are personal logins and which use a shared password. Shared passwords are the hardest part of offboarding, which is one reason a team password manager helps so much, as explained in why a password manager is the best security upgrade.

The Offboarding Checklist for the Last Day

Work through these steps on the employee's final day, ideally in the last hour or straight after they leave.

Step	Action	Why
1	Disable their main email and single sign-on account	This often cuts off many connected apps at once
2	Revoke logins for every system on their inventory	Catches apps with separate accounts
3	Change every shared password they knew	Disabling an account does not change a shared secret
4	Remove them from admin roles on social and ad accounts	Admin roles are often separate from logins
5	Sign out their active sessions and remove their devices	Existing sessions can stay active for days
6	Collect laptops, phones, keys and cards	Physical access is still access
7	Change alarm codes and door codes they used	Codes are rarely changed otherwise

Step five is often missed. Many cloud services keep a user signed in on a phone or browser even after the password changes, unless you sign out all sessions from the admin panel.

Do Not Delete the Account Straight Away

A lot of security advice says to delete a departing employee's account immediately. For small businesses, this often causes more damage than it prevents.

Deleting an email account can permanently remove years of customer conversations, invoices and contracts. Deleting a file storage account may wipe documents that only existed in that person's folders. Some services give you only a short recovery window, after which the data is gone.

The safer sequence is:

Disable the account on day one, so nobody can sign in.
Transfer email, files and ownership of shared documents to a manager within the first week.
Forward incoming email to a colleague, and set an auto-reply naming the new contact.
Delete the account only after 30 to 90 days, once you are sure nothing important remains.

Disabling gives you all the security benefit with none of the data loss.

One more detail: keep paying for the disabled licence until the transfer is complete. Saving a few dollars by cancelling the seat early is how many small firms lose a mailbox they later need for a tax question or a customer dispute.

Handle Difficult Departures Differently

When someone is dismissed or leaves after a dispute, timing matters. Revoke access during or just before the conversation, not afterwards. Plan it in advance with whoever manages your systems, and have a list ready so it takes minutes, not hours.

Avoid announcing the departure on group chats before access is removed. Check recent activity logs where available, such as large file downloads or forwarding rules created in the last few weeks. A new forwarding rule sending email to an outside address is a common warning sign worth investigating.

Stay calm and professional. The goal is protecting the business, not punishing the person.

Make Offboarding Part of Your Normal Routine

The businesses that handle this well do it the same way every time. Keep the checklist in a shared document and assign one person to own it. Review the access inventory twice a year, removing tools you no longer use and adding new ones.

It also helps to limit what each person can reach in the first place. If a part-time assistant only needs the booking system, they should not have admin access to the bank. Smaller footprints make offboarding faster and reduce the damage if any account is compromised. This fits into the broader habits described in security a small team can actually follow.

Finally, remember the departing person's own two-factor devices. If their phone was the only backup for a shared admin account, reassign it before they go, or you may lock yourself out. Storing recovery options properly is covered in where to keep 2FA backup codes.

FAQ

How quickly should I remove a former employee's access?

On their last working day, ideally within an hour of them leaving. For difficult departures, remove access before or during the final conversation.

Do I need to change passwords if the person left on good terms?

Yes. Changing shared passwords is about closing gaps, not about trust. Their old password could leak from a different breach at any time.

What about freelancers and contractors?

Treat them exactly the same as employees. Contractors often have access to many clients' systems at once, which makes stale accounts more risky, not less.

Your Next Step

This week, build the access inventory for your current team, even if nobody is leaving. List every system, mark shared passwords, and save the seven-step table as your standard checklist. The next time someone hands in their notice, you will close every door in an hour instead of discovering open ones months later.