When someone leaves your company, there’s a checklist everyone remembers: collect the laptop, get the key card, forward the email. And there’s a checklist almost nobody has — the one that actually protects your business.
Here’s the uncomfortable truth: the most common security gap we find in small businesses isn’t malware or a weak firewall. It’s active accounts belonging to people who don’t work there anymore. Not because anyone was careless — because nobody wrote down what to shut off.
So here’s the list. Print it, save it, hand it to whoever runs offboarding.
The same-day list
These happen before the person’s last day ends:
Email. Don’t delete the account — you may need the history. Disable sign-in, set up forwarding to a manager, and set an auto-reply with the new point of contact.
Password manager and saved passwords. If they used a company password manager, remove their access. If they saved work passwords in their personal browser (most people do), change the passwords for anything important they touched.
Core business apps. Accounting software, CRM, project management, scheduling — anything with client data or money in it. Disable or transfer the account.
Remote access. VPN, remote desktop, any way of reaching your systems from outside. This one gets forgotten constantly and matters most.
Phone and text. If clients have their cell number, decide today who inherits those relationships — before clients decide for you.
The same-week list
Shared drives and cloud storage. Transfer ownership of their files and folders. If they owned a shared folder and you delete the account outright, everyone can lose access — transfer first, disable second.
The apps you forgot exist. Here’s the hard one. Ask their teammates: what tools did this person use? The free design tool, the file-sharing app, the AI assistant. Every business has these (it’s called shadow IT), and you can’t shut off what you don’t know about.
Recurring payments and vendor contacts. If their card or name is on any subscription or vendor account, update it now — not when a renewal fails in three months.
Personal devices. If they had company email on a personal phone, remove it. Most business email systems can do this remotely without touching their personal data.
The one-time fix that makes this easy forever
Notice what makes this checklist hard: not the shutting off — the knowing what exists. Businesses that keep a simple, living list of every system, app, and account (and who has access) turn offboarding from an archaeology project into a 20-minute task.
If you don’t have that list, that’s the real to-do. And if you’re not sure where you’d even start, that’s exactly what our free IT health check covers. Here’s how it works:
- You book a time. Takes two minutes.
- We take a look. About 30 minutes, at your place or remotely.
- You get the honest picture. Every account, every app, every gap — what’s fine, what’s not, what to do about it.
