An employee’s final day can be busy for all the obvious reasons: handovers, farewells, payroll and recruitment. But when you manage departing employees, there is another job that cannot wait - protecting access to the systems, information and customer relationships they used every day.
For a small or medium-sized business, this does not need to be an elaborate corporate process. It does need to be clear, prompt and shared between the manager, HR or office administration, and whoever looks after IT. A consistent offboarding process reduces disruption for your team while ensuring important business information stays with the business.
Why employee offboarding needs an IT process
Most staff have access to far more than an email inbox. They may use Microsoft 365, cloud storage, accounting software, job management platforms, shared passwords, customer databases, mobile apps and company devices. Even a staff member who has only worked with you for a short time may hold useful knowledge in their email, files or contacts.
The purpose of IT offboarding is not to treat a departing person with suspicion. It is to make sure the business can continue operating without gaps. You need to retain the files, conversations and access needed to serve clients, complete current work and meet record-keeping obligations.
The risk is usually unintentional rather than malicious. A former employee may continue receiving enquiries because their email is still active. A manager may discover that a quote, spreadsheet or supplier contact was saved only in a personal folder. A shared password might remain unchanged simply because nobody knew the person had access to it.
A documented process removes the guesswork at a time when managers already have plenty to handle.
Start the process as soon as notice is given
The best time to prepare for an employee’s departure is when it becomes known, not after their last day. The manager should advise the person responsible for IT as soon as practical, along with the confirmed final working date, their role and any systems or clients they manage.
That early notice allows you to plan a sensible handover. For a receptionist, this may mean redirecting email and updating the phone system. For an accounts officer, it could involve transferring access to accounting software and checking that approval workflows will still work. For a salesperson or project manager, it may mean confirming that customer records, quotes and project notes are stored in the right system rather than in an individual mailbox.
It also gives the business an opportunity to identify any access that needs to change before the final day. If the employee is moving to a competitor or leaving under difficult circumstances, access may need to be reduced earlier. That decision should be made by management based on the circumstances, not applied automatically to every resignation.
Agree on one source of truth
A simple offboarding form or checklist is often enough. It should record the person’s final day, manager, company devices, core software access, shared mailboxes, business phone number and any special responsibilities. Keep it somewhere the relevant people can access it, rather than relying on an informal email chain.
The checklist should clearly state who has authorised the departure and who is responsible for confirming each task. This is particularly useful in businesses where payroll, administration and IT support are handled by different people.
Protect accounts without losing business information
Disabling an account is not the same as deleting it. This distinction matters most in Microsoft 365 and other cloud services where email, OneDrive files, Teams chats and shared documents may be tied to an individual account.
On or immediately after the employee’s final day, their sign-in access should be blocked. This prevents further access to email, cloud files, business applications and company data. Their active sessions should also be signed out, particularly where they have used personal devices or browser-based services.
Before any account is deleted, make sure the business has dealt with the information it contains. The right approach depends on the role and your retention requirements. In many cases, the account can be retained for a defined period while email is redirected or an automatic reply is used. The mailbox may then be converted to a shared mailbox, allowing authorised staff to access past correspondence without retaining a paid user licence in some circumstances.
Automatic replies need care. A brief message confirming that the person has left and providing a general contact address is usually more appropriate than revealing personal details or internal staffing arrangements. Redirecting every message indefinitely is rarely ideal, as it can create privacy issues and leave customers relying on an address that should no longer be in use.
OneDrive and other personal work folders also need review. Transfer ownership or copy business-critical files to the correct shared location, such as a team folder or document library. This is a good opportunity to identify poor filing habits that would otherwise remain hidden until somebody needs a document urgently.
Remove access from every system that matters
Email is usually the first account people think about, but it is only one part of the job. A proper review should cover all services the employee used, including line-of-business software, cloud storage, accounting platforms, customer relationship systems, rostering tools, remote access, business phone applications and social media accounts.
For businesses with a long software list, a short register of applications and account owners is valuable. It makes it easier to see which accounts are individual, which are shared and which need an administrator to remove access. Without this record, former staff can remain listed in systems simply because no one remembers they were ever added.
Pay particular attention to administrator privileges. Some employees may have been given elevated access temporarily to install software, manage a website or assist with a project. Those privileges should be removed as part of the departure process, even if their normal user account has already been disabled.
Shared passwords require a different response. If the departing employee knew passwords for banking portals, social media, supplier accounts, Wi-Fi administration, alarm systems or other shared services, change those passwords promptly. Where possible, move these accounts into a password manager so access can be granted and removed individually rather than relying on a password known by several people.
Collect devices and secure the physical side
Laptops, mobiles, tablets, security keys, access cards and headsets are business assets, not just items to retrieve before someone leaves. Record what has been returned, its condition and whether it needs to be prepared for the next user.
A company laptop should be checked before it is reassigned. Confirm that work files have been retained, the device is still protected by security software, and the previous user’s local profile and saved browser sessions are removed. Simply changing the Windows login password is not always sufficient if applications remain signed in.
For company mobiles, remove the departing employee’s access to email and business apps, then reset and enrol the device for its next user if appropriate. If your business allows staff to use their own mobiles, remove business data through your mobile device management system where one is in place. Avoid asking staff to manually delete business information without confirming it has been done.
Physical access should not be overlooked. Collect keys, swipe cards, vehicle fobs and site access credentials, then remove access to offices, warehouses, construction sites or secure areas. This is often handled outside IT, but it belongs on the same checklist.
Keep the handover practical
A good handover is less about producing pages of notes and more about making the next person effective. Ask the departing employee to identify active jobs, key contacts, recurring tasks, upcoming deadlines and the location of essential files. Their manager should review this information rather than assuming it is complete.
Where a role involves client relationships, tell clients who their new contact will be before the former employee’s email address is switched off. For professional services, medical practices and trades businesses, this simple step can prevent missed bookings, delayed approvals and uncertainty for customers.
It is also worth checking calendars, shared mailboxes and automated rules. A rule that forwards invoices, enquiries or booking requests to an employee’s private folder can quietly interrupt operations long after they have left.
Treat sudden departures differently
Not every departure allows for two weeks of planning. In cases of immediate termination, a security concern or an unexpected absence, access may need to be removed while the meeting is taking place. Management should coordinate with IT beforehand where possible, so accounts can be disabled at the right time without alerting the employee prematurely.
In these situations, preserve information before making major changes. Do not delete mailboxes, wipe devices or remove records in haste. The business may need that information for operational, legal, employment or insurance reasons. Restrict access first, then decide what should be retained and for how long with appropriate professional advice.
Make offboarding a routine, not a scramble
The most useful offboarding process is one your business will actually follow. Review it after each departure and improve the parts that caused delays or confusion. If you repeatedly find that important files sit in personal folders, for example, that is a broader information management issue worth fixing.
For Central Coast, Newcastle and Hunter businesses without an internal IT team, an IT provider can handle the technical steps and keep an access register up to date. However, managers still need to trigger the process promptly and decide who should inherit the employee’s work.
The next time someone gives notice, do not wait until their last afternoon to think about their accounts and devices. A short conversation between the manager, administrator and IT support team can protect continuity, preserve valuable information and let everyone move on with confidence.
