Employee Offboarding: The IT Checklist Most Small Businesses Skip
Most small businesses have some kind of plan for a new hire's first day. Very few have one for the last day. Someone gives notice, the team says goodbye, and nobody remembers to shut off the email account, the shared drive access, or the phone that still has client files on it. Weeks or months later, that account is still active and nobody is watching it. Here is a checklist that closes those gaps.
Why offboarding is where access leaks
Every employee collects access over time. Email, file storage, accounting software, the client portal, a shared password, a company phone. Nobody keeps a complete list, so nobody knows what to turn off.
An old account that stays active is a risk even when the person left on good terms. Their password may be reused somewhere else. Their phone may be lost. Their login may get phished months after they are gone. Nobody notices because nobody is looking.
Before the last day
Offboarding goes smoothly when someone owns it. Pick one person, usually the office manager or your IT provider, and give them the job.
- Get the departure date in writing and tell IT as soon as you know it.
- Decide who takes over the person's email, files, and open client work.
- List every system the person used. Start with your onboarding checklist and add anything they picked up since.
- Check whether the person is the only one who knows a password, a vendor login, or an admin setting.
On the last day
- Disable the Microsoft 365 or Google Workspace account. Disable it first, delete it later. You may need the data.
- Reset the password and sign the person out of all active sessions, including phones and tablets.
- Remove multi-factor authentication methods tied to their personal phone.
- Set up email forwarding or a shared mailbox so client messages do not disappear.
- Transfer their files and OneDrive or Google Drive contents to their manager.
- Collect the laptop, phone, badge, keys, and any external drives.
- Remove the person from shared mailboxes, distribution lists, and Teams or Slack channels.
- Remove access to your remote desktop, VPN, or any other way into the office network.
The accounts people forget
The main systems are easy to remember. The side doors are where problems start.
- Line-of-business software such as tax, accounting, practice management, or payroll platforms. These often have their own logins that Microsoft 365 does not control.
- Shared passwords for vendor portals, bank sites, or social media accounts. If the person knew it, change it.
- Third-party tools they signed up for, such as file-sharing services, e-signature tools, or AI tools using a work email.
- The company website, domain registrar, and hosting accounts.
- Company credit cards, expense tools, and subscription billing.
- Personal devices that have your email or files on them. Remove the business data from them.
The first 30 days after
- Keep an eye on the disabled account for sign-in attempts. Any activity is worth a look.
- Check that forwarding and delegated access are working and that clients are getting answers.
- Delete the account and recover the license once you are sure nothing else is needed.
- Update your list of who has access to what, so the next offboarding is easier.
When the exit is not friendly
If someone is let go or leaves on bad terms, do not wait for the last day. Cut access at the moment the conversation ends, not after. Have IT ready to disable accounts while the meeting is happening.
Change any shared passwords the person knew right away, and check for unusual activity in the days before they left, such as large file downloads or forwarding rules sent to a personal address.
A written offboarding checklist takes about an hour to build and saves you from the kind of cleanup nobody wants to do later. If you are not sure who has access to what in your business today, that is worth finding out before the next person leaves. We help small businesses across the Chicago area put this kind of process in place.
Questions about your IT setup?
We work with small businesses and accounting firms across the Chicago area. Start with a free CPA Cybersecurity & IT Risk Review and we will tell you honestly what we see.