Most companies have an onboarding checklist. Someone thought carefully about first impressions, set up accounts, ordered a laptop, and made sure the new hire felt welcome on day one.
Almost none of those same companies have an offboarding checklist.
And that asymmetry is costing them — in ways that don’t show up on a spreadsheet until something goes wrong.
What Actually Happens When Someone Leaves
When an employee resigns or is let go, the instinct is to manage the human side of the situation — the handover, the exit interview, the goodbye. The IT side gets handled as an afterthought, if at all.
Here’s what typically gets missed:
Accounts and access:
– Google or Microsoft account suspended but not deleted — emails still arrive and pile up
– Slack deactivated but the person is still a member of 6 external Slack workspaces
– GitHub access never reviewed or removed
– AWS or cloud console access not checked
– Third-party SaaS tools — Figma, Notion, Linear, Intercom — still accessible
Devices:
– Personal laptop still has company data synced via Google Drive or Dropbox
– MFA authentication app still on their personal phone — meaning they can still authenticate into systems
– Browser saved passwords never revoked
Credentials:
– 1Password vault access not removed (if a password manager exists at all)
– Shared admin credentials never changed
– API keys the person created still active
This isn’t a hypothetical scenario. I’ve seen every item on this list at real companies — companies with smart, well-intentioned teams who just got busy and didn’t have a process.
Why It Matters More Than You Think
The obvious risk is malicious access — a disgruntled employee who keeps their credentials and uses them. That does happen. But it’s not the most common risk.
The most common risk is the quiet one. Data sitting where it shouldn’t. Access that never expires. A former contractor who could, theoretically, still log in to your production environment.
Then there’s the regulatory angle. Under GDPR, you have obligations around data access and data retention. If a former employee has access to customer data through a personal device or account, that’s a compliance problem — even if they never use it.
And there’s the due diligence angle. If you’re going through a fundraise or an enterprise sales process and someone audits your access logs, ghost accounts are a red flag.
The Fix: An Offboarding Checklist
The good news is that this is one of the most fixable problems in IT operations. An offboarding checklist takes about two hours to build and immediately eliminates most of the risk.
Here’s a starting framework:
Identity and accounts:
– [ ] Suspend Google/Microsoft account immediately
– [ ] Remove from all Google Groups and distribution lists
– [ ] Remove Slack access
– [ ] Remove from all external Slack Connect workspaces
– [ ] Remove GitHub access
– [ ] Remove from all cloud accounts (AWS, GCP, Azure)
– [ ] Remove from password manager and rotate any shared credentials they had access to
Devices:
– [ ] Trigger remote wipe if device is company-owned
– [ ] Revoke MDM enrollment
– [ ] Remove personal device from MDM if BYOD policy applied
– [ ] Confirm company data removed from personal devices
SaaS tools:
– [ ] Remove from all SaaS tools (build a list — see your SaaS audit)
– [ ] Transfer ownership of any files, projects, or accounts they owned
– [ ] Check billing accounts — are they listed as a billing contact anywhere?
Credentials and keys:
– [ ] Rotate any API keys they created
– [ ] Change any shared passwords they had access to
– [ ] Revoke any certificates or SSH keys associated with their identity
Documentation:
– [ ] Update the asset register to reflect any returned equipment
– [ ] Document the offboarding in your HR system
– [ ] Confirm completion with a sign-off from IT and HR
Making It Sustainable
A checklist is only useful if it gets used every time. The companies that manage offboarding well are the ones who have it built into their HR workflow — not as an optional step, but as a required gate before final payroll is processed.
In practical terms, this means your HR team and IT (or IT consultant) need to work together. HR triggers the process when a resignation is accepted or a termination happens. IT completes the technical steps. Both sides sign off.
If you don’t have an internal IT person, this is exactly the kind of work a fractional IT consultant handles — building the process, running the first few offboardings, and handing over a documented workflow your team can follow independently.
The Bottom Line
Offboarding isn’t just an HR process. It’s a security protocol. And unlike most security work, it doesn’t require significant investment — just a checklist, a process, and someone to own it.
The cost of building it: a couple of hours.
The cost of not having it: potentially significant — legally, reputationally, and operationally.
Want to know where your IT stands today?
Take the free IT risk assessment at itops.zlefterov.com. It covers offboarding alongside 11 other critical IT areas and takes about 15 minutes.