The same-day offboarding checklist

A former employee's login that still works is one of the most common weaknesses in a small firm, and one of the easiest to fix. Most of the time nothing bad comes of it. When something does, it's hard to explain to a client why a person who left in March could still read their file in June.

Use this list on the day someone leaves. It applies to seasonal and temporary staff too.

Before they go

• Agree the time access ends. For a planned departure, that's the end of their last day. For a difficult one, it's before the conversation finishes.
• Decide who takes over their clients, their mailbox and their files.
• Collect what belongs to the firm: laptop, phone, security key, door key or access card.

Accounts, in this order

1. Email. Block sign-in first. Then forward new mail to whoever is taking over, and set an automatic reply with the new contact. Don't delete the mailbox yet; you'll likely need what's in it.

2. Your main sign-in. If the firm uses one account to reach many systems, disabling it closes most doors at once.

3. Practice management, accounting and tax software. Disable the user and reassign their open work.

4. Document storage and client portals. Remove access and transfer ownership of their files, or they may disappear when the account is deleted.

5. Remote access. Any connection that lets them reach the office from home.

6. Banking and payroll. Remove them as a user and as an approver, and tell the bank.

7. Everything else. This is where access survives: the e-signature service, the research database, the scheduling tool, shared social media logins, the AI assistant.

Shared passwords

If they knew a password that others still use, change it. The Wi-Fi, the alarm code, the shared scanner mailbox, the supplier portal. A password manager makes this far less painful, because you can see what each person had.

Their devices

• Firm computers: take them back, and wipe them before they're reused.
• Personal phones: remove the firm's email and files. This is only possible if those devices were set up to allow it, which is a reason to manage them from the start. See device monitoring and patching.

Afterward

• Check for forwarding rules in their mailbox that send mail outside the firm.
• Keep their data as long as your retention rules and client obligations require, then delete it.
• Free up the licenses once the data is safely moved.
• Write down what you did and when. Insurers and clients ask about offboarding, and a dated record is your answer.

Keep a list while they're here

Offboarding is hard when nobody knows what a person had access to. Record each account as you grant it, and the list writes itself on their last day.

We handle staff onboarding and offboarding for clients as part of Microsoft 365 and Google Workspace administration, included from the Business plan. Offboarding is also item four on our security checklist.