When someone leaves your company, there is a lot to manage. Exit interviews, final paychecks, returning equipment, updating the org chart. HR has a process for most of it. But there is one step that consistently falls through the cracks – and it’s one of the most important ones.
Why IT Employee Offboarding Gets Skipped
The reality in most small businesses is simple: HR owns the offboarding process, and IT is an afterthought. Someone gives their notice, the paperwork gets done, and by the end of the last day the focus has already shifted to finding a replacement.
Meanwhile, email accounts stay active. Software logins go unrevoked. Shared passwords never get changed. And a former employee – whether they intend to or not – still has a key access to your business.
The Risk is Bigger Than You Think
Research from isDecisions found that 1 in 3 former employees still have active access to company systems after their last day – and that figure has remained consistent over multiple years of study.
In a federal lawsuit filed in 2025, former employees at a fire safety company allegedly logged into secure business platforms after resigning, downloaded thousands of customer records and proposals, and shared credentials with a direct competitor – resulting in over $1 million in claimed losses. (Threatlocker, August 2025)
The threat is not always malicious. But whether it is an accident or intentional, the exposure is real.
The IT Offboarding Checklist
Use this checklist every time an employee leaves your organization.
Accounts & Credentials
- Disable the employee’s company email account on their last day
- Revoke access to all cloud-based platforms (Microsoft 365, Google Workspace, etc.)
- Change any shared passwords the employee had access to
- Remove multi-factor authentication devices tied to their profile
- Disable VPN and remote access credentials
Devices & Hardware
- Collect all company-owned devices: laptops, phones, tablets, and USB drives
- Remotely wipe any device that cannot be physically recovered
- Revoke certificates tied to company devices
- Remove the employee’s device from your mobile device management (MDM) system
Software & Application Access
- Audit every software tool and SaaS application the employee used
- Revoke licenses and logins for each platform individually
- Reassign any accounts the employee managed on behalf of the business (social media, billing, vendor portals)
- Remove the employee from any shared project management or communication tools
Shared Resources & Internal Systems
- Remove access to shared drives and internal file storage
- Revoke permissions in any CRM, ERP, or business management platform
- Update any shared calendars or resource accounts
- Audit admin-level permissions – former employees should never retain elevated access
Who Owns the Employee Offboarding Process?
This is the most important question. If the answer is “I’m not sure,” that is your answer.
Every business needs a clearly defined owner for IT offboarding – someone who is notified the moment a departure is confirmed and who is responsible for working through this checklist before the employee’s last day. In most small businesses, that means looping in your IT partner or managed service provider as a standard part of the HR exit process.
How Often Should You Audit Access?
Even with a solid employee offboarding process, access audits should happen regularly. Staff transitions, role changes, and forgotten accounts can create gaps over time. A quarterly review of who has access to what – and whether they still need it – is a simple habit that dramatically reduces your organization’s risk.
Make It a Process, Not an Afterthought
Employee offboarding is not just an HR function. It is a security function. The good news is that it does not require a large budget or a complicated system – it just requires a process that everyone follows, every time.
If you are not sure whether your current employee offboarding covers the IT side, that is wroth finding out before it becomes a problem.
Macatawa Technologies helps West Michigan businesses build the processes and protections that keep their technology secure – even when things change.
Reach out to start the conversation.
