When an Employee Leaves: A Practical IT Offboarding Checklist for Small Firms

People leave. Sometimes it’s a planned retirement with a farewell lunch, sometimes it’s a two-weeks’-notice move to a new job, and sometimes it’s a same-day decision nobody saw coming.

Whatever the reason, the IT side of a departure tends to get handled in a hurry. Someone remembers to turn off email. Someone else collects the laptop. Weeks later, you discover the person could still sign in to a vendor portal, or that their mailbox was deleted along with a year of client correspondence.

The good news: offboarding doesn’t have to be complicated. A one-page checklist, used every time, closes almost every gap. Here’s how to build one.

Why offboarding is a security issue, not just paperwork

An account that stays active after someone leaves is an open door. Most former employees would never misuse it, and that isn’t really the concern.

The bigger risk is that old accounts are quiet. Nobody watches them. If that person’s password shows up in a data leak from some other website, an attacker can try it against your email or file storage, and an unused account is the perfect place to hide.

Closing access promptly protects your clients, your firm, and frankly the former employee too. Nobody wants to be the name attached to a problem months after they’ve moved on.

The first hour: turn off access

On the day someone leaves (or the moment a sudden departure is decided), start with access:

• Disable the main account in Microsoft 365 or Google Workspace. Disable rather than delete, so nothing is lost.

• Sign them out everywhere. Both platforms let an administrator end active sessions on every phone, tablet, and computer at once.

• Remove their multi-factor sign-in methods so their phone can no longer approve logins.

• Reset any shared passwords they knew: the front desk computer, the Wi-Fi, a shared vendor login, the copier admin page.

• Turn off remote access such as VPN accounts or remote desktop tools.

If you use a password manager for shared logins, this step gets much easier: you can see exactly which shared passwords they had access to.

Don’t lose their email and files

Turning off access shouldn’t mean throwing away work. Before anything is deleted:

• Give a manager or coworker access to the mailbox, or forward new messages to someone who can respond to clients.

• Set an automatic reply letting senders know who to contact instead.

• Transfer ownership of shared documents they created, so files don’t disappear when the account eventually closes.

• Keep their data as long as your firm needs to. Many professional firms have record-keeping obligations. Decide on a retention period, write it down, and follow it consistently instead of deciding case by case.

Once the mailbox and files have a new home, you can usually convert the account to a lower-cost option or free up the license.

Get the hardware back and wipe it

Devices are where offboarding often gets messy. Make a list of everything the person had, and collect it:

• Laptop and charger

• Company phone or tablet

• Keys, access badges, and parking passes

• USB drives, security keys, or external hard drives

Before a laptop goes to the next person, have it properly wiped and reset. For personal phones that were used for work email, remove the company account and any work data, so client information isn’t left behind on a device you no longer control.

This is one place where having an IT partner who actually comes to your office pays off. For firms around the Loop, Naperville, and the western suburbs, it’s much simpler when someone can pick up the equipment, confirm it’s all there, and reset it on the spot instead of waiting on shipping boxes and guesswork.

The apps nobody remembers

Email and files are the obvious ones. The logins that slip through are usually these:

• Industry software: practice management, billing, document management, or client portals

• Vendor and supplier portals

• Banking and payment systems, including any approval roles

• Your website and domain accounts

• Social media accounts for the firm

• Scheduling, e-signature, and file-sharing tools they signed up for on their own

• AI tools they connected to company email or files

That last one is new for most firms. If an employee linked an AI assistant to their mailbox or shared drive, that connection may keep working until someone removes it. If you haven’t yet taken stock of which AI tools your team uses, our post on a simple AI approval policy for small businesses walks through how.

Tip: the easiest way to catch these is to keep a running list of every system each role uses. The list you build at hiring becomes the list you check at departure.

Planned departures vs. sudden ones

Timing changes depending on the situation.

Planned departures give you room to work. Use the notice period to hand off client relationships, move files, and document anything only that person knows how to do. Then turn off access at the end of their last day, not the next morning.

Sudden departures call for speed. Turn off access before or during the conversation, not after. Coordinate quietly with whoever handles IT ahead of time so everything happens at once, and collect equipment in person if you can.

Either way, decide in advance who is responsible for each step. Confusion is what causes gaps.

The offboarding checklist

Print this, copy it into your HR folder, or adapt it for your firm.

Before the last day

• [ ] Confirm the departure date and time access should end

• [ ] Hand off active client work and shared files

• [ ] List every system, app, and portal the person uses

• [ ] Note any shared passwords they know

On the last day

• [ ] Disable the Microsoft 365 or Google Workspace account

• [ ] Sign them out of all devices and remove multi-factor methods

• [ ] Turn off VPN and remote access

• [ ] Remove access to industry software, vendor portals, and banking

• [ ] Remove connected AI tools and third-party app permissions

• [ ] Reset shared passwords

Email and files

• [ ] Delegate or forward the mailbox

• [ ] Set an automatic reply

• [ ] Transfer ownership of documents

• [ ] Apply your firm’s retention period

Equipment

• [ ] Collect laptop, phone, keys, badges, and accessories

• [ ] Remove work data from personal devices

• [ ] Wipe and reset company devices before reuse

Afterward

• [ ] Reassign or cancel unused licenses

• [ ] Update your list of who has access to what

• [ ] Note anything that was missed and add it to the checklist

Make it repeatable

The best offboarding process is a boring one: the same steps, in the same order, every time. Pair this checklist with a matching onboarding checklist, so every new hire starts with a clear record of what they’ve been given access to. When they eventually move on, you already know what to turn off.

A managed IT partner can take most of this off your plate. With help desk support handling account changes and cybersecurity monitoring watching for unusual sign-ins, departures stop being a scramble and become routine.

Want an offboarding checklist built around your firm’s systems? Talk to our team and we’ll help you put one in place.

Frequently asked questions

How quickly should a former employee’s access be turned off?

By the end of their last day for planned departures, and before or during the conversation for sudden ones.

Should I delete a former employee’s email account?

Not right away. Disable it, give someone access to the mailbox, transfer important files, and keep the data for your firm’s retention period before deleting.

What do small firms most often forget when someone leaves?

Logins outside email: industry software, vendor portals, banking roles, social media, and AI tools connected to company accounts.