Effective IT offboarding for a London SME is often the weakest point in an otherwise well-managed IT environment. When a team member leaves, mailboxes, cloud file access, shared passwords and company laptops can remain live for days or weeks. Each of these is a route into company data that nobody is actively monitoring. A documented leaver process closes those routes in a planned, repeatable way, whether the departure is expected, sudden or contested.
Table of Contents
- Quick Takeaways
- Why Leaver Access Is a Security Risk
- Where Offboarding Breaks Down
- A Step-by-Step Leaver Process
- Comparing Leaver Approaches
- Ownership and Accountability
- Records, Audit Trails and Data Protection
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Remove access on the final working day | Accounts left active after departure are a common route to unauthorised access. |
| Map every system before the process starts | Email, Microsoft 365, file storage, finance tools and supplier portals each need a named owner. |
| Rotate shared credentials the leaver knew | Shared logins and service passwords remain exposed unless they are changed. |
| Revoke active sessions, not only passwords | A password change alone may not end a session that is already open. |
| Recover and reset company devices | Laptops and phones can hold cached data, saved credentials and signed-in applications. |
| Keep a dated record of every change | A written log supports audits, investigations and disputes. |
| Run each leaver through one ticket | A single owner prevents gaps between HR, line managers and IT. |
Why Leaver Access Is a Security Risk
User deprovisioning is the process of revoking a person’s access once they leave the organisation or change roles. It is the counterpart to provisioning, which creates accounts and grants permissions. Deprovisioning covers far more than email. It includes company mailboxes, Microsoft 365 licences, file shares, remote access, accounting software and any device or account that can reach company data.
Accounts that are easy to miss
Most SMEs disable the obvious accounts. The gaps tend to sit elsewhere: shared social media logins, supplier portals registered to a personal address, legacy systems with local accounts, and administrator access granted for a one-off project. Each of these survives a standard email shutdown unless someone lists it in advance.
Orphaned accounts and why they persist
An orphaned account is one that no longer has an active owner. Identity specialist Omada notes that orphaned accounts can be used by hackers and cyber criminals, and that removing them limits exposure. Such accounts rarely trigger alerts because nobody signs in to them, which is why they go unnoticed for long periods.
An account that remains active after its owner has left is not an administrative detail. It is an access route with no one accountable for it.
Where Offboarding Breaks Down
In most SMEs, leaver processes fail at handover points rather than at the technical level. HR records the departure, the line manager informs IT late, and IT disables only the accounts it knows about. The GetApp article on UK SME employee offboarding, titled ‘Most firms have no plan’, points to the same gap between intention and practice.
The notice period gap
Notice periods create the widest window of risk. A leaver who has resigned may keep full access for the duration of their notice, and some businesses learn of the departure only on the final day. Requiring written notice to IT from the line manager at the point of resignation narrows this window considerably.
Shared credentials and personal devices
Shared passwords for supplier portals, bookkeeping software or printers are rarely recorded where IT can see them. Personal phones used for work email, and laptops never registered with the business, present similar problems. Credential rotation and device recovery should be fixed steps on the checklist, not separate tasks.
A Step-by-Step Leaver Process
A workable leaver process has three stages, each with a named owner and a dated ticket. The order matters. Access should be confirmed and scheduled before the final day, reduced on that day, and checked again after departure.
Before the final working day
Confirm the leaver’s systems from the asset register and access records, not from memory. Identify shared credentials they know, data they own and any mailbox or files that must be handed to a colleague. Agree the removal time with HR and the line manager and record it on the ticket.
On the final working day
Disable sign-in to the directory and Microsoft 365, revoke active sessions and tokens, remove the account from groups and shared mailboxes, and collect company devices. A password change alone does not end a session that is already open, so session revocation should be a defined step.
Pro tip: Convert the leaver’s mailbox to a shared or retained mailbox before its licence is removed, so business correspondence remains available without keeping the former employee’s sign-in active.
After the departure
Rotate the shared credentials the leaver knew, review sign-in logs for activity after the departure date, and close the ticket with a written record. Each completed leaver case should feed back into the checklist.
Comparing Leaver Approaches
SMEs usually choose between three approaches. The table compares them against the outcomes that matter most to a business owner: consistency, speed and evidence.
| Approach | Strengths | Limitations |
|---|---|---|
| Manual checklist held by an office manager | Low cost and simple to start | Depends on one person remembering every system, so gaps grow as the business grows |
| Ticket-based process owned by IT | Clear audit trail and named accountability | Depends on HR and managers raising the ticket on time |
| Automated deprovisioning through a directory or identity platform | Removes access consistently across connected systems | Requires connected applications and set-up effort, and systems outside the directory still need manual steps |
In practice, the most reliable option combines a ticket-based process with automation for connected systems. Manual steps remain necessary for shared credentials and legacy applications.
Ownership and Accountability
An offboarding process fails when nobody owns it from start to finish. HR often holds the leaver date, managers hold knowledge of local systems, and IT holds the access. One named owner should hold the ticket from notice to closure.
Defining responsibilities between HR, managers and IT
A one-page responsibility matrix works well. HR confirms the leaver date and raises the ticket. The line manager lists systems and shared credentials. IT carries out the removals and signs off the record. Each step should have a deadline stated in working days rather than as soon as possible.
Where an outsourced IT department fits
Many London SMEs do not employ a full internal IT team. In these cases, an outsourced IT department can hold the leaver ticket, maintain the system register and run periodic access reviews, so that stale accounts are found before a departure rather than after it.
Records, Audit Trails and Data Protection
Records serve three purposes. They show that access was removed promptly, they support investigations if data is accessed after a departure, and they help the business meet its obligations under UK data protection law. UK GDPR requires organisations to take appropriate measures to protect personal data, and uncontrolled access to customer or staff records can count against that obligation.
What a leaver record should contain
Each record should list the leaver’s name, final working day, accounts and devices removed, shared credentials rotated and the engineer who signed off the case. Store it with the ticket so that it can be produced quickly when needed.
Reviewing access after the event
Compare the active user list in the directory against payroll or the HR system at regular intervals. This catches accounts that never passed through the leaver process, such as contractor logins or test accounts.
Pro tip: Mismatches between the directory and the HR system usually point to a missed leaver. Treat each one as a security event until it has been explained.
Frequently Asked Questions
How quickly should access be removed after an employee leaves?
Access should be removed on the final working day at the latest. Where the departure is contested or the role held sensitive access, removal should occur earlier, and the timing should be agreed and recorded in advance.
What is the difference between offboarding and deprovisioning?
Offboarding is the wider process, covering HR steps, equipment return, knowledge transfer and access removal. Deprovisioning is the technical step of revoking accounts and permissions within that process.
Do small businesses with fewer than ten staff need a formal leaver process?
Yes. Small teams often share more credentials and depend on fewer people, so a single departure can affect a large share of systems. A short written checklist is sufficient to begin with.
Who should own the leaver process in a London SME?
One named person should own the process end to end, typically the IT lead or an outsourced IT provider. HR and line managers should hold defined tasks within it.
Should a leaver’s mailbox be deleted straight away?
Not usually. Business correspondence often needs to remain available. The mailbox can be converted to a retained or shared mailbox in line with the business’s retention policy, while sign-in access is removed.
We would welcome your experience of leaver processes in your own business, particularly the steps that proved hardest to keep consistent.