For a London SME, IT onboarding is often the step that delays a new starter’s first productive week. A new hire who waits a day for a laptop or a working login costs the business time, and the manager who fills the gap is taken away from client work. The first week also carries security exposure. Temporary passwords, shared logins and copied permissions can remain in place for months if nobody reviews them. A structured process reduces both problems.
Table of Contents
- Quick Takeaways
- Why Delayed Setup Costs More Than Time
- Building a Pre-Arrival Checklist
- Securing Accounts from the First Login
- Device Handover and First-Week Support
- Choosing an Onboarding Model
- Keeping Records Current After Each Hire
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Start provisioning when the offer is accepted | Accounts, devices and licences should be ready at least three working days before the start date, not on the morning of it. |
| Grant access by role template | Each job title should have a fixed list of systems and folders, so access is consistent and easy to review. |
| Enforce multi-factor authentication from the first sign-in | New accounts should never rely on a single temporary password that stays in use. |
| Eliminate shared logins | Shared credentials make it impossible to trace actions to individuals and complicate leaver processes. |
| Name one owner for each hire | A single accountable person prevents duplicated requests and gaps between HR and IT. |
| Hold a first-week support check | A short review on day three or five identifies access problems while they are still easy to fix. |
Why Delayed Setup Costs More Than Time
A payroll provider’s review of onboarding practice reports that employees who go through a structured onboarding process are 69% more likely to stay with a company for three years. The figure reflects a US employer context, but the underlying point applies in London. Early attrition is often linked to a disorganised first week rather than the role itself.
In practice, the cost of delay is rarely a single line item. An unproductive new hire, a manager diverted to resolve login problems and a poor first impression all add up. Owners who outsource IT often find that the gap lies in coordination rather than technical skill.
Where the Delay Usually Starts
Most delays begin at the handover between HR and IT. The offer is accepted and the start date is confirmed, but no one raises a request for the account, device or software licence until the employee arrives. A common mistake is treating IT setup as a day-one task rather than a dependency of the hiring process. Once the request is logged at offer stage, most of the wait disappears.
Building a Pre-Arrival Checklist
A written checklist, owned by one named person, is the most effective single change most SMEs can make. It should be triggered by the signed offer rather than the start date. Each task should show an owner and a due date.
Accounts, Devices and Licences
Create the identity account, mailbox and licences the role requires, such as Microsoft 365 applications and line-of-business software. Configure the device, enrol it in device management and confirm that the build meets your security baseline before handover. Each item should be completed before the start date, so the first morning is spent on work rather than configuration.
Right-to-Work and HR Records
Right-to-work checks and employment records are HR obligations that should be completed before the start date. IT should not provision access until eligibility is confirmed, so the checklist should include a sign-off point between the two functions. Some onboarding guidance refers to US forms and state reporting rules. These do not apply to UK employers, so London businesses should work from UK requirements.
Pro tip: Keep the checklist in a shared document with three columns for task, owner and status. Review it at offer stage and again two working days before the start date.
Securing Accounts from the First Login
Security risk in onboarding usually comes from temporary shortcuts that become permanent. A generic password sent by email, a shared mailbox used by two team members or an administrator right granted for convenience are typical examples. Each is quick to create and difficult to trace later.
Multi-Factor Authentication and Unique Passwords
Require multi-factor authentication for every new account before access to email or files is granted. Issue temporary credentials through a separate channel from the username, and require a password change at first sign-in. No account should remain in use with a shared or default password.
Role-Based Access Templates
Access should follow a template for each job title, listing the systems, shared folders and licences the role needs. Granting access by copying an existing employee’s permissions often carries forward rights the new hire does not need. Templates should be reviewed whenever a role changes.
Access granted for convenience on day one is rarely reviewed, and it is usually the last permission removed when someone leaves.
Pro tip: Record every administrator account by name in a register. Review it each quarter and remove any access that no longer matches a current role.
Device Handover and First-Week Support
The handover should be a short, supervised session rather than a device left on a desk. By the end of the first day, the new starter should be able to sign in, open core systems and know who to contact when something fails. Our experience is that a planned handover prevents most repeat queries in the first week.
A Short First-Week Check
Schedule a brief check on day three or five. Confirm that email, file access and line-of-business tools work, and that any outstanding requests have been logged. Problems found in week one are considerably cheaper to fix than those discovered during a client deadline.
One Route for Support Requests
Provide a single support route with a defined response target, so new staff do not ask three colleagues the same question. Agreed service levels set expectations for the business as well as the employee. iTO.London provides this as part of its managed IT service, with a rapid response helpdesk and a documented process for each new starter.
Choosing an Onboarding Model
Three approaches are common among London SMEs. The right choice depends on hiring frequency, the number of people with IT responsibility and the level of risk the business accepts when access is wrong. The table below compares them.
| Approach | Where It Works | Where It Falls Short |
|---|---|---|
| Owner-led setup | Very small teams that hire rarely and have an owner who knows the systems well | Setup depends on one person’s availability, and access is seldom reviewed |
| Ad hoc support requests | Businesses with an internal IT contact who can handle requests within a working day | Steps vary from hire to hire, and security controls depend on individual memory |
| Managed IT onboarding | Growing teams that need repeatable steps, defined service levels and periodic access reviews | Requires a written process and a provider accountable for following it |
In practice, the managed model suits SMEs that want an outsourced IT department to own the checklist, the role templates and the audit trail. Organisational differences between smaller and larger firms are discussed in the references listed below. Businesses with an internal IT lead can still adopt the same template structure.
Keeping Records Current After Each Hire
Onboarding records should be kept current because they become the starting point for offboarding. An account created without a documented role, owner and access list is difficult to remove accurately when the employee leaves or changes role.
Documenting the Access Granted
Keep a record for each starter listing the accounts, devices, licences and shared folders issued, together with the date and approver. This supports the accountability principle in UK GDPR for personal data held in business systems, and it provides a clear baseline for leaver checks.
Reviewing Access After Probation
Review access at the end of the probation period, or at three months where no probation applies. Remove rights granted on a temporary basis and confirm that the role template still matches the job. A common mistake is treating onboarding as complete once the laptop has been delivered.
Frequently Asked Questions
How far in advance should IT setup begin for a new starter?
Setup should begin when the offer is accepted. Accounts and devices should be ready at least three working days before the start date, which leaves time to resolve any configuration problems.
Is IT onboarding only necessary for larger businesses?
No. Small teams can be more exposed, because a single shared password or administrator account can affect the whole business. A documented process protects a small team in the same way it protects a larger one.
What does managed IT staff onboarding usually include?
It typically covers account creation, device build, access based on role templates, enforcement of the security baseline, a first-week check and a record of what was granted. The exact scope should be stated in the service agreement.
Who should own the onboarding checklist?
One named person should own the checklist, usually the office manager or HR lead, with IT responsible for the technical steps. Ownership should be written down so that responsibilities are clear.
How does structured onboarding reduce security risk?
It replaces temporary shortcuts with enforced multi-factor authentication, unique credentials, role-based access and a register of what was granted. Access can then be reviewed and removed when roles change.
We welcome feedback from London business leaders on how their current onboarding process works and which steps have proved hardest to standardise.
We would love your feedback and any insights you would share with others. What perspective would you add?
References
- Employee onboarding best practices for small businesses, including retention and compliance deadlines
- Ten onboarding best practices for a smooth employee start
- How HR differs between SMEs and large businesses in strategy and structure
- Key differences between SME and large enterprise structure, speed and strategy