When an Employee Leaves, Who Still Has Access to Your Business?

When an Employee Leaves, Who Still Has Access to Your Business?

An employee turns in their laptop, hands over the office keys, and leaves the company. From the business owner's perspective, the departure is complete. But what about the employee's access to email, cloud files, customer records, accounting tools, remote connections, and shared passwords?

In a small business, those details can be spread across several people and vendors. That makes employee departures a technology issue as much as an HR issue.

The Accounts Nobody Remembers

Consider a growing local business with fifteen employees. A longtime office manager moves on after several years. The company disables the person's main email account and collects the laptop. A few weeks later, someone realizes the former employee also managed the online scheduling system, had access to a shared cloud drive, knew the password for a vendor portal, and used a personal phone for work-related authentication. There may be no evidence of wrongdoing. That is not the point.

The business simply does not have a complete picture of who can access what. A normal staffing change has exposed a weakness in how technology is managed.

Access Should Follow the Job

The best time to think about employee access is before someone leaves. When a new employee joins, someone should decide which systems the role requires. When responsibilities change, those permissions should be reviewed. When the employee leaves, the business should have a reliable way to remove access across the systems involved.

This is often called the employee access lifecycle, but the business principle is simple. People should have the access they need for the work they do, and no more than necessary. That applies to employees, contractors, outside bookkeepers, marketing agencies, and technology vendors.

Shared accounts make this harder. When several people use one login, it becomes difficult to tell who did what or to remove one person's access without affecting everyone else.

Build a Departure Checklist That Actually Works

A practical checklist should cover more than returning equipment.
-Identify the applications and accounts the person used.
-Disable or transfer access at the appropriate time.
-Review shared credentials and authentication methods.
-Transfer ownership of important files, calendars, vendor relationships, and recurring processes.
-Confirm that company information remains available to the people who need it.

The timing matters. Some departures are planned and cooperative. Others require immediate action. HR, management, and whoever supports the company's technology should agree on the process before a difficult situation arises.

Just as important, avoid deleting an account before preserving business records that may still be needed. The goal is to protect access while maintaining continuity.

A Small Process With a Big Payoff

An access review is not only about preventing a former employee from signing in. It can reveal software subscriptions nobody uses, accounts owned by one person, missing documentation, and important business processes with no backup owner. For a small business, that is valuable information. It improves security, reduces confusion, and makes future staffing changes easier. Ask your technology provider a straightforward question, “If someone left our company tomorrow, could we identify and remove every account they can access?”

If the answer is uncertain, you have found a useful place to start. Good cybersecurity is not always a new product. Sometimes it is a repeatable business process that closes a gap before it becomes a problem.