Offboard a departing employee without leaving doors open

By the end of this guide, you'll have a one-page offboarding checklist for your business, and the next time someone leaves, every account, password and device they used will be closed off or handed over on their last day.

Who it's for

Owners and office managers of small businesses who handle IT themselves, with Google Workspace or Microsoft 365 and a handful of other online services. You'll need admin access to your email system and an hour to build the checklist; using it takes less than an hour per person.

Why bother: a former employee's account that still works is an open door, whether they use it or someone who stole their password does. And deleting an account too quickly can destroy email and files the business still needs.

Steps

1. List every system someone might have access to

   Write down everything a typical employee signs in to: email, file storage, accounting, the website, social media, the bank, suppliers' portals, the phone system, the alarm code and physical keys. Ask two or three staff what they use; there's always something you didn't know about. This list is your checklist.

2. Suspend email and sign-in on the last day

   At the end of their last day (or right away, if the departure isn't friendly), suspend or block sign-in on their Google Workspace or Microsoft 365 account rather than deleting it. In the admin console, also sign them out of every session, remove their two-step sign-in devices, and remove any admin roles.

3. Hand over their email and files

   Give their manager access to the mailbox, or set up forwarding, and set an automatic reply pointing customers to a new contact. Transfer ownership of their files and shared folders. Only delete the account, and free up the licence, once nothing needed is left in it, often after 30 to 90 days.

4. Change every shared password they knew

   Remove them from shared vaults in your password manager, then change the passwords in those vaults, starting with the bank, the domain registrar and social media. Change the office Wi-Fi password and the alarm code if they had them.

5. Go down the rest of the list

   Remove or disable their account in each remaining service on your list. Watch for services they signed up for with their work email that you didn't know about: search their mailbox for "welcome" and "verify your email" messages. Collect laptops, phones, keys and badges, and remove company email from their personal phone.

6. Check again a month later

   Put a reminder in your calendar for 30 days later. Look at the sign-in reports in your admin console for any attempts on their account, check nothing is still being forwarded to them, and add anything you missed to the checklist for next time.

Common mistakes

• Deleting the account straight away. Their email, files and calendar may hold contracts, invoices and customer history. Suspend first; delete once everything has been handed over.
• Forgetting shared passwords. Removing someone from a vault doesn't make them forget what they saw. Change the passwords themselves.
• Missing services nobody listed. Free tools signed up for with a work email are the most common leftover. The mailbox search in step 5 finds most of them.
• Leaving company email on a personal phone. Sign them out of every session in the admin console, and use your email system's mobile management to remove the account from their phone if you have it.
• Doing it from memory. Without a written checklist, each departure misses something different. Keep the list and update it every time.