What Happens to IT When an Employee Leaves? The Offboarding Checklist

An employee hands in their notice. HR sorts the paperwork, the team organises a farewell lunch, and two weeks later they walk out the door. But what about their IT access? In many Brisbane businesses we work with, the answer is uncomfortably vague.

The Risk of Incomplete Offboarding

A former employee with active credentials is a significant security risk, whether the departure was amicable or not. Active email accounts can be used to impersonate the person. Active cloud access means they can still reach company files. Shared passwords that were never changed remain compromised.

We have seen cases where former employees retained access to company systems for months after leaving, simply because nobody remembered to revoke it.

The IT Offboarding Checklist

On the employee's last day or immediately after, work through this list:

Disable their email account and set up forwarding or an auto-reply directing contacts to the right person. Do not delete the mailbox immediately as you may need access to their correspondence.

Revoke access to all cloud services including Microsoft 365, Google Workspace, accounting software, CRM, project management tools, and any other platform they used.

Change any shared passwords they had access to, including Wi-Fi, shared mailboxes, social media accounts, and vendor portals.

Collect or remotely wipe company devices including laptops, phones, and any personal devices that had company email or data.

Remove them from any VPN or remote access tools.

Review and remove their access to shared drives, SharePoint sites, and Teams channels.

Automate What You Can

If you are using Microsoft 365 or Google Workspace, much of this can be streamlined. Disabling the account centrally cuts off access to email, OneDrive, SharePoint, and Teams in one step. A managed IT provider can handle the entire process in under an hour, ensuring nothing gets missed.

For businesses with frequent staff changes, having a documented offboarding procedure saves time and reduces risk every time.

Do Not Forget About Shared Accounts

Many small businesses have shared logins for social media, industry portals, supplier accounts, or even bank access. These are the credentials most often overlooked during offboarding. Maintain a central record of all shared accounts and update passwords as part of every departure.