It’s no reflection on the person leaving. Doing this every time, for everyone, means nobody is singled out, and if something goes wrong later, nobody can suggest it was them.
The NCSC warns small organisations that when people leave, their accounts “often stay active without anyone noticing”, and suggests reviewing who has access every few months.
Before they leave
- Find out what they have access to. Ask them, and look in each system’s user list.
- Find anything that’s only in their name: accounts, card payments, domain names, connectors or spreadsheets.
- Move those to a company account or to someone who’s staying. What to look for.
- Ask what they do that nobody else knows about, particularly anything weekly or monthly.
- Have them show someone else how to do it.
On their last day
- Remove them from every system: the app, the database, email and shared inboxes, spreadsheets, your accounts package, the code host and anything they signed in to with a Google or Microsoft account.
- Change every shared password they knew, including the Wi-Fi if it matters.
- Remove their phone or authenticator from any two-step sign-in. It’s easy to forget, and it could lock you out.
- Get back company laptops and phones, and sign them out of company accounts on personal ones.
- Forward their email to someone for a while, then close the account, rather than leaving it open and unwatched.
If they were technical, or built the system
- Replace every secret key they could have seen. Keys carry on working however someone’s login has changed. How to do it.
- Remove their SSH keys and any API tokens they personally created. These often stay behind after the login has gone.
- Check for scheduled jobs and connectors running under their account.
- Check whether code or data was copied to their own accounts or laptop, and ask for it to be deleted.
- Get any rights in writing. Here’s why.
A week later
- Check that nothing has stopped working. Things tied to their account often fail on the next scheduled run or billing date.
- Look through the logs for any use of their login after they left.
- Write down what you learned, so that next time takes half as long.
Make it a habit
Keep this list with your other leavers’ paperwork. Every few months, look through each system’s user list and ask “who are these people?” If nobody can answer, that’s an answer in itself. Our access register makes this much quicker, because it lists everything in one place.
By Selwyn Doling, VibeTend. Last updated 6 November 2026.
