Offboarding That Stops at HR: The Access That Never Leaves

Here's the scene, playing out in small companies every week: someone leaves — good terms, bad terms, doesn't matter. HR runs the checklist they own: final paycheck, benefits, the goodbye message. IT (or the owner wearing the IT hat) collects the laptop and wipes it, or means to. Everyone feels the door closed.

It didn't.

Three months later the ex-employee can still open the shared drive link that was never rotated. The support inbox still auto-forwards a copy to a personal Gmail they set up “just for after hours.” The project management seat is still billed and still logged in on their phone. Nobody attacked you. Nobody “hacked” anything. You left the keys on the hook and called it a process.

What HR finishes — and what security never starts

HR is good at the human half of leaving: paperwork, benefits, references, the culture moment. That half is real work. It is also the half that ends when the person walks out.

The other half is every system that ever trusted their identity:

• Email and calendar (including forwarding rules and shared mailboxes)
• SSO and standalone SaaS (CRM, accounting, chat, docs, code, design tools)
• Cloud consoles (AWS, Azure, Google Cloud, hosting panels)
• VPN, Wi-Fi password, and remote desktop
• Password managers and shared vaults
• Domain, registrar, and DNS accounts
• Banking and payment tools with “user” access
• Physical access: badges, keys, alarm codes, printer codes
• The stuff nobody lists: Slack on a personal phone, MFA in an old authenticator app, a GitHub deploy key generated years ago

In a shop without a full-time IT person — which is most small businesses — that list has no owner. HR assumes “IT handled access.” The owner assumes “we got the laptop.” The laptop was never the whole kingdom.

Why nobody notices

Three reasons this stays invisible for months:

• Absence doesn't page you. A disabled account that still works doesn't throw an alert. Quiet access looks like silence, and silence feels like safety.
• Billing is a terrible security signal. A SaaS seat that still renews looks like a cost problem, not an access problem. Finance might flag the line item next quarter. Security needed it on day one.
• Shared credentials hide the body. If the “company” password for the domain registrar lived in a spreadsheet, there is no user to disable. The ex-employee simply still knows it. Offboarding a person does nothing to a secret that was never personal.

So the risk sits there: not dramatic, not ransomware-on-the-news. Just an open path that used to belong to someone who no longer works for you — and might be fine, or might be having a bad year, or might have a new employer in your vertical. You don't get to pick which.

What it actually costs

The expensive version is obvious: a messy exit plus leftover admin rights. The common version is quieter and still expensive.

• Client trust. A former staffer still reading support mail or CRM notes is a confidentiality problem whether or not they “do anything.” If a client asks who can see their data, “people who left last spring” is not an answer you want to give.
• Contract and insurance language. Many client agreements and cyber-insurance questionnaires ask whether access is revoked at termination. “We collect the laptop” is not the same statement.
• Fraud and mistake. An active banking user, a live payment tool, a cloud console with a saved card — those are not theoretical. They are how quiet losses happen without malware.
• The next hire's mess. Seats, licenses, and half-owned accounts accumulate. Six exits without a real offboarding checklist is how you end up paying for tools nobody can administer.

You do not need a Hollywood insider threat. You need one leftover inbox rule and a bad week.

The fix that doesn't require an IT department

You need a single offboarding checklist owned by a named person (the owner, office manager, or whoever actually has admin on the tools) — and it runs the same day employment ends, not “when we get to it.”

In practice, five moves:

1. One checklist, one owner, same day. Not a vibe. A written list. HR triggers it; the access owner executes it before end of day. If the person is high-risk or admin-heavy, revoke first and recover equipment second.
2. Identity before devices. Disable SSO / Google / Microsoft / primary email first. Laptop wipe second. A wiped laptop with a live cloud account is theater.
3. Inventory the SaaS, not your memory. Check admin → users on each tool you pay for. Sort by last login. Anyone who left stays on that list until you can prove disabled. Shared logins get rotated, not “noted.”
4. Kill forwards, sharing, and tokens. Mailbox rules, calendar delegates, shared drives set to “anyone with the link,” personal devices in MFA, API keys, Git deploy keys, app passwords. These survive a simple “disable user” more often than people expect.
5. Change what they could have known. Wi-Fi password, door codes, shared vault entries, registrar and DNS, social accounts, password-manager emergency access. If it was shared, treat it as known to that exit.

Friendly exits get the same checklist as messy ones. Kindness is the conversation. Access is the checklist. Do not confuse them.

The five-minute check

1. Do you have a written offboarding access checklist — and a named owner who is not “whoever remembers”?
2. Pick one person who left in the last year. Can you prove their email, CRM, and main SaaS accounts are disabled today?
3. Is there any shared password they would still know (Wi-Fi, registrar, “office” logins)?
4. Have you checked mailbox rules and forwarding on the shared inboxes they used?
5. If a client asked, “who can still see our data?” — could you answer from evidence, not hope?

Five yeses: you're ahead of most shops your size. Two or fewer: you don't have an offboarding problem in theory. You have leftover access in production. The gap is a checklist and an afternoon — cheaper than discovering it because something weird hit the CRM at 11pm.

The farewell was real. The cake was fine. None of that revokes a session token. Close the identity, rotate what was shared, and write it down so the next exit isn't a scavenger hunt.