When someone joins your team, you carefully set them up with accounts and access. But when they leave, that same access often lingers for weeks, months, or forever — a quiet, serious security risk hiding in plain sight. A former employee (or anyone who compromises their still-active account) can be a real threat. Here's a practical IT offboarding checklist to close that gap cleanly.
Why offboarding matters
Departed employees are a leading cause of insider incidents and data loss — sometimes deliberate, often just because their access was never removed. An account that's no longer used but still active is a perfect target for attackers, too. Proper offboarding protects your data, your systems, and your obligations under Alberta's PIPA to safeguard personal information.
The key principle: access should end when employment does — ideally the same day.
The offboarding checklist
Work through this the day an employee leaves (or before, for a planned departure):
Accounts and access
- Disable their user account (email, Microsoft 365, etc.)
- Revoke access to all business apps and systems (accounting, CRM, industry tools)
- Remove them from any shared accounts, and change passwords they knew
- Revoke remote access / VPN
- Remove their multi-factor authentication and any app passwords
- Check for access to cloud services, admin portals, and third-party tools
Data and devices
- Preserve their email and files before removing the account (you may need them, and licences cost money)
- Reassign or transfer ownership of important files and shared documents
- Collect and securely wipe (or re-image) company devices — laptops, phones
- For personal devices used for work (BYOD), remove business data and access
Communications and continuity
- Set up an email forward or auto-reply so their contacts reach the right person
- Update any accounts, licences, or subscriptions in their name
- Remove them from mailing lists, portals, and directories
Clean-up
- Reclaim software licences you're no longer using (to save cost)
- Document what was done, in case questions come up later
Make it a repeatable process
The businesses that handle offboarding well don't rely on memory — they have a standard checklist they run every time. That consistency is what closes the gaps. A password manager makes the shared-credential part far easier, since you can change and re-share credentials quickly (see why every business should use one).
The bottom line
Offboarding isn't just an HR task — it's a security one. When an employee leaves, disabling their access immediately, preserving their data, collecting devices, and reclaiming licences protects your business and your data. Turn it into a repeatable checklist and it becomes quick and reliable.
We help Alberta businesses manage user accounts and access — including clean onboarding and offboarding — as part of managed IT. Learn more about our managed IT services, or book a free evaluation.