By the time an employee hands in their notice, the decisions that will determine whether their departure is clean or chaotic have already been made.
Those decisions usually happen during the employee’s first few weeks, when no one is paying close attention because the new hire has just arrived and there are a hundred other priorities competing for attention. A shared login gets created here. A quick SaaS account is opened there. A personal laptop is used while everyone waits for company hardware to arrive.
By month six, those choices no longer feel like temporary decisions. They simply feel like the way things are done.
This post explains what is really happening when offboarding takes three weeks, the four onboarding shortcuts that almost guarantee a painful departure, how to improve security and access practices for the team you already have, and what your IT provider should be doing during onboarding that may not be happening today.
What's really going wrong when offboarding takes three weeks
A clean offboarding process takes about 90 minutes of IT time.
The employee’s account is disabled in the company’s identity provider, which automatically revokes access to every connected application through single sign-on. The employee’s device is remotely wiped or collected and wiped on-site. Their email is forwarded to a manager or converted into a shared mailbox. Accounts in the CRM, project management platforms, and other business systems are reassigned. A handover document, already created as part of onboarding, is completed and filed.
The messy version of the same process can take three weeks.
It often begins with a manual list of tools that no one can fully remember, which may require asking the departing employee to help reconstruct their own access. You discover a Figma account, a Loom workspace, a Notion instance, and an Airtable base that were all set up independently. The passwords are stored in the departing employee’s personal password manager. Their laptop is at home, and they are in no hurry to return it.
Then a client emails to say they received a strange message from the employee’s personal email address. Six weeks later, a vendor charges the company credit card for a software seat everyone thought had been canceled.
Whether offboarding is clean or chaotic depends largely on what was established during onboarding.
In identity management, this is known as the “joiner, mover, leaver” lifecycle. Microsoft and most identity management vendors use the same three-stage model. When the joiner phase is rushed, months of identity and access cleanup are compressed into the two weeks after an employee submits their resignation.
Four onboarding shortcuts that guarantee a messy exit
Letting new hires sign up for SaaS tools on their own
When an employee signs up for a software tool independently using their work email address and a password only they know, the account is functionally theirs.
You may not be able to reset the password without sending a notification directly to them. In some cases, you may not even know the account exists until a vendor invoice appears or the account becomes inaccessible after the employee leaves and a client project suddenly stops working.
This is one of the most common causes of the “we can’t find half the logins when someone leaves” problem.
The solution is to provision every business application through a central identity management system. New SaaS applications should be connected to your single sign-on platform before the first employee logs in.
Tolerating personal devices “just until we get them sorted”
Personal devices used for work rarely remain temporary.
The employee installs applications, connects to client systems, downloads files, and gradually turns a short-term workaround into their permanent way of working. When they leave, the company has no reliable way to remove business data from a device it does not own and never enrolled in a management system.
You are relying on the former employee’s goodwill. That may work most of the time, but goodwill is not a security control.
The best solution is to provide company-owned devices on the employee’s first day and enroll them in a mobile device management system. When personal devices are permitted, access to company email, files, and applications should occur through managed apps that can be remotely disconnected. Browser-saved credentials are not an acceptable substitute.
Shared logins for tools you didn't want to pay per-seat for
Shared credentials are one of the biggest problems during offboarding.
When five employees use the same login for a platform, you cannot remove one person’s access without changing the password for everyone. This problem usually becomes visible at the worst possible moment, especially when the departing employee originally created the account and no one else knows the password.
Per-user licensing is part of the cost of managing access correctly. The money saved through shared logins often reappears during offboarding as wasted staff time, business disruption, and unnecessary security exposure.
Letting client relationships live in one person's inbox
This problem is especially common in agencies and professional service organizations.
When a senior account manager, salesperson, or consultant leaves, the client relationship can effectively leave with them. The email history, preferences, project context, and unresolved conversations may all exist inside one person’s inbox.
Once that employee is gone, the information becomes difficult or awkward to retrieve.
From the client’s perspective, it can suddenly appear that your business no longer knows who they are or what has been discussed.
The solution is to store client communication in a shared inbox, CRM, or another centralized system. Even a Microsoft 365 shared mailbox, combined with a clear expectation that client conversations are copied or forwarded to it, is a meaningful improvement over the system many small businesses use today.
How to retrofit hygiene on the team you already have
For most businesses, the most urgent cleanup involves the employees who are already on the team.
You cannot go back and completely re-onboard your existing staff, but you can audit the tools, devices, access, and communication practices currently in place. Closing those gaps now can prevent the next departure from becoming an emergency.
The SaaS audit
Start by collecting three months of credit card statements for every card used for business expenses. Create a list of every recurring SaaS charge.
For each platform, identify who created the account, who knows the login credentials, whether the account uses a personal or company email address, and whether anyone else could access it if the account owner left tomorrow.
You will likely discover tools no one remembers signing up for, platforms used by only one employee with no backup access, and accounts that still list a former employee as the owner even though the company continues paying for the subscription.
This does not need to be a complicated technical project. A spreadsheet and a focused afternoon are often enough to uncover the most immediate risks.
The device register
Create a simple device register showing who has each device, when it was issued, whether it is enrolled in a management system, and what company information or systems it can access.
If no device register exists, build one now.
Ask each employee to confirm every device they use for work, including personal computers, tablets, and mobile phones. The purpose is to understand the company’s current exposure, not to punish anyone for practices that may have been informally allowed.
Most employees will willingly confirm what they use once they understand the goal.
For any personal device that accesses company systems, the minimum requirement should be that company email and file access occur through managed applications that can be remotely disconnected.
Client communication in shared places
Move client communication into shared systems so the relationship remains with the business when an employee leaves.
The goal is continuity. Establish a shared inbox or email alias for client-facing communication and use a CRM to document contact history, notes, preferences, open issues, and next steps.
What your IT provider should be doing at onboarding
Many IT providers are first contacted when an employee resigns.
They disable the user’s account, attempt to collect the laptop, and work with whatever documentation is available. However, that is the wrong end of the employee lifecycle for IT involvement to begin.
If staff departures are the only time your IT provider participates in employee transitions, your business may not be receiving enough value from the relationship.
A better model includes your IT provider in the onboarding process.
They should create the employee’s account in the company’s identity provider, enroll the new device in the mobile device management system, and provision access through single sign-on. Every application the employee uses should be connected to one centrally managed identity that can be disabled in a single action.
Your IT provider should also help maintain a handover document for each employee. That document should be reviewed periodically and include every system the employee accesses, each client relationship they manage, and any credentials or accounts connected to their identity.
When those practices are in place, offboarding becomes a checklist and an hour of work rather than a three-week investigation.
Ask your IT provider what role they play during onboarding. If the answer is “not much” or “we normally get called when someone leaves,” it may be time for a larger conversation.
A 60-day plan before your next round of departures
You do not need to know when the next resignation will happen before you begin preparing. In fact, the work is far easier when nothing is urgent.
Weeks 1 and 2: Complete the credit card and SaaS audit. Build a list of every tool, account owner, and login controlled by only one person. Flag any account where access would be lost or significantly complicated if that person left this week.
Weeks 3 and 4: Build the device register. Confirm what every employee uses for work. For personal devices that access company systems, implement managed application access at a minimum. Enroll company-owned devices in a management system if they are not already included.
Weeks 5 and 6: Audit client-facing communication. Identify client relationships that exist primarily inside one employee’s inbox or on someone’s mobile phone. Begin with the highest-risk accounts and establish shared mailboxes, email aliases, or CRM documentation.
Weeks 7 and 8: Write the onboarding process you wish your company had used from the beginning. Use everything discovered during the previous six weeks to build it. Apply the process to the next employee from their first day and use it as the foundation for a handover document for every current team member.
Most of this work is operational rather than technical. A spreadsheet, a few honest conversations with employees, and several hours of support from your IT provider will address the majority of the risk.
Article used with permission from The Technology Press.