It’s a question most business owners don’t think about until they’re in the middle of it. Someone hands in their notice. There’s a handover, a goodbye card, maybe a leaving do. And then a few weeks later, you realise you have no idea how many systems they still have access to.
This is one of the most common security gaps in small businesses. Not malicious. Not complicated. Just overlooked.
The problem with how most businesses handle this
When someone leaves, the focus is usually on the practical handover. Making sure their work gets covered. Updating the email signature. Notifying clients. Password security tends to come as an afterthought, if it comes up at all.
But think about what a typical employee might have access to. Your email platform. Your website. Your social media accounts. Your accounts software. Your cloud storage. If they’ve been with you a while, that list gets long quickly.
If those passwords were shared verbally, sent over email, or stored in a spreadsheet somewhere, you genuinely can’t be sure what’s been passed on, saved, or remembered.
Why this matters more than you might think
Most people who leave a job don’t do anything malicious. But access left open is still a risk, even with the best intentions involved.
There’s also the question of what happens if their personal device gets lost or stolen after they’ve left. If they had passwords saved in a browser or on their phone, that data could end up in the wrong hands with no connection to you at all.
And for businesses in regulated sectors, or those holding customer data, there’s a compliance angle too. You have a responsibility to ensure that access to sensitive information is properly controlled.
What a clean offboarding process looks like
The businesses that handle this well aren’t doing anything complicated. They’ve just got a clear process and the right tools in place.
With a proper password manager, offboarding becomes straightforward. When someone leaves:
- Their personal account is deactivated immediately.
- Any shared passwords they had access to can be rotated in minutes.
- You know exactly what they had access to, because it’s all in one place.
- There’s nothing to chase down, no forgotten logins to worry about later.
That last point is worth sitting with. No forgotten logins to worry about later. That’s the difference between having a process and hoping for the best.
It’s not just about departures
Getting this right when someone leaves is important, but the same discipline applies when someone joins, changes roles, or takes on new responsibilities. Who has access to what should never be a mystery.
We include 1Password as part of our managed IT support packages for exactly this reason. It gives you visibility and control without adding complexity to your day-to-day. If you’d like to talk through how it could work for your team, we’re happy to have that conversation.
