When a staff member leaves, their access to your systems should end on the same day. In most small businesses it does not, leaving email accounts active, files synced to personal devices and shared passwords unchanged.
When a staff member leaves your business, whether voluntarily or not, there is a window of time where your business data is at risk. The bigger that window, the greater the risk. And in most small businesses, that window is far wider than it should be.
This is not about assuming the worst about people. It is about recognising that access to business systems should match employment status, and that the gap between someone leaving and their access being fully revoked is where problems happen.
What most businesses get wrong
In a typical small business, when someone resigns or is let go, the focus is on the human side. Handing in equipment, final pay, saying goodbye. The IT side often gets dealt with later, if it gets dealt with at all.
Meanwhile, the departing employee may still have access to their business email from their phone. They may still be logged into Microsoft 365 on a personal laptop. They may have OneDrive files synced to a personal device. They may know shared passwords that nobody has thought to change. They may have forwarding rules on their email that continue sending copies of incoming messages to a personal address.
Each one of these is a data leak waiting to happen. Not necessarily malicious. Often just an oversight that nobody noticed until it was too late.
Email is the biggest risk
Business email contains everything. Client conversations, financial details, contracts, internal discussions, attachments with sensitive information. When someone leaves and their email account remains active, anyone with the password can continue reading every email that comes in.
Even if the person has no bad intentions, their account becomes a target. A former employee's account that is still active but no longer monitored is an easy entry point for an attacker. Nobody is watching it, nobody is responding to security alerts for it, and it has full access to your business communication history.
Files do not stay where you think they do
If your business uses OneDrive or SharePoint, files sync across devices. A staff member who had business files synced to a personal laptop still has copies of those files after they leave. Unless you have mobile device management in place that allows you to remotely wipe business data from personal devices, those files go with them.
Even without sync, most people have downloaded files, saved email attachments or copied documents to personal storage at some point. Not out of malice, but because it was convenient. When they leave, that data leaves with them.
Shared passwords compound the problem
If your business uses shared logins for any systems, social media accounts, vendor portals, shared email addresses, software licences, every one of those passwords needs to change when someone with access leaves.
This is one of the reasons shared passwords are a bad practice in the first place. With individual accounts and proper access management, revoking one person's access is straightforward. With shared passwords, you need to change every credential they knew about and update it for everyone who still needs access.
What proper offboarding looks like
A proper IT offboarding process should happen on the same day the employee's last day occurs, ideally at the same time they hand in their equipment. It should include disabling their Microsoft 365 account so they can no longer sign in, converting their mailbox to a shared mailbox so colleagues can access any important emails, removing their access from all business applications and portals, wiping business data from any personal devices they used for work, checking for and removing any email forwarding rules or delegated access, changing any shared passwords they had access to, and transferring ownership of any files or documents that need to remain accessible.
This process should be documented as a checklist that is followed every time someone leaves, regardless of the circumstances. Doing it from memory means something will be missed.
POPIA makes this your legal responsibility
Under POPIA, your business is responsible for protecting the personal information you hold. If a former employee retains access to client data after leaving, and that data is subsequently exposed or misused, your business is liable.
The Information Regulator does not accept the excuse that you forgot to revoke access. Having a documented offboarding process that includes IT access revocation is part of meeting your POPIA obligations.
The uncomfortable conversation
Sometimes people leave on bad terms. In those situations, the risk is more acute. A disgruntled former employee with active access to your business email, client data and financial systems can cause significant damage in a very short time.
This is not about being paranoid. It is about being prepared. Having a process that can be executed quickly and completely, regardless of the circumstances of the departure, protects your business and your clients.
The bottom line
Staff turnover is normal. What is not normal, but is unfortunately common, is leaving former employees with access to your business systems for days, weeks or even months after they leave. Every day that access remains open is a day your business data is unnecessarily at risk.
At Recloud we handle IT offboarding for our managed clients as part of the standard process. When someone leaves, their access is revoked, their data is secured and the transition is handled properly. If your business does not currently have an offboarding process, or if you suspect there are former employees who still have access to your systems, get in touch and we will help you close those gaps.