The Employee Offboarding Digital Access SOP

Purpose

When someone leaves, this procedure guarantees that by the end of their last day they can no longer read shop email, see customer records, move money, order parts on the shop's account, speak for the shop online, or open a door with a code they memorized, and that the shop can show when each access ended. Without it, offboarding is whatever the office remembers on a busy afternoon: the email gets turned off, the tablet comes back, and a year later the former tech still manages the map listing and the supply house still ships to anyone who quotes his name. Most former employees never misuse anything. The procedure exists for the one who does, and for the one whose personal phone is stolen with the shop's apps still signed in.

Scope

Covers every departure: resignation, termination, end of a seasonal stint, a subcontractor who had logins, and an owner's family member who stops helping in the office. Runs the same regardless of how the person left; only the timing in step 1 changes.

It does not cover final pay, benefits or the separation conversation, which are payroll and HR matters governed by state law. It does not cover customer keys and lockbox codes the person held, beyond rotating them in step 6; custody is owned by The Customer Key and Code Handling SOP. A departure where misuse is already suspected is incident response first. See related: The Former Employee Still Had Access.

Roles and responsibilities

Procedure

Step 1. Set the access-end time and pull their rows. The owner sets the moment access ends: for a termination, during the separation meeting; for a resignation, the end of the last shift, or at notice if the person is going to a competitor or the owner has any doubt. The office lead then pulls every row of the account inventory where this person appears as a user, admin or recovery method. Acceptance: a written list of accounts and a fixed time, before the conversation happens. Wrong looks like an inventory with no rows naming them, which means the inventory is stale, not that they had no access; stop rule: do not proceed on memory, ask them what they log into and check their phone's authenticator app list at handover. Hazard: telling the person before access is cut, in a hostile departure, gives a window to download customer lists. See related: The Account Inventory Every Shop Should Keep.

Step 2. Suspend their email and identity login. At the access-end time, suspend (do not delete) their mailbox, reset its password, and sign out all sessions on all devices. Deleting loses mail the shop may need for warranties or disputes. Acceptance: a test login with the old password fails, and the admin console shows no active sessions, within 15 minutes of the access-end time. Wrong looks like a mailbox that was also a recovery email for another account, which suspension will now break; stop rule: before suspending, move those recovery settings to a shop mailbox, and note each one. Hazard: an email account suspended before its recovery role is moved can lock the shop out of the dependent account.

Step 3. Remove them from everything that moves money. Bank users, the card processor, payroll, accounting software, any company card in their name (cancel it with the issuer, do not just collect it). Acceptance: each system shows the user removed or disabled, and the card issuer gives a cancellation reference. Wrong looks like a bank login the shop cannot remove without the branch; stop rule: call the bank that day, and until it is done ask the bank to require a second approval on all outgoing payments. Hazard: none physical; this is the step where a delay costs money directly.

Step 4. Remove them from operations and supplier accounts. Field-service software, the phone system and voicemail, the scheduling app, and every supply house or distributor where they were an authorized buyer. Supply houses often let a named tech order on the shop's account at the counter; call each one and have them removed. Acceptance: the user gone from each system, and a named person at each supplier confirming removal. Wrong looks like a supplier that cannot say who is authorized; stop rule: ask them to require a purchase order number on every counter order until the list is rebuilt. Hazard: a former tech can still walk into a counter and charge parts for side work, and counter staff who know him will let him.

Step 5. Remove manager and owner roles on public accounts. Map and search business profiles, social accounts, review sites, the website builder. Check whether they are a manager or the primary owner. Acceptance: their role removed and the shop's own account confirmed as primary owner on each. Wrong looks like the departing person holding primary ownership, which nobody else can remove; stop rule: ask them in the exit meeting to transfer ownership to the shop's account there and then, and if they will not or cannot, start the platform's ownership-recovery process the same day. See related: The Business Profile Was Hijacked. Hazard: whoever is primary owner controls the phone number customers see on the listing.

Step 6. Rotate every shared secret they knew. The shop door and alarm codes, the gate code to the yard, the office Wi-Fi password, any shared login that has not been moved into the password manager, and the codes on lockboxes holding customer keys. Acceptance: each secret changed, with the date and who now holds it, and customers whose keys or codes they held notified per the key SOP. Wrong looks like a shared login nobody can change because the vendor ties it to that person; stop rule: flag it as a shared-login problem and fix it this week. See related: The Shared Login Problem. Hazard: an old yard or lockbox code is physical access, not just digital.

Step 7. Recover, check and wipe devices. Collect company phones, tablets, laptops, card readers and keys against the issue list. Before wiping, check each device is not locked to their personal account (an activation lock would make it unusable). Then wipe through the device-management console or factory reset. For a personal phone with shop apps, sign them out of each app and remove the work profile; do not wipe a personal phone without a signed policy allowing it. Acceptance: every listed device returned and wiped, or its absence recorded. Wrong looks like a device not returned; stop rule: remotely lock and wipe it, and do not deduct it from final pay without checking your state's rule, since several states, California among them, restrict wage deductions for unreturned equipment. Hazard: a returned phone still logged into the shop's email is a breach waiting in a drawer. See related: Personal Phones at Work: The BYOD Question.

Step 8. Set forwarding and tell the people who called them. Forward the suspended mailbox to their manager for 90 days with an auto-reply naming the new contact, then archive it. Tell regular customers and suppliers who dealt with them directly, by the shop's usual channel, that their contact has changed. Acceptance: forwarding and auto-reply active, and a short list of notified contacts. Wrong looks like customers who have the former tech's personal cell; stop rule: tell those customers which number to use, and do not ask the former employee to pass messages along. Hazard: a forwarded mailbox can also carry personal mail; the manager reading it should not open anything plainly personal and should forward it on.

Step 9. Check the sign-in logs at 30 days. Review the sign-in or activity logs on email and each money system for any login by their account after the access-end time. Acceptance: no activity after that time on any system checked. Wrong looks like any login at all; stop rule: treat it as an incident and go to The First Hour After a Suspected Breach SOP. Hazard: none physical; skipping this is how a missed account stays missed.

The record this produces

One offboarding sheet per departure, filed with their personnel record: access-end time, each account with the time access was removed and by whom, recovery settings moved, cards cancelled with references, suppliers confirmed, public-account roles and current primary owner, secrets rotated with dates, devices returned or locked, contacts notified, and the 30-day log result. The owner reads it at the end of week one; an insurer or attorney reads it if the former employee is later accused of something, when a dated sheet answers what an unprovable "we turned everything off" cannot.

Worked pass: a lead tech leaves for a competitor

A twelve-person electrical shop. The lead tech gives two weeks' notice on a Monday, going to a competitor across town. The owner sets access-end at notice for email and money systems, and at the end of the last shift for the field software he needs to finish his scheduled jobs.

• Step 1. Inventory shows 9 rows naming him; his phone's authenticator app shows 11 entries. The extra two: a manufacturer warranty portal and an electrical supply counter account. Added. Pass after correction.
• Step 2. Mailbox suspended Monday 4:10 p.m. He was the recovery email for the warranty portal; moved to the office mailbox first. Test login fails at 4:18. Pass.
• Step 3. He held no bank access; his fuel card was cancelled with the issuer, reference logged. Pass.
• Step 4. Field software disabled at last shift. Three supply houses called; two confirm removal by name, one cannot list authorized buyers. Purchase-order rule requested there. Pass with the stop rule applied.
• Step 5. He is primary owner of the map listing, which he created years ago. Fail. Stop rule applied: in the exit meeting he transfers primary ownership to the shop's account on his phone, the office lead watching, and is removed as manager. Logged with the time.
• Step 6. Yard gate, alarm and Wi-Fi changed on his last day; four customer lockboxes he held codes for re-coded and those customers told. Pass.
• Step 7. Company tablet returned; activation lock checked, clear; wiped. Pass.
• Step 8. Forwarding to the owner for 90 days. Two property managers had his personal cell; both told to call the office line. Pass.
• Step 9. Day 30: no sign-ins after access-end on email, field software or the processor. Closed.

Re-read against the general section: step 5 failing is the most common real-world failure in this SOP, because the person who set up a listing years ago is rarely the person the office thinks of as its owner. Asked in the exit meeting, it took four minutes. Discovered six months later, it is a recovery process measured in days.

References

• See related: The Account Inventory Every Shop Should Keep
• See related: The Former Employee Still Had Access
• See related: The Customer Key and Code Handling SOP
• See related: Personal Phones at Work: The BYOD Question
• Your state labor department's guidance on final pay and permitted wage deductions