Removing a staff member's login is only one part of offboarding from business software. They may own scheduled reports, integration connections, approval queues or recovery details for a critical account. A useful process identifies those dependencies before access ends, then verifies that the business continues to operate under the right owners. Keep the process proportionate and coordinate it with the organisation's established employment and security procedures.
Separate the person from the business process
Imagine a regional accounting practice whose office coordinator created several workflow automations using their own service account connection. Disabling their login could interrupt document reminders or internal approvals. List the applications they administer, the automations they own and the work assigned to them. Distinguish personal access from the technical identity used by each integration. Where possible, place enduring business processes under an appropriate business-controlled arrangement rather than depending indefinitely on one employee's personal account. Confirm that this arrangement follows the provider's supported account and permission model.
Transfer work as well as account ownership
Open tickets, pending approvals, customer follow-ups and scheduled reports need a receiving owner. A bulk reassignment should show what will move and preserve the historical record of who performed earlier actions. Decide which shared documents and reference material remain needed. Give the successor access through their own identity rather than sharing the departing person's password. Check recovery contacts and billing ownership for important providers. These less visible settings often matter most when something fails after the original administrator is no longer available to help.
Review credentials affected by the change
OWASP's secrets management guidance treats secrets as having a lifecycle, including replacement and revocation. Identify credentials the departing person could access and apply the business's agreed rotation process where needed. Coordinate changes with integration owners so replacement credentials are installed and verified in the right environments. Avoid exposing secret values in the offboarding checklist itself. Removing human access and rotating an application credential are related but distinct actions; record both outcomes so the business can tell what has actually changed.
Verify the next ordinary cycle
After the access change, check the business processes that depended on the person: an approval arrives, a report runs and a monitored integration completes its expected work. Do not rely solely on a list of disabled accounts. Confirm:
- All active work and administrative ownership have named successors.
- Human access, recovery contacts and shared credentials have been reviewed.
- Affected integrations continue under the intended business-controlled identity.
- The next scheduled cycle is checked and unresolved dependencies have an owner.