What Actually Happens When You Offboard an Employee (And What Usually Gets Missed)

The employee’s last day was Friday. On Monday, their email still works, their laptop is sitting in a drawer, and nobody has touched their access to the file server.

Offboarding is one of those tasks that feels finished the moment the person walks out the door, which is exactly why it so often is not. HR closes out the paperwork, someone collects the badge, and the technical side gets a vague “we’ll deal with the accounts later.” Later has a way of becoming never. Every account left open, every device unaccounted for, is a door that is still unlocked after the person who used it has gone.

A departing employee is a security event, whether they left on good terms or bad ones.

The Accounts Are the Easy Part to Forget

The obvious step is disabling the person’s main login. The part that gets missed is everything attached to it. Most people have access to far more than their email:

• Email and the Microsoft 365 or Google account behind it
• The file server, shared drives, and any cloud storage
• Third-party apps signed in with their work account, from the CRM to the accounting tool
• Remote access and VPN
• Any shared or admin passwords they knew
• Physical access, from keys to door codes

Disabling one account does not touch most of that list. Each one is its own step.

The Data Goes With Them If You Let It

When someone leaves, their mailbox and files still hold things the business needs. Client history, project records, the one contract nobody else has a copy of. If the account gets deleted before that content is preserved, it is gone, and you find out weeks later when you go looking for it.

The right move is to preserve the data before you remove the person. Convert the mailbox, transfer file ownership, forward what needs forwarding. Then disable. Doing it in that order is what separates a clean offboarding from a scramble.

Forwarding Rules and the Quiet Risk

Here is one that catches people. Before you hand off or wipe a departing employee’s mailbox, check for forwarding rules. An employee who left on bad terms may have set their mail to quietly copy to a personal address. Even with no bad intent, an old forwarding rule can keep leaking business email long after the person is gone. It takes thirty seconds to check and it is almost never on anyone’s list.

The Device Is Still Your Problem

The laptop in the drawer is not neutral. It has cached credentials, saved logins, and probably local copies of company data. Until it is wiped or reset, it is a company asset sitting outside your control. Collecting it is step one. Actually resetting it is the step that usually never happens.

Final Thoughts

None of this is complicated. It is just a list, and the reason offboarding goes wrong is almost never difficulty. It is that the technical steps have no clear owner, so they slip. The fix is having an actual checklist and someone responsible for running it every single time, not just when the departure was dramatic.

The honest caveat: the routine, amicable departures are the ones that get sloppy, because nobody feels any urgency. Those are exactly the ones where an account sits open for six months. Treat every exit the same and you never have to guess which ones mattered.