Parting with an employee is when oversights happen most easily: attention goes to the paperwork and the handover, while access is left for later. „Later” often never comes.
A list for the last day
- The mailbox — do not delete it straight away; block sign-in and forward mail to the manager. A deleted mailbox means lost client threads.
- Remote access and VPN.
- Accounts in business systems — stock, invoicing, CRM, the website panel, company social accounts.
- Shared passwords — if several people used one password, change it. That is the one thing you cannot take back with the account.
- Hardware and media — laptop, phone, office key, USB sticks.
- Banking rights and powers of attorney.
Why it has to be a list, not memory
Because departures are rarely planned. With a dismissal or a sudden resignation there is no time to work out what that person had access to. A list you simply walk through turns a stressful hour into fifteen minutes.
The other side of it
The same list works for hiring — read backwards it says what a new person gets and, more importantly, what they should not get. Permissions granted „just in case” stay for years, and they are what turns up in an audit.