Before the Badge Works: Gating New-Starter IT Before Day One

There is a moment on the first Monday of a new job when the laptop opens, the password is typed, and the organisation's IT function is quietly assessed. If email works, the shared drive appears and the meeting invitations land, the new joiner concludes the business is competent. If the account is locked, the laptop is still with the supplier and two people are searching for a licence, a rather different conclusion is reached — by someone with no particular reason to be charitable.

For most UK SMEs, that moment is left to chance. Onboarding is handled as a queue of tickets raised in the final week, coordinated by whoever remembers, and resolved on the morning itself. It usually works. It also fails predictably whenever a manager is on leave, a supplier is slow, or a role turns out to be broader than the job description suggested.

Why day one deserves a control rather than a scramble

Leaver processes have received attention in recent years because they carry an obvious risk: access outliving employment. Joiner processes carry the same risk inverted. Access is often granted too widely because the request is vague, too early because the start date moved, or not at all because the request was never formally made.

The first Monday is therefore a live test of the IT operating model. It demonstrates whether identity, devices, licensing and approval are joined up — or whether they depend on an individual's memory. A pre-start audit turns that test into something the business sets deliberately, and gives the new joiner a first impression that reflects the organisation rather than its worst week.

Five gates before the welcome email

A workable pre-start audit is short enough to be completed every time. Five gates are sufficient for most SMEs.

Gate one: role-based access, agreed in writing

The hiring manager should confirm, not in conversation but in a record, which systems the role requires and at what level. This is where the familiar failure occurs: a request for "standard access" is interpreted generously, and a new starter in a support function inherits permissions belonging to a previous holder of the post.

Building a small library of role profiles — finance, sales, operations, technical — removes most of the guesswork. Anything outside the profile should require a separate, named approval. Under UK GDPR, the principle of data minimisation is not merely good manners; access that is not needed is access that must eventually be explained.

Gate two: device readiness, verified not assumed

The laptop should be built, patched, encrypted and enrolled in device management before the start date, with the asset record created at the same time. "Ordered" is not the same as "ready", and a delivery date from a supplier is not a commitment the business controls.

Where hardware is delayed, decide in advance what the fallback is: a loan device, a temporary cloud desktop, or a later start for systems access. Improvised workarounds on the Monday morning are how unmanaged devices enter an estate and stay there.

Gate three: identity and MFA at the point of issue

Multi-factor authentication should be enrolled during handover, with the new joiner present, rather than left as a task for their first week. Recovery methods — a second factor, a backup contact, an alternative device — should be registered at the same time.

The practical value is not only security. A joiner who cannot authenticate on day one loses hours, and often ends up sharing credentials or borrowing a colleague's session to get moving. Enrolling at issue removes that temptation entirely.

Gate four: licences assigned against a named role

Licence assignment is where onboarding quietly becomes a cost problem. A default bundle applied to every new starter tends to accumulate: premium tiers for people who need email and a document store, duplicate collaboration tools bought by different departments, add-ons that renew annually because nobody removed them.

Mapping each role profile to a licence tier takes an afternoon and pays for itself repeatedly. Record the assignment, the approver and the date, so that the thirty-day review has something factual to examine.

Gate five: manager sign-off with a named owner

The final gate is a signature — digital is fine — confirming that the joiner's access, device and licences match the role as agreed. Without it, the process has activity but no accountability, and any discrepancy discovered later belongs to nobody.

Timing the run-in

A ten-working-day run-in suits most SMEs. At ten days, confirm the role profile, order or allocate the device and raise the access request. At five days, verify the device build and check licence availability. At two days, complete the account creation, enrol MFA and issue first credentials through a secure channel. On the morning itself, only the handover remains.

Where a start date is agreed at short notice, the same gates apply in compressed form. What should not happen is skipping a gate because the calendar is tight; the shortcut is exactly the risk the process exists to prevent.

Evidence worth keeping

A pre-start audit produces a short record: the approved role profile, the device asset entry, the MFA enrolment confirmation, the licence assignment and the manager's sign-off. Held together, these form a defensible account of how access was decided — useful for Cyber Essentials evidence, for insurer questionnaires, and for the internal conversation that follows any incident involving a recent joiner.

Where the process usually breaks

Three cases test any onboarding control. The rehire, whose old account may still exist in a disabled state and whose permissions may be restored wholesale. The contractor, who is often set up outside the standard route and left outside the review. And the internal mover, who is the most neglected of all: they already have an account, so no onboarding ticket is raised, and their previous permissions quietly travel with them into a new role.

Treating movers as joiners — with the same five gates applied to the delta — closes a gap that survives most audits.

The handover to probation

Onboarding ends, but the review should not. A short check at thirty days confirming that access matches what the role actually became, and that unused licences are reclaimed, keeps the position honest. Roles change faster than job descriptions, and the first Monday is only the beginning of the record.