The Empty Desk Isn’t the Risk: Auditing Offboarding Before Access Outlives Employment
Photo: David Bohrer, Public domain, via Wikimedia Commons
When someone leaves a UK SME, the visible event is the farewell email and the empty desk. The less visible event is the access that remains: the mailbox still receiving client correspondence, the laptop still holding a local copy of the finance drive, the SaaS account nobody remembered to close, and the shared admin password that half the team still knows.
Offboarding is one of the cheapest security controls an SME can fix. It is also one of the easiest to leave untested. A policy that says access will be removed promptly is not a control; it is an intention. The control exists only when someone can produce evidence that it happened, on time, for every leaver.
Why offboarding fails quietly
Most offboarding failures are not dramatic. They are administrative gaps that accumulate. A line manager forgets to tell IT until the last morning. A contractor’s engagement ends without a formal exit. A team buys a new SaaS tool on a corporate card and manages it outside the IT function. A departing employee returns a laptop but keeps a mobile phone, a security key or a corporate SIM.
The risk is not only malicious action. Former credentials appear in breach datasets, old mailboxes receive phishing messages, and orphaned accounts retain permissions long after the person has moved on. For an SME, the damage can be disproportionate because access is often broad and oversight is thin.
Four failure modes worth measuring
An offboarding audit should focus on what can be counted. Four failure modes matter most:
- Late revocation. The leaver retains access to email, file storage, finance systems or line-of-business applications after their final working day. The target should be measured in hours, not weeks. For involuntary departures, access should be removed before the conversation ends; for voluntary resignations, at the close of the final working day unless the business agrees otherwise.
- Unreturned devices. Laptops, phones, tablets, security tokens and peripherals are not reconciled against the asset register. A device that is not returned is a data-bearing asset outside the organisation’s control.
- Orphaned SaaS accounts. Applications purchased by teams rather than IT continue to hold user accounts, shared files and licence spend. Single sign-on logs and expense records are useful discovery tools.
- Shared credentials. Team inboxes, generic admin accounts and passwords stored in spreadsheets or notes are not rotated when someone leaves. Shared access is convenient until it is the reason nobody can prove who did what.
A joiner-mover-leaver checklist with evidence owners
The following checklist is deliberately short enough to run and specific enough to audit. Each control needs a named owner and retained evidence. The owner is usually a role, not a person, so the process survives staff changes.
| Stage | Control | Timing target | Evidence owner | Evidence retained |
|---|---|---|---|---|
| Notice received | HR raises a single leaver ticket and notifies IT, the line manager and finance | Within 1 working hour of notice | HR | Ticket reference and timestamp |
| Pre-departure | Line manager lists systems, shared mailboxes, client accounts and physical assets used by the leaver | 2 working days before final day | Line manager | Completed leaver checklist |
| Final working day | Disable primary sign-in, revoke active sessions and reset shared credentials the leaver knew | Before end of final working day | IT | Identity provider log and ticket closure |
| Final working day | Collect laptop, phone, tokens, SIM and access card; record condition and serial numbers | Before end of final working day | IT or office manager | Signed asset return form |
| Within 24 hours | Forward or archive mailbox and files according to policy; confirm delegate access | Within 1 working day | IT | Mailbox rule and file permission report |
| Within 5 working days | Close or transfer SaaS accounts identified in the leaver checklist | Within 5 working days | IT and application owner | SaaS admin report |
| Within 10 working days | Reconcile the leaver against active directory, SSO and the asset register | Within 10 working days | IT governance lead | Reconciliation sign-off |
| Quarterly | Sample five recent leavers and test evidence against this checklist | Quarterly | Operations director | Audit sample report |
The table is not bureaucracy for its own sake. It creates a chain of evidence. If an insurer, client or regulator asks how the business controls access, the answer is a dated record rather than a recollection.
Testing the control before it is needed
An SME does not need a large security team to test offboarding. It needs a quarterly sample and a willingness to report the result honestly. The test is simple: take the last five leavers, compare the HR leaver list with active directory, single sign-on, the asset register and the SaaS admin console. Then check the timestamps on revocation tickets. Record the median time from final working day to access removal, the percentage of devices returned within five days, the number of orphaned accounts closed and the number of shared credentials rotated.
A second exercise is the ghost leaver. Choose a test account, remove it from the HR system without telling IT, and see whether the standard process catches it. This is not a trick; it is a check that the trigger works when HR and IT are not synchronised.
The governance wrapper
Offboarding sits across HR, IT and line management, which is why it often falls between them. The policy should name a single trigger: the HR leaver record. IT should not rely on verbal notice. The line manager should own the system and asset list because they know what the person actually used. Finance should confirm whether corporate cards, mobile contracts or software subscriptions need closing.
For UK SMEs, the governance context is straightforward. UK GDPR requires personal data to be handled securely, and the ICO expects appropriate technical and organisational measures. Cyber Essentials asks for user access control and secure configuration. Neither framework demands a complex offboarding platform. Both demand evidence that access is removed and devices are managed.
The empty desk is not the risk. The risk is the access that outlives the employment. Auditing offboarding once a quarter turns a cheap control into a proven one, and gives the business something more useful than a goodbye email: a record that the keys came back.
