Leaving Well: A Controlled Offboarding Routine for UK Small Firms
Photo: Unknown authorUnknown author, Public domain, via Wikimedia Commons
Most UK small firms have a first-day routine. Far fewer have a last-day routine. That imbalance is understandable: onboarding feels like building something, while offboarding can feel like an awkward administrative clean-up. In security terms, however, a departure is just as important. It is the point at which access, data, devices and knowledge change hands. Handled well, it protects the business and treats the leaver fairly. Handled badly, it leaves dormant accounts, orphaned files and unreturned kit behind.
For 2026, the practical answer is not a lengthy policy. It is a short, repeatable routine with a named owner and a written record. The aim is to make leaving as controlled as joining.
Give the process an owner
A leaver process fails when everyone assumes someone else has done it. The line manager should own the business handover. IT should own access and devices. HR or the office manager should own the record. One person - usually the line manager - should coordinate the timetable and confirm that each step has happened.
Before the final day, gather the basics: the agreed leaving date, the person's role, the systems they use, the devices they hold and the files that must stay with the team. This preparation is what makes a thirty-minute final sequence realistic.
The thirty-minute leaver sequence
The following sequence is designed for the final working day, once handover has taken place. Times are indicative, not rigid. The important point is that each action is ticked and time-stamped.
- Confirm the departure time with the line manager and note it in the leaver record.
- Revoke remote access, VPN sessions and any high-risk third-party connections at the agreed time.
- Disable the main sign-in account rather than deleting it immediately. This preserves the audit trail and allows mailbox or file recovery if needed.
- Convert the mailbox to a shared mailbox if the role requires continuity, or set a short, neutral auto-reply and agree a retention period.
- Transfer ownership of OneDrive, SharePoint or shared-drive content to the line manager or a named team account.
- Collect laptops, phones, tokens, keys, passes and any removable media. Record serial numbers and condition.
- Remove the person from relevant distribution lists, Teams channels, shared calendars and building access lists.
- Update the asset register and tell the service desk, finance and any relevant suppliers that the leaver has gone.
That is the core. It should take about half an hour if the preparation has been done. If it takes much longer, the pre-work was missing.
Revocation timing: not always one switch
A common mistake is to treat access revocation as a single event. In practice, timing should match risk. If someone is leaving immediately or working through a notice period with reduced duties, remote and external access should go first. Internal access can be staged only where the line manager has agreed a clear handover need and the IT team has recorded it.
Avoid shared passwords entirely. If a team has been using a shared login, change it when the leaver leaves and issue individual accounts. Disable accounts rather than deleting them for a defined period, often thirty days, so that email and files can be recovered. Check the less obvious systems too: expense tools, CRM, payroll portals, courier accounts and any software bought on a company card.
Shared mailboxes and file ownership
The most common post-departure problem is not a stolen laptop. It is a customer email that nobody can answer because it sits in a mailbox no one can access. Convert role-based mailboxes to shared mailboxes and grant access to the line manager or a named colleague. Use a neutral auto-reply rather than a personal one, and avoid forwarding business mail to a personal address.
File ownership needs the same discipline. Personal OneDrive folders are not a team archive. Before the account is disabled, move or copy business-critical content into a shared team site or departmental folder. Review permissions at the same time. A leaver may have been the only owner of a folder, or may have shared files with external parties who should no longer have access.
Keep a UK GDPR record trail
UK GDPR accountability is not about keeping everything. It is about being able to show what you did and why. For each leaver, keep a short record covering the date access was removed, the systems affected, the devices returned or wiped, the file and mailbox transfer, and the retention or deletion decision. If a device is not returned, log that as a potential incident and assess whether personal data was at risk.
Do not keep the leaver's personal data longer than necessary. The record should support accountability, not become an unofficial archive. A simple spreadsheet or service-desk ticket is usually enough, provided it is consistent.
Mirror the first day
The strongest leaver process is the mirror image of onboarding. The same asset register, the same access matrix and the same named owner should appear at both ends of employment. Test the routine once a quarter with a dummy leaver, and fix the gaps before a real departure exposes them. A controlled exit is not distrust. It is good housekeeping, and it makes the business more resilient.
