By the time an employee hands in their notice, the decisions that will make their departure clean or messy have already been made. They were made in the first weeks of that person’s tenure, when nobody was paying close attention because the new hire had just arrived and there were a hundred other things to do. A shared login here, a quick software sign-up there, a personal laptop used until the company hardware showed up. By month six, none of those feel like decisions at all. They feel like how things are.
This post covers what’s really going wrong when offboarding drags on for three weeks, the four onboarding shortcuts that guarantee a painful exit, how to close the gaps on the team you already have, and what your IT provider should actually be doing when someone new joins your company.
What’s Really Going Wrong When Offboarding Takes Three Weeks
A clean offboarding takes about 90 minutes of IT time. An account gets disabled in your identity system, which automatically cuts off access to every connected tool in one action. The device is wiped remotely or collected and wiped on-site. Email gets forwarded to a manager or converted to a shared mailbox. The departing person’s access in your CRM and project tools gets reassigned. A handover document, already templated because it was templated at onboarding, gets filled in and filed.
The messy version of that same process can eat three weeks. It starts with a manual list of tools nobody can fully remember, which usually means asking the departing employee to help reconstruct it. You find a project board here, a video tool there, a shared workspace and a database, all set up independently, all with passwords sitting in the departing employee’s personal password manager. The laptop is at their house and they’re not in any rush. A client emails to say they received a strange message from a personal address. Six weeks later, a vendor charges the company card for a seat you thought you cancelled.
Whether your offboarding is clean or chaotic comes down entirely to what was set up during onboarding. Identity management professionals refer to this as the “joiner, mover, leaver” lifecycle. Microsoft and most identity vendors use the same three-phase model. A rushed joiner phase compresses months of identity cleanup into the two weeks after a resignation lands.
Four Onboarding Shortcuts That Guarantee a Messy Exit
Letting New Hires Sign Up for Software Tools on Their Own
When a staff member signs up for a tool independently, using their work email and a password only they know, that account is functionally theirs. You can’t reset it without triggering a notification to them. You may not even know the account exists until a vendor invoice shows up, or until the account goes dark after they leave and a client project breaks.
This is the most common source of the “we can’t find half the logins when someone leaves” problem. The fix is routing every tool through a central login system, where any new software application gets connected before the first user ever signs in. Think of it like issuing a single master key that opens every door in the building. When someone leaves, you take back the master key and every door locks at once.
Tolerating Personal Devices “Just Until We Get Them Sorted”
Personal devices that get used for work don’t stay temporary. The employee installs apps, connects to client systems, downloads files, and what was a two-week workaround becomes how they work permanently. When they leave, you have no ability to wipe company data from a device you don’t own and never formally enrolled in a management system. You’re relying on their goodwill, which is usually fine, but goodwill is not a security control.
The fix is to issue company-owned devices on day one and enroll them in a device management system. When you do allow a personal device, require that company email and files are only accessible through managed apps that can be remotely disconnected. Browser-saved passwords are not a substitute for that.
Shared Logins for Tools You Didn’t Want to Pay Per-Seat For
Shared credentials are the worst offender at offboarding time. When five people use the same login for a tool, you can’t remove one person’s access without changing the password for everyone. You usually discover this at the worst possible moment, when the person leaving is the one who set up the account and nobody else remembers the password at all.
Per-seat pricing is the cost of doing this properly. The money you save from shared logins reappears during offboarding as wasted hours and exposed access. It’s not actually savings.
Letting Client Relationships Live in One Person’s Inbox
This one hits especially hard for professional services firms. When a senior account manager, attorney, or consultant leaves, their client relationships often leave with them. The context, the email history, the preferences, and the half-finished threads all lived in one person’s inbox. With that person gone, all of it becomes inaccessible or awkward to retrieve. From the client’s perspective, your business just doesn’t know who they are anymore. That’s a hard phone call to make.
The fix is a shared inbox or CRM where client communication is logged consistently. Even a Microsoft 365 shared mailbox with a clear expectation that client threads are copied to it is a meaningful improvement over what most small businesses have today.
How to Retrofit Better Habits on the Team You Already Have
Most businesses need to clean up the team they already have before the next hire arrives. You can’t go back and re-onboard your existing staff, but you can audit what’s there and close the gaps before the next departure catches you off guard.
The SaaS Audit
Pull three months of credit card statements for every card used for business expenses. List every recurring software charge. For each one, find out who set it up, who has the login, whether the account uses a personal or company email, and whether anyone else could access it if that person left this week.
You’ll find tools nobody remembers signing up for, accounts where the original owner has already left while you’re still paying for the seat, and logins that only one person controls with no backup. None of this requires technical expertise. A spreadsheet and an afternoon will get you most of the way there.
The Device Register
Build a simple list: who has what device, when it was issued, whether it’s enrolled in a management system, and what company data it can access. Ask every staff member to confirm the devices they use for work, including personal ones. Most employees are perfectly willing to confirm this once they know nothing punitive will come of it. The goal is just to map what you’re actually working with.
For any personal device that has been used to access company systems, the minimum is making sure company email and file access happens through managed apps that can be remotely disconnected when needed.
Client Communication in Shared Places
Move client communication into shared places so the relationship belongs to the business when an individual moves on. Set up a shared inbox or alias for client-facing communication, and use a CRM where contact history and notes are logged. The goal is continuity. When a relationship lives only in one person’s inbox, it leaves when they do.
What Your IT Provider Should Be Doing at Onboarding
Most IT providers get called when someone resigns. They show up, disable the account, collect the laptop if they can find it, and do their best with whatever documentation exists. That’s the wrong end of the process to be involved in. If your IT provider only shows up when someone leaves, you’re not getting much value from the relationship.
The model that actually works puts your IT provider at the start of the process too. They set up the new account in your identity system, enroll the device in your device management platform, and connect every tool the new hire will use to a central login so that access can be revoked in one action when the time comes. They should also maintain a handover document for each staff member, updated periodically, listing every system the person accesses, every client relationship they own, and every credential tied to their identity.
When that’s in place, offboarding becomes a checklist and an hour rather than a three-week excavation. Ask your IT provider what they do at onboarding. If the answer is “not much” or “we usually get called when someone leaves,” that’s worth a direct conversation.
A 60-Day Plan Before Your Next Round of Departures
You don’t need to know the exact date of the next resignation to start. The work is more manageable when nothing is urgent, and like any sensible New Orleans business owner knows from hurricane season prep, waiting until the storm is named is the wrong time to start boarding up the windows.
Weeks 1 and 2: Run the credit card SaaS audit. Build a list of every tool, every account owner, and every login that only one person controls. Flag the ones where access would be lost or complicated if that person left this week.
Weeks 3 and 4: Build the device register. Confirm what every staff member uses for work. For personal devices with company access, implement managed app access at minimum. Enroll company-owned devices in a management system if they aren’t already.
Weeks 5 and 6: Audit client-facing communication. Identify any client relationships that exist primarily in one person’s inbox or on someone’s personal phone. Set up shared mailboxes or CRM logging for the highest-risk accounts first.
Weeks 7 and 8: Write the onboarding process you wish you’d had from the start. Use everything you found in the previous six weeks as the input. Apply it to your next hire from day one, and use it as the template for a handover document for every existing staff member.
Most of this is an operational task rather than a technology project. A spreadsheet, some honest conversations with your team, and a few hours of your IT provider’s time will cover the bulk of it.
Frequently Asked Questions
How long should offboarding take in a small business?
With proper setup and centralized identity management, the IT side of offboarding takes about 60 to 90 minutes. Take that foundation away and the same task can stretch to two or three weeks of scattered cleanup.
How do I find software tools my team signed up for without telling me?
The fastest method is a three-month review of every credit card statement used for business expenses. Most unsanctioned software shows up as a recurring charge somewhere on the card.
Can I wipe a personal device after someone leaves?
Only the company data, and only if you set that up while they were still employed. Device management tools like Microsoft Intune let you remove company email, files, and credentials from a personal device without touching the rest of it. If those tools weren’t in place during their employment, your options are limited.
What does single sign-on have to do with offboarding?
Single sign-on means every tool a user accesses is tied to one central identity. Think of it like a master keycard for a building. Deactivating that one card in a central system locks every door at once. Without it, you have to manually log into each platform and remove the user one by one.
Should my employees use only company-owned devices?
Where practical, yes. For personal devices, enrolling them in a management system or requiring managed app access is the next best thing. Microsoft’s guidance on personal device access outlines how to balance flexibility with control. A personal device with saved company credentials and no management in place is the highest-risk configuration you can have when someone leaves.
If you’re not sure whether your current onboarding process would hold up when your next key employee gives notice, that’s exactly the kind of question Bourn Technology can help you work through before it becomes a problem. We help Greater New Orleans businesses build the kind of onboarding foundation that makes departures manageable, not chaotic. Reach us at (504) 262-1234 or hello@go.bourntech.com to start the conversation.