Employee offboarding checklist for small businesses

When someone leaves a small business, nobody “owns” offboarding. The owner handles pay, a manager collects the keys, and the logins get forgotten. Surveys keep finding the same thing: many former employees say an old work password still worked after they left. This checklist covers everything a person usually has, in the order to deal with it.

Track it in Handover

Before their last day

Confirm their last day and tell the people who handle each item.
List everything they have: every app account, shared login, device, key, badge and card.
Agree who inherits their email, files, customers and open work.
Ask them for anything only they know: passwords to vendor portals, where files live, accounts they set up.

On their last day

Turn off their main work account (Google Workspace or Microsoft 365) on their last day, at the end of their final shift.
Sign them out of every device and session, not just the password. A changed password doesn’t always end an open session.
Remove them from every other app, including ones they signed up for themselves with a work email.
Change every shared password, door code and alarm code they knew.
Collect laptops, phones, keys, badges and company cards, and write down serial numbers.

After they leave

Remove them from payroll and benefits and confirm final pay.
Forward or monitor their email for a few weeks so customers aren’t lost.
Check bank, card and vendor portals for their name as an authorized user.
Update your website, email signatures and directories.
Save a dated record of what was done and by whom.

Questions

How soon should a former employee’s access be removed?

On their last day, ideally at the end of their final shift. If they are let go, remove access at the time you tell them, or just before.

Should I delete their email account?

Usually not straight away. Suspend or block it, move their mail and files to someone else, and delete it later once nothing more arrives. Deleting too early can lose customer emails and files.

Why change shared passwords if they returned everything?

Because they still know them. Wi-Fi passwords, the alarm code, the bank login several people share, the social media account: anything several people know has to be changed when one of them leaves.