When It’s Time to Let Go
Tonight is senior night. Football, cheer, and band seniors will be recognized at the game, and John and I will walk Josh across that field.
I already know I’m going to be a mess. Let’s be honest. I know he’s ready. We’ve spent eighteen years getting him ready to fly the nest, and he’s going to do amazing things. But he’s still my baby.
Here’s the thing I keep coming back to: getting ready to let go well is its own kind of work. You don’t wait until move-in day to teach them how to do laundry.
Business is a lot less emotional (most days), but there’s a parallel. People leave. Sometimes it’s a great next opportunity. Sometimes it’s just time to part ways. And sometimes it doesn’t end on good terms at all. Whatever the reason, how you handle that exit matters, and it matters a lot more for your security than most business owners realize.
Why Offboarding Is a Security Risk
When an employee or contractor leaves, they don’t automatically lose access to your business. Their email still works. Their login to your CRM still works. That shared Google Drive folder? Still shared. The password to your company Instagram? They still know it.
If the parting is friendly, that’s sloppy. If it isn’t, it’s dangerous.
Let’s talk worst case. A former employee or contractor who still has access could:
- Leak your data, including your clients’ data
- Take it to a competitor, along with your client list, pricing, and proposals
- Become your competitor, using your own playbook against you
- Dig for information to use against you, the kind of thing that ends up in a lawsuit, a bad review campaign, or worse
Most people who leave won’t do any of this. But “most people” isn’t a security strategy. Your clients trusted you with their information, and it’s your job to make sure it doesn’t walk out the door with someone else.
Your Offboarding Checklist
On (or before) their last day:
- Disable email access immediately. Don’t delete the account. That mailbox may hold client communications, contracts, and records you’ll need. Remove their access and forward or delegate the mailbox to someone on your team.
- Disable network and system access. VPN, Wi-Fi, servers, remote desktop: if they could log in to it, shut it off.
- Revoke access to shared files and folders. Check Google Drive, Dropbox, OneDrive, SharePoint, and anything they shared out to personal accounts. Transfer ownership of files they created so nothing disappears when the account does.
- Change every shared password. Social media, your website, Wi-Fi, vendor portals, the “team login” you all use. If they knew it, change it.
- Remove them from your apps. CRM, project management, Canva, scheduling tools, accounting software, your email marketing platform. Make a list. (More on that below.)
- Remove admin roles. Social media pages, your domain registrar, website hosting, payment processors. These are the keys to the kingdom.
- Remove their MFA devices and active sessions. Logging someone out of everything and removing their authenticator from shared accounts closes doors that a password change alone won’t.
- Collect company devices. Laptops, phones, keys, badges. If a device can’t be returned, remotely wipe it.
In the days after:
- Review recent activity. Large downloads, files forwarded to personal email, or bulk exports in the weeks before they left are red flags worth looking into.
- Let clients and vendors know who their new point of contact is, so nobody keeps sending sensitive information to someone who’s gone.
- Revisit your agreements. Remind them of any NDA, confidentiality, or non-solicitation terms in writing, and confirm company property and data have been returned.
- Document what you did. If something ever goes sideways, you’ll want a record showing you acted quickly and responsibly.
Offboarding Starts at Onboarding
Here’s the part nobody wants to hear: if you don’t know what someone has access to, you can’t take it away.
The easiest offboarding happens when you keep a simple access list from day one. Every time you give someone a login, a shared folder, or an admin role, write it down. A spreadsheet works. Then when it’s time to say goodbye, you’re working from a list instead of your memory at 9 p.m.
And yes, this applies to contractors, freelancers, and your VA too. Short-term help often gets the most access with the least tracking.
Letting Go Well
Tonight I’ll be walking across a football field with tears in my eyes, proud of the person my kid has become and trusting that we prepared him for what’s next.
You can’t control why people leave your business. You can control whether you’re ready when they do. Do the prep work now, so that when it’s time to part ways, the only thing they take with them is the experience.
Not sure what your team has access to, or where to start? Reach out to us at info@pdrmconsulting.com and we’ll help you build an offboarding process that actually protects your business and your clients.
