A business owner told me something that still sticks with me. Her bookkeeper had left five months earlier, on decent terms, no drama. Then one day she got a password reset email from her bank's online portal. She hadn't asked for it. When she checked, the bookkeeper's login still worked. Five months of bank statements, invoices, and customer emails had been sitting there, wide open, and nobody had thought to close the door.
This is not a story about a bad employee. It's a story about a normal, busy small business that never wrote down what to do on someone's last day. That gap is more common than most owners realize, and it is one of the easiest things to fix once you see it clearly.
Why This Gets Forgotten
When someone leaves your business, your head is full of other things. Maybe you're sad to see them go. Maybe you're relieved. Maybe you're scrambling to cover their work for the next few weeks. Whatever the reason, access to email and software is almost never the first thing on your mind, and that's completely understandable.
The problem is that access doesn't pause itself just because nobody's thinking about it. A login stays active until someone actively turns it off. If nobody owns that job, it simply doesn't happen. I've seen it skipped after friendly departures, after layoffs, and after firings alike. Emotion isn't the real cause here. The real cause is that there's no checklist, no single person responsible, and no set moment when it happens.
Small businesses are especially exposed here because one person often wears many hats. The office manager who set up the accounting software might also be the one who knows the Wi-Fi password and the alarm code. When that person leaves, closing their access means touching five or six different systems, not just turning off one email account. Without a written list, it's easy to close the obvious one and miss the rest.
The Simple Checklist
You don't need fancy software to get this right. You need a short list you run through every single time, for every departure, no matter how the person left. Here's what belongs on it:
- Email. Change the password or disable the account immediately. Decide who should receive messages that come in afterward, and set up a forward or an auto-reply.
- Shared drives and documents. Google Drive, Dropbox, OneDrive, whatever you use. Remove the person, not just from the main folder, but from anything they may have shared individually.
- Financial tools. Banking portals, accounting software, payroll systems, payment processors. These are the highest-risk accounts on the list, and they're often the ones people forget because they don't think of the bookkeeper or office manager as a "systems" person.
- Business social media. Instagram, Facebook, LinkedIn company pages. If someone managed your accounts, check whether they know the password and whether they're still listed as an admin.
- Physical access. Keys, key fobs, alarm codes, and any door codes that were shared verbally. Change the code if it's a shared one everyone knows.
Write this list down once, in a document or even a checklist app, and use the same one every time. The goal isn't to build something complicated. It's to make sure you never have to remember all of this from memory while you're also dealing with everything else that comes with someone leaving.
Why Timing Matters More Than People Think
Here's the part that surprises most business owners: it's not enough to eventually get around to it. The gap between someone's last day and when their access actually gets cut off is where the risk lives.
Most of the time, nothing bad happens during that gap. The former employee has moved on and isn't thinking about your accounts either. But "most of the time" isn't the same as "always," and the accounts that matter most, like bank logins and customer data, are exactly the ones you don't want left open on a maybe.
There's also a simpler, less dramatic reason to close access on the same day: mistakes happen. A former employee might get an automated email meant for a customer, and reply to it out of habit before realizing they shouldn't have. Or a bill might land in an inbox that's not being watched by anyone at your company. None of this requires bad intent, just an open door and enough time for something to fall through it.
The fix is simple even if it takes a small mental shift. Treat access removal as part of the same conversation as the goodbye, not a task for "sometime this week." If someone is leaving today, their access should end today, in the same afternoon if you can manage it. Studies on this keep landing in the same place: businesses that revoke access within a day of someone leaving have far fewer surprises than those that wait a week or more, and a surprising number of companies never fully finish the job at all.
Making This Routine, Not Paranoid
I want to be clear about something: this isn't about distrust. Most people who leave a job do so honestly and never think twice about their old logins. This is about not leaving the decision up to chance, the same way you'd lock the office door at night even though you trust your neighborhood.
The way to make this feel routine rather than dramatic is to apply it the same way, every single time, regardless of why someone is leaving. If it only happens when you're worried about someone, it becomes an accusation. If it happens for every departure, from the friendliest resignation to the hardest conversation, it's just how your business runs. That consistency is what keeps it from feeling personal.
A good habit is to build the checklist into whatever you already do when someone gives notice or is let go. Add it to the same to-do list as returning their equipment or processing their final paycheck. It becomes one more box to check, not a separate, awkward task you have to remember to start.
This connects to something else worth thinking about in your business: how you handle everyday password habits while people are still working for you. Clean offboarding is much easier when you already know who has access to what, rather than discovering it for the first time on someone's last day.
If you're not sure where your business stands on this, or you'd like help putting a simple checklist in place, I'm happy to walk through it with you.