An employee offboarding checklist for small business is one of the simplest security tools you can have, and one of the most often skipped. When someone leaves, the focus is usually on the goodbye, the handoff of work, and finding a replacement. Shutting off their access to email, files, and business apps tends to land on whoever remembers to do it, whenever they get to it.
That gap matters. This guide explains why departing employees are a real security risk even when they leave on good terms, and gives you a seven-step employee offboarding checklist for small business that you can use the next time someone gives notice, or the next time you have to let someone go.
Key Takeaways
- Offboarding is a security process as much as an HR one. Every account a person can reach is a door that should be closed on their last day.
- In a 2026 Sagiss survey of 1,000 U.S. adults, 79% of former employees said at least one work account or access point kept working after they left.
- The same survey found the rate was 82% for people who left companies with fewer than 250 employees.
- An employee offboarding checklist for small business, with a clear owner and an up-to-date list of accounts and devices, prevents most of the gaps.
- Disabling access is not the same as changing a password. Sessions, devices, shared logins, and connected apps all need attention.
Why Employee Offboarding Is a Security Issue
Most people who leave a job have no plans to cause harm. The risk is usually quieter than that. An old account that still works can be misused if a password is stolen, if a laptop is lost, or if a former employee’s personal email is compromised. Lingering access also means a former employee may still be able to see customer information long after they should.
The numbers suggest this is common. In its 2026 Offboarding Security Report, managed IT and security provider Sagiss surveyed 1,000 U.S. adults who had left a job in the past five years that involved computers or company systems. Of those former employees, 79% said at least one work account or access point kept working after their last day, and 64% said they could still see or reach at least one category of sensitive company information, such as customer details or financial records.
Two cautions are worth stating plainly. This is a vendor-published survey, and the results are self-reported by former employees rather than verified by technical testing. Still, the pattern is useful for any business owner to see, because it points to a process problem that an employee offboarding checklist for small business can fix, rather than a technology problem.
Why an Employee Offboarding Checklist for Small Business Matters
The same survey found that 82% of former employees who left companies with fewer than 250 employees said they had lingering access, compared with 70% at companies with more than 1,000 employees. The survey also found that 33% of former employees said it was not clear who at their company was responsible for shutting off access, and 33% said their employer did none of the offboarding steps the survey asked about.
That fits what many smaller businesses experience. There is no dedicated IT department, the person who set up the accounts may have moved on, and the departure may be handled by a manager who is also doing three other jobs. Nobody is being careless. There is simply no written process, so steps get missed.
For firms that handle confidential client information, such as law firms, architects, and construction companies, an overlooked account can also be a compliance and client trust problem, not only an IT one.
The Three Stages of Offboarding
It helps to think of offboarding as three stages rather than one task on the last day.
Your Employee Offboarding Checklist for Small Business: 7 Steps
1. Name one owner for offboarding
The survey’s finding that one in three former employees said it was unclear who was responsible is a reminder to decide this in advance. Name one person who is accountable for each offboarding under your employee offboarding checklist for small business, with a backup. In many small businesses this is an operations manager or office manager working with HR and an IT provider. What matters is that everyone knows who it is.
2. Keep a current list of accounts and devices
You cannot close a door you do not know exists. Keep a simple, up-to-date record of what each person uses: email, file storage, line-of-business software, accounting and payroll systems, vendor portals, shared mailboxes, and any company laptop, phone, or tablet. Update it when people change roles, not only when they leave. This list is the foundation of everything else on the checklist.
3. Plan the timing with HR
Decide in advance when access will be turned off. For a routine resignation, that may be the end of the last day. For a sudden or difficult departure, it may be before the person is told. Either way, agree the plan between HR, the manager, and whoever handles IT, so that access is not disabled too early or left running too late. If a departure involves a dispute or legal concerns, involve your HR advisor or legal counsel before acting.
4. Disable accounts, and end active sessions
Resetting a password is not enough. A person may still be signed in on a phone, a home computer, or a browser. Disable the account, sign out of all active sessions, remove any registered devices, and remove their multi-factor authentication methods. Our guide to multi-factor authentication for small business explains why this layer matters so much and how to roll it out well.
5. Handle email, files, and data on purpose
Before the account is removed, decide what happens to the contents. Who needs the mailbox, and for how long? Who takes ownership of the person’s files and shared documents? Do not delete anything in a hurry. Some records may need to be kept for business, legal, or contractual reasons, so check your retention requirements with counsel or your records policy before anything is permanently removed.
6. Recover equipment and clean up personal devices
Collect laptops, phones, badges, and any other equipment, ideally on the last day. In the Sagiss survey, only 28% of former employees said their employer collected equipment before they left, and only 16% said company email or apps were removed from their personal phone. If people use personal devices for work, make sure company data and email access can be removed from them, and that your policies say so clearly.
7. Close the side doors: shared logins, vendors, and contractors
The riskiest access is often the kind that is not tied to one person. Shared passwords for software or social media, admin accounts, vendor portals, and wireless network passwords all need review when someone who knew them leaves. The survey found that contract and temporary workers had the highest rate of lingering access, at 89%. Treat them with the same employee offboarding checklist for small business as employees, and set an end date for their access when they start.
Why a Written Process Pays Off
An employee offboarding checklist for small business takes some of the guesswork and stress out of a hard moment. It also protects your business in two other ways. A consistent process treats every departure the same way, which matters if a departure is ever questioned. And a record of what was done and when gives you something to point to if there is a later concern about access to client information.
Offboarding also connects to other risks. Departing employees’ accounts can be used in business email compromise for small business scams if they are left active, and old credentials can show up for sale after a breach, which is why dark web monitoring for small business is a helpful companion to a good offboarding process.
How Courant Can Help
A good offboarding process depends on knowing what accounts and devices exist and being able to turn them off quickly and completely. At Courant, we help New Orleans area businesses keep that picture current and build an employee offboarding checklist for small business that fits how they already work, so a departure does not turn into a security gap.
Frequently Asked Questions
What should be on an employee offboarding checklist for small business?
A good checklist covers a named owner, a current list of accounts and devices, agreed timing, disabling accounts and ending active sessions, handling of email and files, recovering equipment, and reviewing shared logins, vendor portals, and contractor access.
When should access be removed for a departing employee?
That depends on the circumstances. For a routine resignation, access is often turned off at the end of the person’s last day. For a sudden or sensitive departure, it may need to happen earlier. Agree the timing in advance with HR and whoever manages IT.
Is changing someone’s password enough?
No. A password reset does not necessarily end sessions that are already signed in, remove registered devices, or close connected apps and shared logins. Disable the account, end active sessions, and review the other access the person had.
Should we delete a former employee’s email and files?
Not right away. Decide who needs the mailbox and files, and check any retention requirements with your legal counsel or records policy before anything is permanently deleted.
How should we handle contractors and temporary workers?
Treat them with the same checklist as employees, and set an end date for their access when they start so it does not depend on someone remembering later.
Make Your Employee Offboarding Checklist for Small Business a Habit
An employee offboarding checklist for small business only works if it is written down, owned by someone, and used every time. The steps are straightforward, and the payoff is knowing that when someone leaves, their access leaves with them.
If you would like help building an offboarding process or checking what access former employees may still have, schedule a 15-minute consultation with our team, or contact us with your questions. We will help you close the gaps before they become a problem.
