Who Has the Keys? Removing Access When Someone Leaves

The account nobody closed

When someone leaves a small business - an employee, a contractor, a bookkeeper, a web person you used for a year - the paperwork usually gets handled. The accounts almost never do.

The email address stays active. The login to your website still works. The shared password for the accounting software was never changed. Months later, a former contractor still has a key to your business and nobody has thought about it since the day they left.

Most of the time nothing comes of it. When something does, it's expensive and it's completely avoidable.

Why this happens

It isn't carelessness so much as arithmetic. A small business accumulates dozens of logins over the years: the website, the domain registrar, the host, email, accounting, payroll, the payment processor, social media, the scheduling tool, the phone system, the review sites. Nobody wrote them down. There is no list, so there is no checklist, so nothing gets removed.

The second reason is that access is often shared rather than assigned. If three people use one login, you can't remove one person's access without disrupting everyone.

Make the list before you need it

The whole fix starts with an inventory. One document, one spreadsheet, or better, a password manager, listing every account the business depends on and who can get into it.

Write down, for each one: what it is, who the account belongs to, who else has access, and what happens to the business if it's lost. That last column tends to be the eye-opener. A social media login is annoying to lose. Your domain registrar is a business-ending loss.

Building the list takes an afternoon. Not having it costs you far more the first time it matters.

Give people their own logins

Wherever a tool supports separate users, use them. Individual accounts are how you remove one person cleanly, and they're how you find out later who actually did something.

Shared passwords look simpler and they're the reason offboarding turns into a scramble. If a tool truly only allows one login, keep it in a password manager and plan to change it when someone leaves.

Also worth checking: who owns the account, not just who can use it. If your website, your domain, or your business listing is registered under a former contractor's personal email address, you don't control it. You've been borrowing it.

The day someone leaves

Have a short, boring routine and run it every time, even for friendly departures:

• Turn off email access first, since email is how most other passwords get reset.
• Remove them from every tool on the list, or change the password where access was shared.
• Move anything registered in their name into a business account you control.
• Get the files. Anything on their personal device or personal cloud storage that the business needs.
• Check the money paths. Payment processors, banking access, expense cards, anything that can move funds.

The bottom line

Offboarding is one of those tasks that feels unnecessary right up until the moment it isn't. Almost every access problem I see in small businesses traces back to someone who left years ago and was never actually removed.

Write down what accounts you have and who can reach them. Give people their own logins. Then, when someone moves on, you close the door in twenty minutes instead of wondering for the next three years whether it's still open.