# Offboarding: the forgotten accounts that put you at risk > Forgotten accounts, shared passwords and unused software tools can keep access open after someone leaves, and that is also a privacy event. - URL: https://nextit.tech/blog/offboarding-the-forgotten-accounts/ - Language: English - Other language: https://nextit.tech/fr/blogue/depart-d-un-employe-les-comptes-oublies/ - Publisher: NextIT (https://nextit.tech/) --- [Blog](https://nextit.tech/blog/) # Offboarding: the forgotten accounts that put your business at risk NextIT Security Team Oct 15, 2026 5 min read A departure looks simple: a person returns a laptop and leaves the office. Yet their accounts may stay open, and each open account is a way into your data. The person who uses it may be the former employee, or someone who knows their password. ## What orphan accounts are An orphan account is an account that stays active after its owner has left. Nobody reviews it. Think of an office key that a former employee keeps. The lock still works, and nobody changes it. The longer an account stays open, the harder it is to know whether anyone used it. Orphan accounts appear for ordinary reasons. Nobody decides to leave an account open. Usually the obvious accounts close first, such as email. The less obvious accounts stay open, because nothing in the process reaches them. Three habits make the problem worse: - **Tool sprawl:** your team signs up for many software as a service (SaaS) tools, and each one holds its own accounts. - **Shared passwords:** several people use one login, so no one can tell who did what. - **Missing lists:** nobody records which accounts a person owns, so nobody closes them. Each new tool adds one more place where a person may hold an account. A file-sharing site, a project board, a note app and a survey tool can each keep a login for the same employee. Without a list, those accounts are easy to forget. A shared password also hides the truth. Once a person knows it, that person keeps access until you change it. Changing it means updating everyone who uses it. ## Why a departure matters for your business An open account can let a former employee read, change or delete company files. It can also let someone who holds a copied password enter your systems. A departure is also a privacy event. When a person leaves, their access to personal information must stop. If the access continues, your business may have a confidentiality incident. Law 25, the Québec privacy law, requires you to keep a register of confidentiality incidents, whatever their severity. PIPEDA (Personal Information Protection and Electronic Documents Act) lists safeguards as one of its ten fair information principles. It also requires you to record every breach of security safeguards, and to keep that record for 24 months. Access problems also cost time. When an open account is found months later, someone must work out what the person could see, what they changed, and whether data left the company. A checklist on the last day avoids that work. Your clients trust you with their information. If a former employee can still read a client file, the client may ask how you missed it. A clear departure process protects that trust. The same check applies when someone changes role. A person who moves to a new team may keep access to the old team’s files. Review access at each change, not only at departure. ## How to approach it: a 10-step offboarding checklist Name one person to own the process. This can be the owner, an office manager or the person in charge of personal information. Start the checklist when you learn the departure date, not on the last day. The earlier you start, the fewer accounts you miss. A good process has three parts: a complete list, a set end time and a written record. Use this checklist for every departure, including contractors, interns and temporary staff. 1. List every account the person has, including email, the company login, shared folders and each SaaS tool. 2. Ask the manager which files, folders, client records and shared calendars the person owns. 3. Name a new owner for each of those items. 4. Choose the exact time that access ends, usually the end of the last shift. 5. Collect company devices, badges and security keys. 6. Disable the email and the company login at that time. 7. Change each shared password the person knew, and each password stored in a shared tool. 8. Remove the person from groups, teams, shared channels and distribution lists. 9. Revoke every app and artificial intelligence (AI) assistant the person connected to company data. 10. Check each system on your list. Confirm that the account shows as closed, then record the date. Review the list with the manager before the last day. Managers often know a tool that the list missed. **Good to know:** Keep one list for all departures. Update it each time your team adopts a new tool. ## The last day versus the first week ### On the last day Close access at the end of the last shift. Collect devices, badges and security keys before the person leaves. Change the shared passwords the person knew. Do not wait for an exit interview or a final paycheck to do it. ### Within the first week Check the list again. Confirm that each system shows the account as closed, and that each owned item has a new owner. Record any access that stayed open in your incident register. Note the date of the review. ## Common mistakes - Waiting for a meeting before closing access. Access should end on time, not on the meeting agenda. - Disabling the email but forgetting the SaaS accounts. - Deleting an account before moving its files and mail. The data can go with it. - Keeping a shared password because everyone already uses it. - Leaving the former employee as a member of a shared mailbox, so they can still read its messages. - Forgetting contractors, interns and temporary staff. - Trusting memory instead of a written list. ## How NextIT helps NextIT is a platform for small and medium-sized businesses (SMBs) in Québec and Canada. Its Integrations Hub shows who has an account in each connected system. It also supports offboarding a person across those connected systems. The software inventory keeps your software list, with costs, in one place. To learn how the hub works, read [Integrations](https://nextit.tech/docs/integrations/). To see the platform with your own team, [book a demo](https://nextit.tech/book-a-demo/). Free posture report ### Is your business exposed? Find out in 5 minutes. Enter your domain. Confirm ownership by email, then get your free security posture & compliance report. [Book a strategic meeting](https://nextit.tech/book-a-demo/) - No card required - Hosted in Canada NextIT Security Team Security, Law 25 compliance and IT governance for SMBs. ### About the author The NextIT Security Team runs the domain scans and the posture scoring, and writes about the fixes that move a security score the most. ### More articles from NextIT - [ISO/IEC 27001 explained for SMBs: the standard, the controls and the audit Oct 27, 2026](https://nextit.tech/blog/iso-27001-explained-for-smbs/) - [Law 25 explained: what Québec’s privacy law asks of SMBs Oct 27, 2026](https://nextit.tech/blog/law-25-explained-what-quebecs-privacy-law-asks-of-smbs/) - [The NIST Cybersecurity Framework 2.0, explained for small businesses Oct 27, 2026](https://nextit.tech/blog/nist-csf-2-explained-for-smbs/) - [SOC 2 explained for SMBs: what the report covers and how to prepare Oct 27, 2026](https://nextit.tech/blog/soc-2-explained-for-smbs/) - [Compliance 101 for SMBs: frameworks, controls and evidence in plain words Oct 15, 2026](https://nextit.tech/blog/compliance-101-frameworks-controls-and-evidence/) ## Scan your company. Or let's talk strategy. Get your free posture report in 5 minutes — or book a strategic meeting with our team. [Book a strategic meeting](https://nextit.tech/book-a-demo/) No credit card required · Bilingual FR / EN · Hosted in Canada