Offboarding: What 14 Departures Revealed About Access and Knowledge

In 14 departures over eighteen months, access was fully revoked in 9 cases and the median time to complete revocation was 11 days. The other five left at least one system reachable, in two cases for over two months.

The company had 65 employees at the end and about 28 systems. Offboarding was a checklist held by one person in people operations, and the checklist had been written when there were nine systems.

What the checklist covered

It covered the laptop, the main identity provider, the email account, payroll and the code repository. Those five were reliably handled, because they were the five that produced an immediate visible problem if missed.

Everything else depended on a manager remembering to tell someone, which is a system that works when managers are calm and fails when they are not.

The five incomplete cases

Two people still had access to a shared analytics account that used a team password rather than individual identity. One still had an active session on a support tool for 68 days. One retained access to a document store because the sharing was set at a folder level that nobody owned. One had a contractor account at a payment provider that was not on the checklist at all.

Four of the five were accounts shared by more than one person, which is exactly where individual revocation fails.

The knowledge problem

Access is the measurable part. Knowledge is the part that costs more. Of the 14 departures, 9 had been the only person who knew how a particular process worked, and 6 of those processes had no documentation.

Three processes broke visibly within a month. A fourth was discovered four months later when a report stopped running.

The exit interview finding

When asked what would be hardest to replace, 11 of 14 named a specific task rather than a role. The answers were concrete: the quarterly reconciliation, the vendor renewal calendar, the way the staging environment is rebuilt after a failure.

That question is more useful than any question about culture, and it had never been asked before.

The handover week

A handover week was introduced, with one requirement: the departing person writes down the three tasks they named as hardest to replace, and someone else performs each one while they are still there.

Performing is the operative word. A document written by an expert is often unreadable to a successor, and the gap only appears when someone tries to follow it.

The access sweep

The checklist was replaced by a sweep, generated from the identity provider’s list of connected applications rather than from a hand-written list. That list changes, so the sweep is regenerated before each departure instead of being maintained.

Median revocation time fell to two days, and the two remaining incomplete cases were both shared accounts, which the company is now migrating to individual identity.

What still breaks

Knowledge still breaks. The handover week catches the three named tasks and nothing else, and a departure is not a good moment to document a whole role.

The company’s own view is that the handover week reduced the damage rather than preventing it, which is an accurate description of most offboarding processes.

Eighteen months on

Nine of 14 departures once had complete revocation, after a median of 11 days. The last four departures were all complete within two days, and the handover week has run four times with three documented processes produced each time.

The laptop that came back

Nine of 14 laptops were returned within a week, three within a month, and two never. The two were contractors whose equipment was their own, which the checklist had treated as an employee case and skipped.

Asset tracking and access revocation were run by different people with different lists, which is how a person can be removed from every system while a device registered to them remains active.

Fourteen departures revealed five open doors and nine single points of knowledge. The doors are closed faster now, and the knowledge leaves with a shorter tail than it used to.