When someone leaves: an account offboarding checklist for small businesses
In a small business, it is common for someone's email and cloud accounts to keep working long after they have left.
The person doesn't have to be malicious for this to be a risk. A forgotten account with a reused password is an open door.
Japan's Information-technology Promotion Agency (IPA) publishes a security guideline for small and medium-sized businesses. Version 4.0 (March 2026) covers what to do when people leave, and this article turns it into a checklist you can use.
In this article:
- what the guideline asks for when someone leaves
- what to switch off, change and collect
- a checklist you can copy
What the guideline says
In summary, version 4.0 says to:
- change or remove sharing settings promptly when staff move roles or leave
- collect information, devices, IDs and keys when someone leaves or a contract ends, erase data so it cannot be recovered, and make this visible with a checklist or records
- set rules for reviewing access so that permissions are not left behind after a move or departure
- avoid shared IDs, and where one is unavoidable, make it possible to tell who used it
In short: switch off, collect, erase, and record.
1. Switch off on the last day
Do this on the person's last day, once their work is done.
- company email
- cloud storage (Google Drive, OneDrive, Dropbox and so on)
- chat (Slack, Teams and so on)
- business apps: accounting, payroll, CRM
- online banking user IDs
- VPN or remote access
- admin roles on social media and ad accounts
Hand over data before you delete anything. In some services, deleting an account also deletes that person's files and email. Block the sign-in first (reset the password or suspend the account), move what the business needs to someone else, and only then delete.
2. Change shared passwords
Small teams often share one login. Change every shared password the person knew.
- Wi-Fi
- shared email inboxes and social media accounts
- admin pages for printers, network storage (NAS) and security cameras
- shared logins for supplier or customer portals
If you are not sure which ones they knew, list them all and change them all. Over time, replace shared logins with individual accounts so the next departure is easier.
3. Collect
- laptops, phones and tablets
- USB drives and external disks
- keys and access cards
- paper files
Before a device goes to someone else or is disposed of, erase it so the data cannot be recovered (follow the manufacturer's instructions for a full reset).
If the person used their own phone for work email or chat, ask them to sign out and remove the work account, and sign the device out from the admin console as well.
4. Record
Write down what was switched off, when, and by whom. It lets you check nothing was missed, and it is your record if questions come up later.
Checklist you can copy
Leaver: _ Last day: _ Done by: __
Switch off (on the last day) - ☐ Email (also check forwarding and auto-reply rules) - ☐ Cloud storage (also check who owns shared links) - ☐ Chat - ☐ Business apps (accounting, payroll, CRM) - ☐ Online banking user ID - ☐ VPN and remote access - ☐ Admin roles on social media and ad accounts
Hand over (before deleting) - ☐ Email, files and calendar moved to the new owner - ☐ Customers and suppliers told who their new contact is
Change - ☐ Wi-Fi password - ☐ Shared email and social media logins - ☐ Printer, NAS and camera admin pages - ☐ Shared portal logins
Collect and erase - ☐ Laptop, phone, USB drives - ☐ Keys and access cards - ☐ Work accounts removed from personal phones - ☐ Returned devices erased
Record - ☐ This checklist saved with the date and name
Use the same list when a contractor, temp or part-timer finishes.
Things that make the next one easier
- Keep a list of who uses which service
- Replace shared logins with individual accounts
- Use a business password manager, including for any passwords you must share
- Turn on multi-factor authentication
Check for reused passwords
If you are worried that a password the person knew is reused elsewhere, I made PassAudit, a checker that reads a password export (CSV) from your browser or password manager and lists reused, weak and similar passwords. It runs entirely in your browser, and passwords are not sent anywhere. Delete the exported file as soon as you are done.
You can open the trial from "Free tools you can use" below this article.
Summary
- When someone leaves: switch off, collect, erase, record
- Switch accounts off on the last day, and hand over data before deleting
- Change every shared password the person knew
- Collect devices and erase them so data cannot be recovered
- Keep a dated checklist
Source: IPA, Information Security Guidelines for SMEs (Japanese, version 4.0, March 2026)
General information. This article was drafted with the help of AI and checked against the IPA guideline text on 2026-10-21. For service-specific steps, see each service's official help.