Small business technology
What to do before a staff member or contractor leaves
A simple offboarding checklist for small businesses without a formal IT department.
What you will learn
You'll know which accounts, devices, files and access points to review before someone leaves.
Before you continue
Do not delete accounts, files or mailboxes until business records and ownership have been checked.
Stop and get help if you are unsure who owns an admin account, whether records must be retained or whether a personal device contains business data.
Start before the final day
Offboarding is easier before access is lost or a device is returned in a hurry. Make a short list of the accounts, devices and files the person uses for work.
Keep the tone practical and respectful.
Check individual accounts
If the person has their own login, plan when it should be disabled or changed. This may include email, cloud storage, bookkeeping, social media, website, point-of-sale or booking systems.
Do not delete an account until you understand what business information is attached to it.
Review shared accounts carefully
Shared accounts are harder to manage because one password may be known by several people. If a shared account cannot be replaced yet, change the password and review recovery details.
Move towards individual accounts where possible.
Transfer important files and ownership
Check that business documents, photos, website assets, customer records and admin ownership are still available to the business.
Forwarding or copying email should be handled carefully because it may include personal or confidential information.
Collect devices and remove access
Return business computers, phones, keys, backup drives and security tokens. Remove access to remote support tools, cloud storage and password vaults where relevant.
If the person used their own device, get advice before wiping or changing anything.
What to expect
You have a practical offboarding list and know which access needs to be changed or reviewed.
Sources and further reading
- Small business cyber security guide · Australian Signals Directorate
Supports avoiding shared accounts and reviewing access when people leave.