When an employee leaves a business, most companies focus on the obvious things. The resignation letter. The exit interview. The laptop handover. The slightly awkward farewell email.

What gets missed is everything happening quietly in the background. Email access. Shared folders. Password resets. Software subscriptions. Device control. Multi factor authentication. That invisible layer is where the real risk lives.

This is what we call the IT offboarding gap.

The offboarding gap appears when someone leaves and there is no structured technical process governing what happens next. An account gets disabled. Everyone assumes “it’s sorted.” A few weeks later someone asks, “Where are those client files?” Nobody knows. The new employee cannot find history. Management cannot locate key emails. The data is technically still there somewhere, but it is effectively lost.

We see this more often than we should.

An employee mailbox is not personal property. It contains client communication, supplier negotiations, approvals, attachments, and context that keeps the business moving. Before any account is decommissioned, that data must be secured properly. Where possible, mailboxes should be converted so that access can be handed to whoever takes over the role. In other environments, secure archives must be created. The principle is simple. Nothing gets deleted on assumption.

The same applies to file data. Documents stored in personal folders tied to a user account cannot simply vanish when that account is switched off. IT needs to be involved because we understand how the systems are structured and where data actually lives. We know what needs to move to shared storage, what needs to be archived, and what needs to remain accessible.

Let us be honest. Exiting staff members are not always cooperative. Sometimes they are helpful. Sometimes they have mentally clocked out weeks ago. That is precisely why the process must be structured. As much care as possible needs to be taken while access still exists. Once it is gone, recovery becomes far more complicated and far more expensive.

While we handle the technical side, we strongly recommend that businesses handle the communication side properly. Clients should be formally informed when someone leaves and told who is taking over the role. That prevents confusion, protects relationships, and avoids emails disappearing into inboxes that nobody monitors. Offboarding is not only technical. It is reputational.

Once preservation is handled, access control becomes the next priority.

Proper offboarding means revoking access across every system the employee used. Email. Remote access. Accounting platforms. Practice management systems. Cloud applications. Internal servers. Third party tools. It does not matter whether the business uses enterprise cloud platforms or simple hosted email. Access must be revoked completely and immediately.

If the departing employee had elevated permissions, those need special attention. Shared passwords must be changed where necessary. Administrative roles must be reassigned. Integration credentials must be reviewed. Offboarding is the ideal moment to correct access creep that has built up over time.

Subscription and licence management is another silent issue. Businesses accumulate software over the years. When someone leaves, those subscriptions should not quietly continue billing. Licences must be reassigned or cancelled. Otherwise you are literally paying for ghosts.

Devices deserve equal attention.

If a company laptop or mobile device was issued, it must be properly received, audited, and reset. Data should be backed up before wiping. Devices must be securely reconfigured before redeployment. Deleting a user profile and calling it a day is not a security strategy.

In Bring Your Own Device environments, where employees use personal laptops or phones for business access, the situation requires even more care. Business email accounts must be removed. Company applications must be logged out. Access tokens must be revoked. Company data must be separated from personal data without crossing legal boundaries.

This is not just technical hygiene. It is about protecting confidential information, complying with POPIA, and preventing financial loss. A single overlooked account or synced folder can expose sensitive client information. Breaches do not have to be malicious to be damaging.

Multi factor authentication must also be addressed. Authentication tokens and mobile app registrations should be invalidated. Hardware tokens must be returned. Any authentication method tied to that user must be properly removed. Leaving access active on a personal device after termination is unnecessary exposure.

Offboarding always leads directly into onboarding.

A new employee stepping into the role needs a clean, structured setup from day one. That includes account creation, correct permissions, password policy enforcement, and properly configured multi factor authentication.

Access must be deliberate. Too much access creates risk. Too little access creates frustration and delays. The goal is balance, not guesswork.

Devices for new staff must be prepared to standard. Whether company issued or personal under policy, they must be configured securely, updated properly, and connected to the right systems. Productivity should start on day one, not after three support tickets.

The reason the IT offboarding gap exists is simple. Many businesses treat IT as reactive support rather than structured governance. HR processes are formal. Financial controls are formal. Yet technical access often relies on an email that says, “Please disable John’s account.” That approach might work in a five person company. It does not scale, and it does not protect the business.

At UIT, we implement structured offboarding and onboarding checklists. Data preservation is confirmed. Access revocation is documented. Licences are reconciled. Devices are secured. New users are configured correctly. Every step is deliberate and traceable.

Poorly managed exits can result in lost data, unauthorised access, compliance exposure, reputational damage, and direct loss of revenue if client communication is disrupted. Properly managed transitions protect institutional knowledge, maintain trust, and keep operational costs under control.

Staff turnover is normal. Chaos in your systems is not.

Closing the IT offboarding gap is about structure, accountability, and execution. When handled correctly, a departure becomes a controlled administrative event, not a technical emergency. That is the difference between reactive IT and governance driven IT.

And that difference matters.

Need help with offboarding operations? Let's talk.

Footnote: VPN stands for Virtual Private Network. It is a secure connection method that allows employees to access internal company systems remotely over the internet as if they were physically in the office network. VPN access must be revoked immediately when an employee leaves to prevent unauthorised remote access.

Footnote: POPIA stands for the Protection of Personal Information Act. It is South African legislation that regulates how personal information must be collected, stored, processed, and protected. Businesses are legally obligated to safeguard personal and sensitive data and can face penalties for non compliance.

Footnote: MFA stands for Multi Factor Authentication. It is a security mechanism that requires users to verify their identity using two or more factors, such as a password combined with a code generated on a mobile device. MFA significantly reduces the risk of unauthorised access if passwords are compromised.