The Door Left on the Latch: A Quarterly Reconciliation of Departing Staff Access

Most access problems after a resignation are not caused by malice. They are caused by fragmentation. The HR record says the employee left on the last Friday of the month. Payroll has processed the final salary. The line manager has collected the laptop. Yet the identity provider still holds an active account, the finance system still lists a named licence, and an old mailbox rule still forwards invoices to a personal address.

A joiner-mover-leaver audit is therefore not a disciplinary exercise. It is a reconciliation: a controlled comparison of what should have happened with what actually exists across the estate. For UK SMEs, the aim is a quarterly check that is short enough to complete, evidence-based enough to defend, and repeatable enough to survive staff turnover in IT itself.

Begin with the payroll and HR record, not the admin console

The natural starting point is the identity provider, but that is also the weakest starting point. It only shows accounts that were created there. It does not show the vendor portal set up by a department, the shared mailbox delegate, or the contractor who was never added to the HR system.

Obtain a dated leaver list covering the previous twelve months. Ask HR and payroll to confirm it, including contractors and temporary staff who were paid through the business. Then perform a three-way match: HR leaver record, payroll final payment, and identity provider account status. Any leaver who appears in HR and payroll but still has an enabled sign-in is an exception. Any enabled account with no corresponding HR record is a separate exception.

Use a stable identifier where possible, such as employee number or payroll reference, rather than names. Names change, duplicate and get misspelt. Where no identifier exists, record the matching basis in the evidence file.

Build a leaver evidence file for each departure

The audit should produce one row per leaver, not one row per system. That row should carry the facts a reviewer needs: name, department, manager, final working day, HR reference, accounts identified, licence status, mailbox handling, forwarding rules removed, devices returned, third-party applications revoked, and the date each action was evidenced.

This is not bureaucracy for its own sake. It creates a defensible record if an incident later raises questions about when access ceased. It also exposes the systems that consistently fail to close accounts. If the same CRM licence is overlooked every quarter, the problem is the process, not the individual administrator.

Reconcile the identity estate in layers

Start with the central identity provider. Check whether the account is disabled, deleted, or merely moved to an unlicensed state. These are not equivalent. A disabled account may still hold an active session or an application token. A deleted account may leave an alias that continues to receive mail. An unlicensed account may retain group membership and access to shared resources.

Then check the directories and systems that sit outside single sign-on. Local Active Directory accounts, NAS accounts, line-of-business applications, and vendor portals all need a named owner and a closure step. Shared accounts should be avoided, but where they exist, the audit must record who knew the credentials and when they were changed.

Review group membership as well as account status. A leaver may be removed from the payroll system but remain in a security group that grants access to a file share. Check distribution lists, delegated calendar access, and any role-based groups that feed downstream applications.

Follow the mail, not just the mailbox

Email is where leaver controls most often fail quietly. A mailbox may be disabled while an inbox rule continues to forward messages to an external address. Delegates may still have full access. A shared mailbox may still list the leaver as a member. An alias may continue to route enquiries to a colleague who does not know the customer history.

For each leaver, inspect inbox rules, forwarding addresses, delegate permissions, shared mailbox membership, and any auto-reply that remains active. Remove forwarding to personal addresses unless there is a documented, time-limited business reason. Where a mailbox is retained for continuity, record the retention period and the person responsible for reviewing it. UK GDPR data minimisation applies to retained mailboxes as much as to live systems.

Reclaim licences and revoke third-party grants

Licences are both a cost and an access control. A named licence that remains assigned after departure may keep a user account active in a SaaS platform, even if the central directory account is disabled. Reconcile licence assignments against the leaver list each quarter. Record the date the licence was reclaimed and whether any data held in that platform was transferred or retained.

Third-party grants deserve particular attention. Users often authorise applications to read mail, files or calendar data through OAuth consent. Those grants can survive a password reset and may not appear in the central joiner-mover-leaver checklist. Review consent grants for departed users in Microsoft 365, Google Workspace and any other identity platform in use. Revoke tokens and remove application-specific passwords.

Close the physical chain

Device returns are part of access control, not a separate asset-management chore. Match the asset register against returned laptops, phones, SIM cards, security keys and building fobs. Record the condition, the return date, and the wipe or reissue step. Do not wipe a device before confirming that business data has been retained in line with policy and any legal hold.

Where a device is not returned, record the escalation. A missing laptop with cached credentials and an unexpired token is an access risk, not merely a stationery loss.

Run the check quarterly, with a monthly trigger

The operational trigger should be the leaver notification itself. The quarterly audit is the assurance layer that proves the trigger worked. Schedule it in the same calendar as other recurring IT controls. Sample all high-risk leavers, such as finance, HR, IT and anyone with administrative rights, and a random sample of the rest if volume is high.

Track four simple measures: leavers with an active account more than 24 hours after their final working day; licences reclaimed; devices outstanding; and forwarding rules or delegates removed. Report them to the person who owns IT risk in the business. A trend is more useful than a one-off clean-up.

When the audit finds an orphaned account

Do not simply delete it. Contain the access, preserve the relevant logs, and establish whether the account was used after departure. If the evidence suggests unauthorised access to personal data, escalate to the data protection lead and consider the UK GDPR breach notification timeline. The audit is designed to find these issues before they become incidents, but it must also have a route for when it does not.

A leaver process is not complete when the farewell card is signed. It is complete when the access has been reconciled, evidenced and reviewed. The quarterly check is the mechanism that turns that statement into a control.