By the time an employee gives notice, whether their exit will be smooth or chaotic has already been decided. Those decisions happen during the first few weeks on the job, when no one is paying close attention. A shared login gets created. A quick SaaS signup happens. Someone uses a personal laptop until company hardware arrives. By month six, none of it feels like a decision anymore. It just feels like how things are done.
This post breaks down why offboarding drags on for weeks, the onboarding shortcuts that create that problem, how to clean things up for your existing team, and what your IT provider should be doing upfront but often is not.
What’s really happening when offboarding takes three weeks
A clean offboarding should take about 60 to 90 minutes on the IT side. Disable the user in your identity system and access drops across connected tools. Wipe or collect the device. Forward email or convert it to a shared mailbox. Reassign ownership in your CRM and project systems. Use a standard handoff document that was set up at onboarding.
When it becomes messy, it turns into a weeks long process. No one has a complete list of tools. You end up asking the employee to help reconstruct access. Along the way you uncover accounts in tools that were set up independently, each with credentials only they control. The laptop is at home and not a priority to return. A client mentions a strange message from a personal email. A month later you find a subscription still being billed.
The difference comes down to how things were set up on day one.
In identity terms, this is the joiner, mover, leaver lifecycle. If onboarding is rushed, all the cleanup gets pushed into offboarding.
Four onboarding shortcuts that cause problems later
Letting employees sign up for tools on their own
When someone creates an account on their own using their work email, that account becomes tied to them. You may not know it exists, and you cannot easily take control of it.
This is the root cause of missing logins during offboarding. Every tool should be provisioned through a central identity system so ownership stays with the business.
Allowing personal devices as a temporary solution
Temporary usually becomes permanent. The employee installs apps, stores files, and connects to company systems.
When they leave, you have no control over that device. You are relying on cooperation instead of having a technical control in place.
The fix is straightforward. Issue company devices from day one and enroll them in device management. If personal devices are allowed, require managed access for email and files.
Using shared logins to save money
Shared accounts create problems immediately at exit. You cannot remove one person without resetting access for everyone. Often, no one actually knows the password.
Paying per user solves this cleanly. Shared access usually costs more in time and risk later.
Keeping client relationships in personal inboxes
In many service businesses, client history lives in one person’s email. When that person leaves, context disappears.
From the client’s perspective, the business suddenly loses track of the relationship.
The fix is to centralize communication. Use a shared mailbox or CRM so conversations are stored in a place the business controls.
Cleaning this up with your current team
You cannot redo onboarding for your existing staff, but you can fix what is already in place.
SaaS audit
Review the last three months of business credit card statements. List every recurring subscription. Identify who set it up, who has access, and whether the business can take control if that person leaves.
You will find tools no one remembers, accounts tied to one individual, and licenses still active for former employees.
Build a device register
Create a simple list of who uses which device, whether it is managed, and what company data it can access.
Ask employees to confirm what they use, including personal devices. The goal is visibility. For personal devices, ensure company data is accessed through controlled methods that can be revoked.
Move client communication into shared systems
Shift important conversations out of personal inboxes. A shared mailbox with a simple expectation to copy in client communication can solve a large part of the problem. A CRM adds even more structure.
What your IT provider should be doing at onboarding
Many IT providers only get involved when someone leaves. They disable accounts, collect equipment, and work through whatever documentation exists.
That is the wrong point in the lifecycle.
A strong approach starts at onboarding. Your IT provider should:
- Create the user in your identity system
- Provision access through single sign on
- Set up and enroll devices in management
- Keep a record of what systems the user can access
They should also maintain a basic handoff document that tracks responsibilities, systems, and access tied to each employee.
When that work is done upfront, offboarding becomes a checklist instead of a scramble.
A simple plan to get ahead of this
You do not need to wait for someone to leave to start fixing this.
Weeks 1 to 2
Review SaaS subscriptions and identify single owner accounts.
Weeks 3 to 4
Document all devices and confirm how company data is accessed.
Weeks 5 to 6
Move key client communication into shared systems.
Weeks 7 to 8
Define a clean onboarding process and use it going forward.
Most of this is operational, not technical. A spreadsheet, a few conversations, and some focused time from your IT provider will handle the majority of it.
FAQs
How long should offboarding take
With proper setup, the IT portion can usually be completed in about an hour.
How do I find unknown tools my team is using
Start with credit card statements. Most subscriptions show up there.
Can I wipe a personal device after someone leaves
Only if that control was set up in advance through device management or managed app access.
Why does single sign on matter
It allows you to disable one account and remove access everywhere at once.
Should employees only use company devices
That is the safest approach. If personal devices are used, there should be controls in place to protect and remove company data.