Shared Work Accounts Need an Offboarding Checklist
A small nonprofit used shared design, mailing, storage, and social-media accounts for several years. When a volunteer coordinator left, no one knew which services were connected to her personal phone or which recovery codes she still held. The organization changed one password but overlooked two active sessions and an automated payment account.
Offboarding is often treated as a human-resources task, yet digital access reaches far beyond an email inbox. A departing person may own folders, calendars, forms, advertising accounts, domain settings, and software integrations. Some services remain invisible until a payment fails or a scheduled campaign changes unexpectedly.
Every organization needs a checklist that begins before the final day. Managers should identify accounts, transfer file ownership, redirect essential messages, remove devices, revoke application tokens, and replace recovery contacts. Shared passwords should be changed only after records and responsibilities are transferred, because sudden lockouts can interrupt legitimate work.
The process should distinguish personal and organizational data. Staff should not copy private files simply because they appear on a work device, and departing people should receive a clear opportunity to remove personal material under supervision. Retention rules should guide what is archived and what is deleted.
Former workers also need confirmation that access has ended. This protects them from later blame if an account is misused. Administrators should record the date, person responsible, and services checked rather than relying on memory.
Offboarding should be tested during routine staff changes, not invented only after a conflict. Periodic access reviews can identify accounts that still belong to people who left months earlier, as well as tools that no current employee understands.
A careful checklist protects continuity and security at the same time. It allows relationships to end professionally while ensuring that the organization, rather than one individual device or forgotten password, remains in control of its work.
A. Rahman
