Why Offboarding Is a Security Ticket First

Tuesday, 10:40, at Meridian Parts. Dana runs a desk of three and has a short e-mail from Priya in finance: "We are still being billed for a mailbox and a sales licence for Gareth. He left in March. Can you remove them?" It is the kind of request that takes four minutes, so Dana opens the directory to find the account. The account is enabled. The last sign-in was last Thursday at 22:14, from an address that is not the office. And the mailbox has a rule in it that forwards every message with the word "quote" in the subject to a personal address. Gareth was the regional sales representative. He left seven months ago, nobody told the desk, and the desk has been keeping his account warm ever since.

Dana's four-minute ticket is now a security incident, a conversation with the sales director, a call to whoever handles legal matters, and a very quiet afternoon. None of it was caused by Gareth being wicked; it may turn out that he is not. It was caused by an exit that nobody treated as a security event. This article is about why every exit is one.

Offboarding is everything that happens to a person's access, equipment and data when they stop working for the organisation. Treating it as a security ticket first means the first job is to stop the leaver's access at the agreed moment and prove it stopped. That comes before any tidying, any licence reclaim and any handover. The administrative work is real and it is second. This article is part of our Employee Offboarding series, which covers the whole exit from the desk's side. It covers the stakes, the checklist in the only safe order, the same-day exit, the equipment, the mailbox, and the audit that finds the accounts nobody disabled.

It covers what a sloppy exit leaves behind and why a leaver keeps access for months without anybody intending it. Next come what "security first" changes about the work, then the three owners of an exit and what each one holds. We cover the trigger that must reach the desk and the form it should take, then what the desk does not own. Next come one ticket per leaver and its tasks, then a short war story. We finish with the offboarding risk list to copy, in that order.

What a Sloppy Exit Leaves Behind

An exit done badly does not leave nothing behind; it leaves a specific, predictable set of things. And the first step in taking offboarding seriously is being able to name them. A leaver's account that was never disabled is the obvious one, and it is only the first. Each item below is something I have found on a real desk after a real exit. And each one was discovered by accident, which is the only way any of them is ever discovered.

The live sign-in is the headline. An enabled account with a password the leaver still knows will accept that password from anywhere the organisation accepts sign-ins from. For most organisations that now means anywhere. Beside it sit the sessions: a phone that was signed in to the mail app on the leaver's last day stays signed in. That is because disabling an account does not always end what the account already started. Some tools end existing sessions when an account is disabled; many do not. The desk has to revoke them deliberately. A laptop with a saved VPN certificate, a browser with a saved password, and an app that was given a long-lived token all belong in this group. In plain words, a session is a sign-in that is still open. A token is a stored proof of an earlier sign-in that lets a device skip the password next time. Both outlive the moment the person walks out.

Then there is the mailbox. A forwarding rule set up months ago, for a perfectly good reason, keeps running after the person leaves. So does a rule that copies invoices to a personal address "so I can work on the train". Delegation granted to a colleague stays granted. An out-of-office message that was never set means customers write to a mailbox nobody reads and conclude the organisation is ignoring them. The mailbox of a leaver is a small machine that keeps doing whatever it was last told to do, with nobody watching.

Shared passwords are the quiet one. The leaver knew the password to the generic social media login, the courier portal, and the test account on the website. They also knew the password to the shared mailbox for tenders and the wireless network in the warehouse. None of those is "their" account, so none appears on any list of accounts to disable. Every one of them still works for the leaver on the day after they leave. Add the data: the spreadsheet of customers they e-mailed to themselves and the folder they synced to a personal device. There are also the drawings on the old laptop that was "lost" two years ago. And add the licence, which finance notices eventually. Add the external accounts (the vendor portal, the analytics tool, the domain registrar) that were registered under the leaver's name and that HR has never heard of.

Read the right-hand column and notice that most of the rows say "the desk". That is not because the desk caused the problem. It is because the desk is the only function in the building that can turn these things off. It is also the only one that can look.

The Leaver Who Still Had Access Months Later

The leaver with access months after leaving is not an exotic case; on most desks that have never audited, it is the normal case. And it comes about through three ordinary assumptions held by three reasonable people. HR assumed that IT "does something automatic" when a person is marked as having left in the HR system. The manager assumed HR told IT, because HR handles leavers. IT assumed somebody would open a ticket, because somebody always had. Each assumption was sensible. Together they meant that nobody did anything, and the account went on living.

Where a trigger does arrive, it arrives wrong. The notice goes to a technician who is on leave. Or it goes to a mailbox that was itself the mailbox of a leaver (this happens more than anyone would like). Or it arrives as a line in a weekly HR summary with the leaving date already two weeks past. On other desks the trigger arrives, is acted upon, and stops at the account. The sign-in is disabled, the phone stays signed in, and the forwarding rule keeps forwarding. Everyone involved believes the exit was handled, because the one thing they could see was done.

The honest framing is that the leaver is not usually the danger. Most leavers leave, forget the password within a month, and never think about the organisation's systems again. The danger is the orphaned account itself. It is an account with no person responsible for it, whose password is as old as the day it was last changed. Nobody will notice it being used because nobody is expecting it to be used at all. An attacker who gets hold of that password, through a leaked list from an unrelated website or a guess at a pattern, has an account that no human will report as compromised. That is because the human has gone. Gareth's account at Meridian Parts had been quiet for seven months. The desk would have called it quiet for seven years.

What "Security First" Changes About the Work

Calling offboarding a security ticket first changes three practical things: the order of the work, the clock it runs on, and the standard of proof. The order is that stopping access comes before everything else, before the laptop is collected, before the manager gets the mailbox, before the licence is counted. The desk's instinct is often the reverse, because the laptop is physical and the manager is standing at the desk, while the account is invisible and complaining to nobody. Resist the instinct. The account is the part that can be used from a coffee shop.

The clock is the second change. An administrative task has a target measured in days. A security task has a moment, agreed in advance, at which the access stops. It also has a measure of how far from that moment it actually stopped. For a planned leaver that moment is usually the end of the last working day, to the minute HR agrees with the manager. For a same-day exit it is the minute the meeting starts, which is a different article in this series. The point is that "sometime this week" is not a time. The gap between the agreed moment and the real one is a number the desk should know. The audit article at the end of this series calls it days-to-disable and shows how to count it.

The standard of proof is the third change. An admin task is done when the technician says it is done. A security task is done when the technician can show it. That means the account's state, the sessions revoked, the rules checked, and the shared passwords changed, each with a time and a name in the ticket. Nobody asks for that proof on a quiet day. Everybody asks for it on the day the forwarding rule is found, and on that day the ticket is the only witness the desk has.

Security first does not mean deleting anything quickly. It means disabling quickly and deleting slowly. And that distinction, which is the spine of the whole series, is in The Offboarding Checklist: Disable First, Delete Later. A disabled account can be turned back on in a minute when the manager discovers that the leaver's mailbox held the only copy of a contract. A deleted one cannot. The urgent step is reversible, which is exactly why it is safe to do urgently.

Three Owners: HR, the Manager and the Desk

An exit has three owners, and the failures described above happen when any two of them believe the third is handling it. HR owns the fact of the exit: that the person is leaving, when, on what terms, and what they are entitled to afterwards. The manager owns the work: what the leaver was doing, who takes it over, and what data and mail the team needs. The manager also owns what the leaver had their hands on that is not written down anywhere. The desk owns the access: every account, session, device, licence and shared secret, and the proof that each was dealt with. The table below is the version to pin up, and the one to send to HR with a polite note when the next leaver arrives as a surprise.

Notice what the desk does not own: the decision, the date and the conversation. Notice also that the desk's column is the longest. That asymmetry is the whole argument for a written process, because the function with the most tasks is the one that is told last.

The Trigger That Must Reach the Desk

The single rule that fixes most offboarding failures is this. No person leaves without a ticket on the desk, opened before their last day, naming the date and the time their access stops. Everything else in this series hangs off that ticket. Where it exists, the checklist can run, the audit has something to reconcile against, and the days-to-disable can be counted. Where it does not exist, the desk is relying on gossip, and gossip has no service level.

The trigger has to come from HR, because HR is the only function that knows about every leaver. That includes the ones in departments that never talk to IT and the ones whose managers forget. Agree with HR, once, in writing, on three things. Every leaver produces a request to the desk. The request arrives at least a few working days before the last day for a planned exit, and by phone within the hour for an unplanned one. And it contains the minimum fields the desk needs. The minimum is short: full name as it appears in the directory, department, manager, last working day, and the time on that day access should stop. It also includes whether the exit is planned or immediate. And it includes whether the person is leaving on good terms or the desk should expect to be told nothing further. HR will sometimes decline to share the last point, which is itself an answer.

Give the trigger a door of its own rather than letting it arrive as a free-text e-mail. A short form on the desk's portal, with those fields and nothing else, takes HR two minutes. It gives the desk a ticket with the right data in the right places every time. If you run QuerySolv, a department with its own form and mailbox is the natural home for it. HR submits the leaver form, the ticket lands in the queue the desk is already watching, and nobody has to remember an e-mail address. In any tool the shape is the same: one named entry point, one owner, no leaver without a record. The sister rule on the way in, where the starter's request arrives before the start date, is in Getting the Request Before the Start Date. A desk that has solved one has usually solved the other.

The trigger also needs a back-up, because HR systems have leavers in them that never generate a request. Ask HR for the leaver list once a quarter and reconcile it against the directory. That reconciliation is the audit, and it is the subject of The Leaver Audit: Finding the Accounts Nobody Disabled. The form catches the leavers people remember. The audit catches the rest.

What the Desk Does Not Own

A desk that takes offboarding seriously will be tempted to take all of it, and should not. The desk does not decide that a person is leaving, does not decide the date, and does not have the conversation. It does not decide who may read the leaver's mail. That is a policy question with legal weight, and the desk acts on a written instruction from HR, never on a manager's request at the counter. It does not look through the leaver's files out of curiosity, or helpfulness, or to "check there is nothing sensitive". If something in the mailbox needs to be found, the person authorised to look is the one who looks. In that case, the desk's role is to grant the access and record who had it.

The desk also does not investigate. When Dana found the forwarding rule, the right move was to disable the account, revoke the sessions, stop the rule, and preserve the mailbox untouched. Dana should write down exactly what she saw with the times. Then she should hand the question of what Gareth had done to the people whose job that is. Working out what was forwarded, to whom, and whether it matters is forensic work and legal process. Those belong to the security function or to outside help, and are referred to rather than attempted. The desk contains; it does not pursue. The same boundary applies to the clicked phishing link and the lost phone. And the reasoning behind it is in Other Security Tickets the Desk Will See.

This is a relief, not a limitation. A desk of three has neither the time nor the authority to be a security department. And a desk that tries will do both jobs badly. Its contribution is the one nobody else can make: the switch is turned off, on time, every time, and there is a record. That is enough, and it is a great deal more than most organisations get.

One Ticket Per Leaver, With Its Tasks

Each leaver gets one ticket, and the tasks that make up the exit hang off it. An exit is a bundle of eight or ten jobs done by two or three people over several weeks. A single ticket with a single owner cannot carry that honestly. The parent ticket holds the facts from HR and the overall status. The tasks, whether they are child tickets, linked tickets or a checklist inside the parent, depending on the tool, hold the individual jobs. Those jobs are disable and revoke, mail handling, device return, shared passwords, licences, the hold and the eventual deletion. Each task has its own owner and its own date, and the parent is not closed until every task is.

Linked tickets suit this shape particularly well, since the device return may take three weeks while the disable took three minutes. The two should not share a status. In QuerySolv the tasks of an exit can be separate tickets linked to the parent. Each can be claimed by the person doing it, with the parent's event history showing when each was opened and closed. Most tools can do something like it. A desk whose tool cannot link tickets can still put the checklist in the parent and tick it in notes, provided every tick carries a name and a time. The order of the tasks, and why the order matters, is the checklist article's subject. Here it is enough to say that the ticket is the record. The record is what turns a nervous conversation in seven months into a two-minute look-up.

The record has one more job. A desk that sees every exit as a ticket can count exits. And a desk that counts can see the shape of its own problem. That means how many leavers a quarter, how many arrived as a surprise, and how long each took from last day to disabled. Those numbers are small at a small organisation, and they are still the only evidence the desk will ever have that the process works. Keep them. Nobody will ask for them until the week everybody does.

A Short War Story: The Tenant Mail at Ashgrove Housing

Ashgrove Housing lost a housing officer called Marta to a rival association. Her manager, a kind man called Owen, asked the desk to forward her mailbox to his own "until the new person starts". The desk did, without a ticket, because Owen asked in the corridor. The new person started, and nobody told the desk. And the forward stayed in place for a year and four months. During that time, Marta's old address received around nine hundred messages from tenants. Some were about repairs that were urgent and several were about matters that a housing association is obliged to keep confidential. Owen's mailbox, meanwhile, filled, and his own out-of-office began bouncing tenant messages back to the tenants with a note about his holiday. The association discovered the arrangement when a tenant complained to the regulator. She said she had written four times about a leaking boiler and received only a holiday message from a man she had never met. The cost was a formal finding against the association and roughly sixty hours of desk and management time reconstructing which messages had been read. There was also a repair that had waited eleven weeks. The lesson was written into Ashgrove's process the following month. Every change made because someone is leaving goes on a leaver ticket with an end date. And a kind request in a corridor is still a request.

The Offboarding Risk List

The list below is the one to work through for every leaver, planned or sudden, and the one to use when auditing exits that happened before the process existed. It is organised by what is left behind rather than by who does it, so that a technician reading it on the day sees the risk first and the task second. Fill in the top line from the HR trigger. Tick each item only when it is done and proved, with a name and a time in the ticket. Keep the list with the leaver's parent ticket, because the day it is needed again will be a day nobody can find anything else.

OFFBOARDING RISK LIST — ONE PER LEAVER
Leaver: ______________________   Directory name: ______________________
Department: ______________   Manager: ______________   HR contact: ______________
Last working day: __________   Access stops at (time): ________   Planned / Immediate
Ticket: ________   Opened by: ______________   Opened on: __________

A. ACCESS THAT CAN BE USED FROM ANYWHERE
   [ ] Directory sign-in disabled at the agreed minute        by ________ at ________
   [ ] Open sessions and stored tokens revoked, all devices   by ________ at ________
   [ ] VPN and remote access certificate or profile revoked   by ________ at ________
   [ ] Second-factor registration removed from the account    by ________ at ________
   [ ] Any other sign-in the person held (list): ______________________________

B. THE MAILBOX
   [ ] Forwarding rules checked; any outside forward removed  by ________ at ________
   [ ] Delegation reviewed; access to colleagues ended or dated
   [ ] Auto-reply set, naming the new contact                 until ________
   [ ] Manager access granted (per written HR instruction)    until ________

C. SHARED AND GENERIC SECRETS THE LEAVER KNEW
   [ ] Shared-password list reviewed with the manager
   [ ] Each shared password changed and recorded              list: ______________
   [ ] Wireless, door, alarm or other shared codes changed where the leaver knew them

D. DATA
   [ ] Files on the device preserved before any wipe
   [ ] Ownership of shared folders and documents transferred to ______________
   [ ] Personal-device sync and personal cloud copies raised with the manager and HR

E. EQUIPMENT
   [ ] Devices listed: ____________________________________________
   [ ] Returned and receipted on ________ / courier kit sent on ________
   [ ] Quarantined; wiped and re-issued only after the data hold is cleared

F. LICENCES AND EXTERNAL ACCOUNTS
   [ ] Licences reclaimed when the mailbox no longer needs them
   [ ] External accounts in the leaver's name (vendor portals, tools, registrars):
       ______________________________  transferred to ______________ on ________

G. THE HOLD AND THE END
   [ ] Hold period agreed: ____ days from last day; ends ________
   [ ] Manager sign-off that nothing further is needed, in the ticket
   [ ] Account and mailbox removed or archived per policy      by ________ at ________
   [ ] Parent ticket closed only when every item above is done and proved

Dana worked through the list for Gareth the same afternoon, seven months late. Then she worked through it for the nine other leavers HR's list turned out to contain, two of whom also had enabled accounts. None of the others had a forwarding rule. One had a paid licence that had cost the organisation, by Priya's reckoning, about as much as a decent laptop. The list took Dana a day to run across ten people, and the leaver form took HR a week to agree to. And there has not been a surprise since, which is the quietest kind of success a desk ever gets.

Frequently Asked Questions