A former employee still has access, and nobody knows to what

A familiar case: a salesperson leaves in spring. In autumn, a customer mentions that they still get emails from her about new offers, from a personal address, with the company's current price list attached. Her company email was closed on her last day. Her access to the CRM, the shared drive and the price list folder was not, because nobody knew she had it.

The short answer#

People keep access after leaving because access is spread across many systems that nobody lists in one place: email, file sharing, the CRM, accounting, the website admin, social media, advertising accounts, cloud consoles, and passwords shared in chats. Closing the email account removes only one door, and if other services used "sign in with" that account, some sessions may continue. Reliable offboarding needs three things: an up-to-date list of every system and who has access to it, single sign-on wherever possible so one action removes most access, and a written checklist run on the last working day, including shared passwords that must be changed. Contractors and agencies need the same treatment, and a quarterly access review catches what the checklist missed.

Where access hides#

• Email and calendar.
• File sharing: Google Drive, OneDrive, Dropbox, including files shared with personal addresses.
• CRM and sales tools.
• Accounting, banking portals and payment approval rights.
• Website and shop admin panels.
• Social media pages and advertising accounts.
• Analytics, Search Console, domain and hosting accounts.
• Cloud consoles and code repositories.
• Messaging groups: WhatsApp, Telegram, Slack.
• Shared passwords: the Wi-Fi, the alarm code, a shared admin login written in a chat.
• Devices: laptops and phones with company data synced, and mobile apps still signed in.
• API keys and personal access tokens created by that person.

The checklist for the last working day#

1. Disable the account in the central identity system (Google Workspace, Microsoft 365), and sign out all sessions.
2. Remove access in every system on the access list that does not use central sign-in.
3. Transfer ownership of files, calendars, and shared folders to a manager before deleting anything.
4. Remove the person from bank portals and payment approval rights, and inform the bank where required.
5. Remove them as admin from social media, advertising, analytics, domain and hosting accounts.
6. Revoke API keys and tokens they created.
7. Change any shared password they knew.
8. Collect devices, or wipe company data remotely.
9. Set up forwarding or an automatic reply for their email address for a limited period.
10. Record what was done and by whom.

Making it reliable#

Keep an access list

For each system: who owns it, who has access, and how access is removed. Without it, every offboarding depends on memory.

Use single sign-on where you can

When CRM, file sharing and other tools sign in through the company's Google or Microsoft account, disabling that one account removes access to all of them at once.

Stop sharing passwords

Use a company password manager with shared vaults. When someone leaves, their access to the vault is removed, and you know exactly which shared passwords they could see.

Treat contractors the same way

Agencies, freelancers and former suppliers often keep admin access for years. Give them named accounts, not shared ones, and put access removal into the end of every engagement.

Review access quarterly

Export user lists from the main systems and compare them with the current staff list. Every account that belongs to nobody gets closed.

Leftover access can be one of the ways fraudsters get into mailboxes, as described in supplier invoice fraud. Website and domain accounts are covered in more detail in who owns your website.

Nevo carries out cybersecurity audits. The cybersecurity audits page describes what an audit includes.