Set the rule before the contractor starts
Before any contractor gets access, decide exactly what they need to do and how long they need it for. A one-page approval note is enough for many small businesses: name of the contractor, start date, end date, manager approving access, systems needed, and whether they need read-only or full access. Keep that record in one place so there is no confusion later when someone asks why access is still active after the job is done.
In Cape Town, Johannesburg or Durban, many teams bring in contractors for website work, finance support, maintenance, events or short-term operations. The mistake is usually the same. Someone sends a password by WhatsApp or uses the same login for three people. That might feel quick, but it makes it hard to track who did what. A tighter rule at the start saves time when the contractor leaves or the work changes halfway through.
Map the access the contractor actually needs
List every application, shared folder and admin area the contractor will touch, then remove anything extra. If they are only handling invoicing, they do not need access to sales notes, HR files or finance approvals. If they are doing a short IT project, they may need a ticketing system and one cloud account, not every internal tool under the sun. This step is where many teams find they can separate access cleanly instead of giving one broad login.
- System name and purpose
- Access level needed, such as view, edit or admin
- Start and end dates
- Manager or owner who approved it
- Whether access should expire automatically
For companies working across Pretoria, Gqeberha or remote teams in smaller towns, clear mapping matters because people are often not in the same office. If someone is helping from home during load-shedding, they still need the same rules as a person sitting in your Woodstock office. Access should be tied to the job, not the location.
Use temporary access instead of shared passwords
Shared passwords are convenient until nobody knows who has them. A better setup is to give each contractor their own account with only the permissions they need. Where a shared resource cannot be avoided, store it in a password manager and grant access only for the period of the contract. That way you can remove it later without changing every login across the business.
Temporary access is also better when contractors work on-site and off-site at different times. A plumber, installer or auditor may need access for one afternoon, then again the next week. If your process is set up properly, you can grant that access with a date limit instead of leaving it open for months. It also helps during peak periods when admin staff are away and you need to keep the handover simple. Keep the permission list tight and check it twice, because one extra account can create an avoidable risk.
Build approval steps that do not slow the job down
A good approval flow should be short enough for real work, but strict enough to stop casual requests. The project owner requests access, the manager approves it, and the person responsible for security or systems creates it. If the contractor needs higher-level access, add a second approval before it is activated. That protects you from rushed decisions and keeps the trail clear.
Use the same format every time so nobody has to guess who gave the go-ahead. For small businesses, this can be as simple as a standard form or a short checklist in your internal process. Keep the wording plain: what is needed, why it is needed and when it must end. If you separate approvals from setup, there is less room for error and fewer last-minute messages after hours.
- Request raised by the team member closest to the work
- Approval from the line manager or client owner
- Setup completed by the admin or support lead
- Expiry date confirmed before access goes live
- Removal scheduled on the last working day
Train contractors on your rules on day one
Even a short contract needs a proper handover. Show the contractor how to sign in, where to find the password vault if they are using one, and what they must never share. If your team uses single sign-on, explain which apps are included and what to do if a login prompt looks unusual. Many problems come from people assuming contractors already know your internal way of working.
A ten-minute onboarding session can prevent hours of fixing later. Cover basic password habits, device use, approved communication channels and what happens if they lose access. If the contractor is working remotely from Durban North, Paarl or anywhere else in South Africa, make sure they understand what to do during poor connectivity or power cuts. They should know who to contact, when to stop trying and how to confirm their work has been saved. A clear start gives you fewer surprises at the end.
Check access during the job and remove it properly at the end
Do not wait until the contract is over to check whether access is still correct. Review contractor permissions during the project, especially if their scope changes or the timeline shifts. A quick mid-point check helps you spot unnecessary access and make sure any added tools are still justified. This is useful for finance, operations and support work where responsibilities can change seperately from the original brief.
When the work ends, remove the contractor from every system, shared folder and device they used. Confirm that passwords have been changed where needed, shared access has expired and any admin rights have been removed. If the contractor handled documents or client data, make sure the handover is complete and stored where the team can find it later. Good offboarding is not just about closing an account, it is about closing every route back in.
- Disable account on the final day
- Revoke password vault access
- Change any shared credentials used during the job
- Check document ownership and handover notes
- Record the closure date and approving manager
Keep a simple review cycle for repeat contractors
Some contractors come back every quarter or season. That makes them easy to forget, especially if they last helped during a busy patch in December or around year-end reporting. Put them on a review cycle so their access is checked before the next job starts. You do not need a complicated system. A short quarterly or monthly review is enough for most small teams and can be done in a few minutes.
Review the list of active contractors, confirm the dates on each account, and check whether the permissions still match current work. If a contractor no longer needs access, close it straight away. If they are returning, start fresh with a new approval. That keeps the process tidy and gives you a clear record for auditors, owners or internal reporting. It also helps your team sleep better knowing that old access is not sitting around waiting to be used.
