Start With a Same Day Offboarding Check
The safest approach is to treat every departure as time sensitive. Once resignation or termination is confirmed, list every system the person can reach, then work through it in the same day where possible. That includes message, finance tools, CRM, file storage, messaging apps, remote access tools and any shared logins used by the team.
For small businesses in Johannesburg, Pretoria, Durban, Gqeberha and Cape Town, the practical issue is often not the main company systems but the side tools people collect over time. A sales rep may know the social media login, while a project lead may have access to supplier portals, municipal submission accounts or shared cloud folders. Missing one account can leave a door open long after the person has gone.
- Confirm the exit date and last working hour.
- Identify every app, portal and shared login linked to the user.
- Check whether the person also holds admin rights.
- Set a single person to own the offboarding task.
- Record what has been removed and what still needs action.
Remove Access in the Right Order
Start with the accounts that can unlock other systems. If a user has access to a master message inbox, password manager or single sign-on portal, disable that first. From there, remove access to day to day apps, shared files and any remote support tools. If the exit is not amicable, do not wait until the end of the day to act.
In many teams the biggest mistake is only changing one password and assuming the job is done. If old credentials are stored in personal notes, browsers or shared documents, the risk remains. A proper offboarding process cuts off access at the source and then checks the rest of the trail.
- Disable the user account in the central identity system.
- Remove single sign-on access before other app logins are changed.
- Change shared passwords used by the departing person.
- Revoke recovery codes, backup tokens and trusted devices.
- Remove saved access from browsers and mobile devices where possible.
Reassign Shared Credentials Without Delays
Small businesses often depend on shared access for practical reasons. That is fine, but every shared login must have an owner, a clear purpose and a record of who can use it. When someone leaves, change those credentials and store the new details in a secure vault rather than in a spreadsheet or chat thread. That simple step reduces the chance of awkward follow up calls and forgotten passwords.
At 1Pass, we usually see cleaner outcomes when vault structures are set up by function. Finance, HR, sales, operations and support should not all share the same access pool. Separate access makes it easier to remove one person without affecting the full team.
- Change passwords for shared inboxes, portals and service accounts.
- Update vault entries and remove the departed user from relevant groups.
- Check whether any shared browser profiles still contain saved logins.
- Replace credentials for supplier, municipal or compliance portals if used by the exiting staff member.
- Note the date each password was changed.
Protect Files, Folders and Admin Rights
File access is often overlooked because it feels harmless compared with passwords, yet it can expose quotes, payroll data, client lists and internal notes. Review permissions on cloud folders, project spaces and shared drives. If the user created folders that others rely on, transfer ownership before closing the account. The same applies to admin rights on systems used for support, billing or reporting.
For remote teams and businesses with staff in different provinces, this step matters even more. A person may not be in the office in Woodstock or Century City, but they can still have access to documents used by the whole company. A tidy handover means the business keeps running even when someone is offline or out of the country.
- Transfer ownership of files and shared folders.
- Review admin roles on finance, HR and operations systems.
- Remove the user from group permissions they no longer need.
- Check for personal recovery email addresses linked to business accounts.
- Confirm that any reporting dashboards or exports are handed over.
Use a Short Handover Checklist Before Closing the File
A strong offboarding process ends with a simple sign off. That should confirm the account has been disabled, the passwords have changed and the handover is complete. It also helps to keep a short note on what was missed, so the next exit is easier to manage. A clean process saves time when the team is busy and load shedding has already disrupted the day.
Keep the checklist short enough that people actually use it. If the process is too long, staff skip steps. If it is too vague, access remains behind. The aim is not paperwork for its own sake, it is a business that does not keep paying for old access after an employee has gone.
- Confirm final access removal with the system owner.
- Check whether the user had any remaining sessions open.
- Verify that shared credentials were changed.
- Store handover notes in the correct team folder.
- Review the exit file in the next quarterly access review.
Build Offboarding Into Your Weekly Admin Rhythm
Offboarding works best when it is not treated as a once off event. Small business teams in South Africa often move quickly, hire in batches and adjust roles as work changes. That makes it important to have a repeatable process for every exit, whether the person is permanent, contract based or part time.
If your team already uses password management and single sign-on, the work becomes easier. You can remove access centrally, reduce the chance of lingering logins and keep a clear record of who can reach what. That gives the business better control and fewer surprises when staff changes happen at short notice.
At 1Pass, we help teams set up practical offboarding that fits the way they actually work. That includes remote onboarding nationwide, support from Woodstock, and guidance for businesses in Johannesburg, Pretoria, Durban, Gqeberha, Stellenbosch and Century City.
