Start with a short access map before any work begins
Before a contractor starts, make a list of the applications, folders and tools they will actually use. This sounds basic, but many teams skip it and then end up giving broad access because it is quicker. A proper access map should show what the contractor needs, who approved it, and what must remain off limits. That includes finance systems, customer databases, HR records and any admin area that is not part of the assignment.
For small businesses in Durban, Pretoria or Gqeberha, this is also where local working patterns matter. Some contractors work from home, some split time between sites, and some only need access during certain hours. If your business uses cloud tools, contractor access can be switched on and off remotely, which is especially useful when load-shedding or travel delays interrupt normal schedules. The main point is to make access deliberate, not accidental.
- List the exact tool name, folder or system.
- Note whether access is read only, edit access or admin access.
- Add the end date or review date.
- Record the person responsible for approving removal later on.
Build offboarding into the job from day one
The end of the contract should be planned at the beginning. Offboarding is not only about taking away access, it is about making sure nothing is left behind. That means closing accounts, changing passwords, removing saved devices, collecting documents and checking whether the contractor created any new accounts on your behalf. If access was granted for a customer project, make sure the client handover is complete before the login is closed.
A good offboarding process is useful for businesses that work with subcontractors, freelancers or seasonal staff. It reduces the chance that an old account stays active because someone assumed another team member would handle it. If the contractor helped with a temporary system, check whether the account was used for any integrations or reporting tools too. Those are easy to forget and often overlooked. A small admin slip can become a bigger security issue later on, especially when teams are busy and working across multiple locations.
- Disable access on the final working day, not weeks later.
- Rotate shared passwords after every contractor cycle.
- Check connected apps and saved sessions.
- Confirm that files and notes were returned or transferred.
Train contractors on your rules, not just your tools
Contractors are often skilled in their own field, but they may not know your internal rules. A short onboarding session can cover where files live, how passwords are handled, who approves changes and what to do if they lose a device. This is especially important for remote workers and for teams in different provinces who may never meet face to face. Clear instructions reduce confusion and help everyone work faster from day one.
Training should be practical. Show the contractor how to log in, where to store documents, and which systems they should avoid. If your team uses a password manager or single sign-on solution, explain the correct way to access it and who to call if something goes wrong. Keep the process simple enough that a busy contractor can follow it without phoning your office ten times. A short written guide, even one page, is often enough. It also helps when a new contractor steps in during leave or a rush period.
For small businesses in Johannesburg, Cape Town and beyond, this can be the difference between smooth work and a long clean-up later. People usually do the right thing when the rules are clear and the setup is easy to follow.
A local example: temporary support without long-term risk
Consider a small manufacturing company in Pretoria that brings in an outside consultant to tidy up reporting and fix access issues after a busy quarter. The consultant needs access to two systems, a shared project folder and one message account for handover only. Without a proper plan, that same person could end up with access to old supplier files, customer records and internal admin notes. Months later, nobody remembers which logins were created or whether they were removed.
With a controlled process, the company creates one named contractor account, sets a finish date, limits access to the specific folders, and schedules an offboarding check for the final Friday. The consultant completes the work, returns the files, and the company changes any passwords that were used during the assignment. The job is finished without leaving a live account behind. That is the kind of simple discipline that protects a business while still allowing short-term help to be useful.
We see the same pattern with remote onboarding across South Africa. Whether the contractor is in Durban, Stellenbosch or working from home in a smaller town, the method is the same: plan the access, limit the permissions and close it properly at the end.
Quarterly reviews catch the accounts nobody remembers
Even with good procedures, temporary users can slip through the cracks. Quarterly access reviews are a practical way to catch old accounts, unused logins and permissions that no longer make sense. This is especially useful for businesses with seasonal work, project based support or changing supplier relationships. It takes less time to review access every few months than to investigate a problem after a mistake.
A review does not need to be complicated. Compare the active contractor list to current work, check end dates, confirm approvals and remove anything that is no longer needed. If a contractor still appears in a system but the work ended long ago, that is a warning sign. For many small teams, this process also highlights where informal habits have grown over time. The goal is not paperwork for its own sake, but a cleaner and safer way to run everyday work.
- Match active accounts to current projects.
- Check that end dates are still correct.
- Remove access for completed or paused work.
- Record the review date and any changes made.
At 1Pass, we help small business teams set up password management and single sign-on in a way that supports contractor control from the start. That includes initial security review, setup, permission mapping, onboarding training, offboarding process design and ongoing support for teams across South Africa.
