An employee leaves. Who changes the passwords?

When someone leaves a company, there's a ritual for the physical things. Keys handed over, laptop returned, parking card back in the drawer. It happens because those things are visible — an empty hook where the keys should be is hard to miss.

Accounts are not visible. And so, in most small businesses, they get no ritual at all.

What typically stays open

Think through a departure at your own company — not a hostile one, a perfectly friendly one — and count what the person could still reach a month later. Their mailbox, still receiving customer mail. The cloud storage still syncing to their personal laptop. An admin role on the company's Facebook or Instagram page. The website's CMS login. The remote-access tool installed back when they needed to work from home. A supplier portal registered to their address.

None of this is malice. It's simply that closing accounts is nobody's job, there's no empty hook to notice, and the day someone leaves is busy with everything else.

The shared-password problem

Small teams share passwords — one login for the info@ mailbox, one for the web host, one for the invoicing tool. It's convenient, and it comes with a cost that only shows up at departures: you cannot take a shared password back from one person. You can only change it for everyone, everywhere it's used.

With a dozen shared services, "we'll change them all" quietly becomes "we changed the important ones". And if any account's two-factor codes go to the departing person's private phone, you may find the account is harder to get into for you than for them.

The list you need before you need it

The fix isn't software; it's a one-page inventory, written while everyone is on good terms: every service the business uses, who can sign in to it, and — the column that matters most — which accounts are tied to a specific person's own email address or phone number.

That last column is where the real surprises live. A domain or hosting package registered years ago under someone's personal email means that, on paper, the company website renews — or doesn't — at their discretion. The same goes for a Google Business Profile or a social page with a single owner. These are worth untangling now, calmly, not during a resignation week.

A thirty-minute routine

With the inventory in hand, offboarding stops being a project and becomes a checklist for the last day: disable the sign-in, forward the mailbox, transfer file ownership, remove them from shared tools, change every shared password they knew, move any two-factor setups, and check the admin lists on the website and social accounts. Thirty minutes, done once, beats discovering an open door six months later.

Whose job is it?

Like most of the quiet failures we write about, this one isn't technical — it's a question of ownership. The inventory only exists, and only stays current, if maintaining it is someone's actual job. That's precisely the sort of thing a standing IT support arrangement should own for you: not just fixing what breaks, but knowing what you have and who can touch it.

If you're not sure what your own list would look like — or whether a former colleague could still log in somewhere today — we'll help you find out. Get in touch for a free systems review and we'll map it together.