A bookkeeper left one of our clients on bad terms a couple of years back. Two months later, supplier statements started bouncing and a tax query went to an inbox nobody could open. The bookkeeper had not done anything clever. She still had the login from her first day, and nobody had thought to take it back. That is the whole story of offboarding in small businesses: nobody revokes what nobody tracked.
What walks out the door with someone
When a person leaves, they usually leave behind access to the shared email account, the accounting package, the hosting panel, and the Wi-Fi. The domain registrar is the one that bites hardest, because whoever controls it can reset the mail, and whoever controls the mail can reset everything else. If the team keeps its passwords in a spreadsheet, the spreadsheet walked out too. None of this requires a disgruntled employee to become a problem. The realistic version is simpler: nobody does anything, and the access just sits there for years, waiting for someone to have a bad day.
The thirty-minute checklist
Run this on the last working day, in this order. Start with the domain registrar and email, then the accounting system, then anything else the person ever touched, and change those passwords first. Sign the person out of all active sessions. Google and Microsoft both have a button for this buried in account security, and almost nobody knows it exists, which is how accounts stay logged in on old phones. Remove them from the password vault and delete the entries for accounts they knew. Revoke anything physical: the office key, the Wi-Fi, the alarm code, in that order. Then, and only then, disable the mailbox, after you have set up forwarding if the address still receives customer mail. The whole thing takes thirty minutes if you do it once per person instead of never.
The list is the whole control
Offboarding is easy when onboarding was written down. That is the quiet benefit of keeping a simple record of who has what: the exit is the same list, ticked off instead of filled in. If your business runs its email, domain, and hosting through Olorun Cloud, the accounts side is already access-controlled and revocable in minutes. You are not hunting for a password you half-remember from 2019 while the domain renewal reminder goes unanswered.
When did you last check who still has access? Run the list with your team this week. If step one stalls because nobody remembers where the domain was registered, that is exactly the conversation to have with us.