Small IT steps when people join and leave reduce account sprawl and data risk. This article gives managers and IT leads a practical checklist framework.
When a new employee starts, they should get quick access to the tools they need; when they leave, company data and accounts should be secured in an orderly way. Both processes are usually split between HR, the line manager and the IT team. If responsibilities are unclear, you end up with access that is granted late, forgotten or broader than necessary. A simple checklist improves both the employee's experience and the security of the business.
Own the process and define the triggers
Don't reduce joining and leaving to a single "IT has been told" step. Decide what information HR, the line manager and the IT lead share, and when. Start date, role, team, work location, device needs, approving manager and required applications can be collected on a standard request form. Using a trackable request ticket instead of email chains reduces the risk of approvals and completed steps getting lost.
For leavers, the last working day, the time access will be closed, device return, and handover of email and files should also be communicated in advance. For sudden departures, put in writing who has the authority to act and how quickly. That way the process doesn't depend on anyone's memory.
What to do when someone joins
Grant role-based access
Rather than "let's start by opening the folders everyone can see", define the applications and files the new employee actually needs for their role. With role-based access, permissions are set by the job someone does, not by who they are. This speeds up setup and reduces unnecessary access.
The manager should approve which customers, projects or financial information the user will work with, and the IT team should check that the request fits the existing roles. Set an end date for temporary needs.
Set up accounts and authentication
Give every employee a personal account and limit the use of shared accounts. Delivering the initial password securely, changing it at first sign-in and setting up multi-factor authentication should all be part of the plan. Also explain the support process to follow if the authentication device is lost or the employee changes phone.
For people who need administrative rights, create a separate admin account alongside their everyday account. This separation reduces the risk of doing routine things such as reading email or browsing the web in a highly privileged session.
Prepare the device
Before handing over a laptop, phone or tablet, check updates, screen lock, disk encryption, security software, backup and, where needed, remote wipe. Record the device's serial number, handover date and accessories. Tell the employee clearly where to report a problem, what to do with update prompts and how to forward suspicious emails.
Rather than installing applications the new employee doesn't need for their job up front, use an approved installation process when a need arises. This makes both licence and security management easier.
Give a short security introduction
Instead of overloading people on day one, cover the critical topics briefly and in plain language: passwords and multi-factor authentication, email security, file sharing, remote working rules and what to do if a device is lost. Explain which data is considered sensitive and that it must not be moved to personal email or personal storage accounts. Share the support channel where the employee can ask questions, and add a follow-up step in the following days for more detailed training and role-specific tools.
Reviews during employment
When someone's role, team or responsibilities change, their access should change too. Rather than leaving the old role's permissions in place, add and remove access according to the new role. At regular intervals, ask managers to confirm the application and folder access of their team members.
Service providers, interns and temporary staff are part of this process as well. Setting the contract or assignment end date on their accounts reduces forgotten access, but still verify separately that the account really is closed when that date arrives. Tie responsibility for shared mailboxes and shared file areas to a role, not a person.
A controlled exit when someone leaves
Close or suspend the leaver's access in line with their final working hours. Email, cloud storage, remote access, business applications, admin accounts and multi-factor authentication methods should each be reviewed; collecting the laptop on its own is not enough. On some systems, disabling an account does not immediately end existing sessions, so also revoke active sessions and any access granted to applications. If the employee knew any shared passwords, change them.
During handover, balance business continuity with privacy. The work files and customer correspondence the manager needs should be taken over through a defined handover method, but unlimited or open-ended access to the employee's account should not be left in place. Options such as automatic email forwarding or shared use of the account need careful handling; which data is accessed, with whose approval and for how long should be decided according to company policy and applicable legislation.
At device return, check keys, access cards and business account sessions as well as equipment such as laptops and phones. If company apps or data are on the employee's personal device, removing them should also be part of the plan. Monitoring activity on the relevant accounts for a while after departure helps you spot anything unusual.
Improve the process in proportion
You don't need a long report after every joiner and leaver. Collect brief notes on tools that were set up late, missing approvals or forgotten accounts. A recurring problem is an opportunity to improve the form or the division of responsibilities.
Periodically test the process against a sample record as well: can you understand an employee's access and device record within a few minutes? Is there an account still open for someone who has left? When the access inventory, device list and checklist stay up to date, the process carries on even when people change, and during an audit or security incident it is easier to explain which access was granted and why.
Checklist
- Joining and leaving details reach IT on time, using a standard form.
- Access is granted by role, with manager approval and an end date where needed.
- Every user gets a personal account and multi-factor authentication.
- Security settings and the inventory record are completed at device handover.
- New employees are told the rules for data, email and support.
- On a role change, old access is removed and new access is reviewed.
- On departure, all application, cloud, email and remote access accounts are closed and open sessions are ended.
- The return of devices, cards and other company assets is recorded.