Three former employees can still open your front door
When someone leaves a small firm, the desk gets cleared and the keys come back. The logins usually don’t. Here is what we find, and how long it has usually been sitting there.
The average small firm we review has three accounts belonging to people who no longer work there. The record is eleven. Nobody was careless — a leaving day is busy, and closing an account is a task with no deadline and no owner.
The risk is not usually the person who left. Most of them have forgotten the login exists. The risk is that an account nobody watches, with a password nobody has changed in four years, is the easiest way into your business — and it is the one door you would never think to check.
What we usually find
- Email accounts still receiving mail, still forwarding somewhere.
- A shared login that four people use, including two who have left.
- A remote account created for a project in 2021 that outlived the project.
- Access to your client system that was granted, quite properly, and never removed.
What good looks like
A short written list of what a new person gets on their first day, run in reverse on their last. One page, no jargon, kept by whoever does the leaving paperwork. When somebody goes, the accounts go the same afternoon — not eventually, not when someone remembers.
It takes about an hour to write and about ten minutes to run. We build it for every firm we take on, and we go and find the old accounts first.