Why same-day matters
Someone’s last day is on the calendar. Cake is ordered. The welcome message for their replacement is drafted. Meanwhile the shared mailbox, the domain registrar MFA, the QuickBooks login, and the website CMS still work under the person walking out the door.
That gap is not an HR problem alone. For a small business in South Texas—or anywhere TwoQM supports operators—it is an access-control problem with a short clock. You do not need an enterprise offboarding platform. You need a same-day checklist you can finish in about 30 focused minutes before the goodbye emails go out.
Access lasts longer than employment unless someone revokes it. Common failure modes:
Personal phone still receives MFA codes for Microsoft 365 or Google Workspace
Shared passwords lived in a browser profile on a laptop that went home “temporarily”
Domain, hosting, and bank portal logins never moved off a personal email
A contractor’s Canva, Meta Business Manager, or Shopify staff account was never removed
Forwarding rules quietly send client mail to a personal Gmail for “coverage”
None of those require malice. All create unnecessary risk: inbox snooping, accidental deletes, invoice diversion, or a locked-out owner who cannot reset a password because MFA sits on someone else’s device.
Minute 0–5: Freeze the identity
Start with the identity provider you actually use—Google Workspace, Microsoft 365, or whatever sits in front of email and SSO.
1. Suspend or disable the user account (do not delete yet). Suspension stops login while preserving mail and files for export.
2. Reset the password and strip app passwords / legacy auth if your admin console offers that.
3. Revoke sessions and signed-in devices. Force sign-out everywhere.
4. Reassign or remove MFA methods tied to their phone or authenticator app. If the only recovery path was their personal number, fix recovery contacts for the admin account next.
5. Change recovery email/phone on any owner-level admin account they could reach.
If you are a three-person shop and the leaving staffer was also the Workspace super-admin, pause cake. Recover admin access first so you are not locked out of the checklist itself.
Minute 5–12: Email, groups, and quiet forwards
Mail is where trust and money move.
Take ownership of their mailbox (or convert to a shared mailbox) and set an auto-reply that points clients to a living address.
Remove them from distribution groups, shared inboxes, and calendar resources.
Search mail rules for forwards, redirects, and filters that hide or exfiltrate messages.
Export or reassign Drive/OneDrive ownership for folders the business still needs.
Confirm aliases (info@, billing@, jobs@) are not solely dependent on their personal login.
Write down who now owns each shared inbox. Ambiguity here is how “nobody saw the vendor invoice” happens two weeks later.
Minute 12–20: Domains, hosting, and website admin
Digital presence is often split across people who “just handled it.”
Confirm the domain registrar login is a company-controlled account with MFA on a device the business keeps. If it was theirs, change password, update contacts, and verify auto-renew and lock.
Confirm DNS / hosting / CDN panels no longer accept their credentials.
Remove their user from the CMS or website admin. Delete unused admin accounts while you are there.
Rotate any deploy keys, Git tokens, or FTP credentials they used.
If they managed SSL, email DNS (SPF/DKIM), or analytics tags, screenshot current settings before you change anything.
TwoQM clients often discover during offboarding that the site “belongs” to a former designer’s personal registrar account. Fix ownership when someone leaves—not at the next redesign.
Minute 20–27: SaaS, banking, and money paths
Walk a living inventory, not a perfect CMDB. Typical small-business list:
Accounting, payroll, and time clocks
Banking and merchant portals (and who gets MFA codes)
Social and ads: Meta Business Manager, Google Ads, Canva, scheduling tools
CRM and helpdesk
Password vaults—remove the user and audit shared vaults they could open
Vendor portals (shipping, suppliers, POS)
For each: remove the user, rotate shared passwords they knew, and confirm MFA lands on a company phone or hardware key. If a bank portal only allowed their personal cell for OTP, call the bank the same day and update authorized users—banks move slower than SaaS toggles.
Minute 27–30: Hardware, proof, then announcements
Collect laptop, phone, keys, badge, and hardware MFA keys. Issue a written receipt.
Wipe or reimage devices before reassignment; do not “just delete the profile.”
Store an offboarding note: date, who performed each step, accounts touched, and what was deferred.
Then send the internal welcome or role-change message. Access first, announcements second.
Keep a one-page template
Identity — suspend, password reset, session revoke, MFA reassignment Mail & files — mailbox ownership, rules, groups, drive ownership Web stack — registrar, DNS, hosting, CMS, deploy secrets Money & SaaS — bank/payroll/accounting, ads, CRM, vaults Physical — devices, badges, keys Sign-off — owner initials and date
Run it for employees and long-term contractors. Title on the door does not change whether their login still opens billing.
Bottom line
Good offboarding is boring. The next morning, sign-in attempts fail, MFA codes do not hit a personal phone, clients still reach a monitored inbox, and nobody is guessing the registrar password in a group text.
If you want a second pair of eyes on domains, email, hosting, and website admin as part of a stack review, TwoQM helps small businesses keep those controls with the operator—not with whoever set things up years ago. The checklist is yours to run today.
Spend thirty disciplined minutes on identity, mail, web controls, SaaS, and devices before the farewell thread. Cake can wait. Open sessions should not.