Employee offboarding is riskier than it looks
Honestly, I only just realized this: employee offboarding is one of the riskiest points in a business.
It’s not just an HR thing. It’s not about the farewell lunch. It’s about the things that, if they slip through, can come back as problems months later.
I spent a few days researching it. I started because a friend of mine had just run into trouble with a former employee, and I wanted to know why so many business owners abroad take this thing called an “offboarding checklist” so seriously.
In Indonesia, honestly, I rarely hear it discussed. What usually gets discussed is onboarding: how to welcome new employees. But it’s the people leaving who carry more risk, not the ones arriving.
Digital access is sticky
This is the thing that made me think the longest.
An employee resigns today. Handshakes, a farewell, done. But behind the scenes:
- Their email might still be active
- Their Outlook might still be set up on their personal laptop
- Their access to work tools (Drive, Slack, Notion) hasn’t been revoked
- Software trials they signed up for with their work email are still running
All in the company’s name.
The one I keep thinking about most is software trials. We used to sign up for trials of Figma, Notion or other tools with our work email all the time. Even on personal laptops.
For the user, it’s just “to make signing up easy.” For the vendor’s system, it reads as “company X is using our software.”
The trail sticks to the company, not to the individual.
A minimal checklist
I tried making a simple checklist based on what I read. Here’s the most minimal version, for the day someone resigns:
- Shut down their work email (don’t just forward it, actually disable it)
- Revoke access to all SaaS tools
- Reset the passwords of shared accounts
- Check devices: if they used a company laptop, wipe it; if it’s personal, ask them to log out of every work app
Simple, but often missed.
Something that’s discussed less, and I think it matters, is documentation. Write down the resignation date, the date access was revoked, and who did it. Keep it all in one place.
It looks like overkill. But one day, if there’s a legal issue or a claim from a third party, this document is what will save you.
I used to think this was too corporate. Now I get why mature companies do it.
Why it slips through
One thing I only realized from this research: most offboarding problems aren’t because the employee is malicious. They happen because small details slip through and nobody feels responsible for them.
HR thinks IT is handling it. IT thinks HR will let them know. The owner thinks the team has it covered.
In the end, nobody handles it.
Finishing well
There’s a lesson in this for me too, as someone who also often holds access to work tools.
If I ever resign, the responsibility is on me as well. Log out of all my personal devices. Delete my work email history. Revoke sessions from the browser.
Not because I’m told to. But because it’s part of “finishing well.”
I’m not writing this because I’m an expert. I only realized all this after doing the research. But I’ve come to see offboarding as closing the door when you leave someone’s house.
It looks trivial. But if you don’t close the door, someday it turns into a story nobody enjoys.