The Access That Outlives the Contract: A Board Test for Leaver Controls

Most organisations can say when a person left. Far fewer can prove when their access ended. That distinction matters because a departed employee, contractor or temporary worker with a live account is not merely an administrative loose end. It is an unowned route into cloud services, SaaS platforms, on-premise systems and, in some cases, privileged administration.

In 2026, the problem has become harder rather than easier. Identity estates are spread across Microsoft 365, Google Workspace, line-of-business SaaS, legacy applications, virtual private networks and operational systems. Contractors often sit outside standard HR processes. Line managers may know an individual has finished, but the HR record, the service desk ticket and the identity provider do not always agree. The result is a control gap that is quiet until it is tested by an incident, an audit or a regulator.

Why offboarding fails quietly

Offboarding is rarely a single control. It is a chain of handoffs. HR records the termination. The line manager confirms the last working day. IT or the service desk disables the account. Application owners remove local access. Security reviews privileged accounts. Facilities recovers passes and devices. Each step can be completed, yet the chain can still fail if one handoff is assumed rather than evidenced.

The weakest links tend to be predictable. Contractors and temporary staff may be engaged by procurement or a business unit rather than HR. Shared mailboxes and delegated calendars can remain active because they are useful to the team. SaaS applications may be provisioned outside the service desk, leaving accounts that never appear in the joiners, movers and leavers process. Privileged accounts, API keys and service credentials may be overlooked because they do not look like ordinary user accounts.

There is also a timing problem. Many organisations disable the primary account on the last working day but do not revoke active sessions, tokens or application-specific passwords. Others rely on a future-dated ticket that is never checked. The board does not need to see every ticket, but it should be able to ask a simple question: can we demonstrate, for a sample of leavers, that access was removed within our stated timeframe and that no exception remained open?

A 30-day leaver control calendar

A reliable process does not need to be elaborate. It needs to be owned, timed and evidenced. The following calendar can be adapted to the organisation’s size and risk profile.

Before departure, from roughly day minus 14 to day minus 1. Confirm the leaver in the HR system and identify every account linked to the individual, including cloud identity, SaaS, on-premise, remote access, privileged accounts and third-party integrations. Ask the line manager to confirm handover requirements and any data that must be retained. Schedule revocation for the agreed time. Review email delegation, forwarding rules and shared mailbox permissions. Record physical access tokens and devices to be returned.

On the final day. Disable the primary identity at the agreed time. Revoke active sessions and refresh tokens, not only the password. Remove the individual from groups and distribution lists that confer access. Suspend email forwarding and review automatic replies for inappropriate content. Collect devices and physical passes. Where a shared mailbox is required, assign a named owner and document the decision.

Days one to seven. Confirm that application owners have removed local and SaaS access. Check privileged accounts and administrative group membership. Revoke API keys and third-party connections created by the leaver. Remove remote access profiles and VPN certificates. Transfer or archive data according to the retention schedule. Close accounts that are no longer required rather than leaving them dormant.

Days eight to thirty. Reconcile the leaver record against identity and application logs. Investigate exceptions, including accounts that could not be disabled immediately. Confirm that no new access was granted after the leaving date. Retain the evidence in a form that can be retrieved for audit. Review whether the process worked for contractors and temporary staff as well as permanent employees.

What evidence should survive the leaver

A board should not accept a verbal assurance that offboarding is handled. It should ask for evidence that is specific, retrievable and linked to the individual. Useful evidence includes the HR termination record with effective date, the service desk ticket showing the request and completion timestamps, identity provider logs showing account disablement and session revocation, application owner confirmations, privileged access logs, device and pass return records, and a manager attestation where data handover has taken place.

The evidence should also show exceptions. If an account could not be closed because of a legal hold, a live investigation or a business requirement, that exception should be recorded, approved and time-bound. An empty exception log is not always a sign of good control. It may simply mean nobody is looking.

Under UK GDPR, organisations are expected to implement appropriate technical and organisational measures to protect personal data. The Information Commissioner’s Office does not prescribe a specific offboarding process, but accountability requires that controls are documented and effective. NCSC guidance on identity and access management points in the same direction: know what access exists, remove it promptly and keep records that allow the organisation to verify that removal occurred.

Board metrics that expose the gap

A small set of metrics is more useful than a lengthy operational report. Boards should ask for trends rather than one-off figures, and they should challenge averages that conceal outliers.

• Percentage of leavers whose primary access was disabled within the organisation’s stated timeframe, typically 24 hours or less for permanent staff.
• Median and maximum time from the HR effective date to revocation across all material systems.
• Number of orphaned accounts with no matching active employee or contractor record.
• Number and age of privileged access exceptions linked to leavers.
• Percentage of sampled leavers with complete evidence across HR, identity, applications and physical access.
• Number of contractor or temporary accounts still active beyond the contract end date.
• Exceptions identified in the monthly joiners, movers and leavers reconciliation.

These metrics should be owned by a named executive, not left to the service desk alone. Security leadership can set the standard, but HR, IT and the business must all be accountable for their part of the chain.

Assurance in practice

A board can test the process without commissioning a major programme. Ask internal audit or an independent assessor to select a sample of recent leavers across permanent staff, contractors and temporary workers. Trace each individual from the HR record through to identity logs, application access and physical access. Look for evidence of revocation, not just a ticket marked complete. Attempt to identify any account that remained active, any session that was not revoked and any exception that was not approved.

The most revealing question is often simple: show me three leavers from last quarter and prove their access ended when we said it did. If the organisation cannot answer that question within a reasonable time, the control is not yet mature enough for the board to rely on it.

Offboarding is not a back-office chore. It is a test of whether the organisation knows who has access, who owns that access and how quickly it can be withdrawn. The ghost in the org chart is not the person who left. It is the access that stayed behind.