Ask most businesses how a new starter gets set up and you will be told it depends who is around. Ask how a leaver gets removed and the answer is usually vaguer still.
This is the most common gap we find, and it is the one with consequences at both ends: new people spending their first week unable to work, and former people keeping access for months.
The joiner problem: an expensive first impression
Somebody starts on Monday. Their laptop is ordered Monday afternoon. Their email is created Tuesday. Nobody knows which systems they need, so access arrives in pieces over two weeks as they discover what they cannot do.
The cost is not only the lost time, although on an average salary a week of reduced productivity is not trivial. It is that a new employee’s first impression of the organisation is that it is disorganised — and that impression is formed in week one and rarely revised.
The fix is not a system. It is a short conversation earlier, and a template.
What a joiner process actually needs
Notice, first. IT needs to know about a starter when the offer is accepted, not on the morning they arrive. A week is comfortable; a day is not.
Then a role template rather than a person-by-person guess. Someone joining finance needs the same eleven things as the last person who joined finance. Write that list once and the question stops being “what do they need?” and becomes “which role are they?”
Then the machine ready and named, the accounts created, MFA enrolled on day one rather than deferred, and a named person who owns the setup. Fifteen minutes on their first morning showing them where things are saves a fortnight of small interruptions.
The leaver problem: a security exposure with a long tail
Leavers are worse, because nothing visibly breaks. An account that should have been closed simply carries on, and nobody notices until an audit, or an incident.
The common pattern is that the main account gets disabled promptly and everything else is forgotten: the CRM login, the courier portal, the supplier extranet, the shared mailbox password they knew, the MFA app still on their phone.
The leaver checklist most businesses do not have
Tick what happens reliably today, without anyone needing to be reminded.
The two mistakes worth naming
Deleting the account immediately. It feels tidy and it frees a licence. It also destroys the mailbox and, after a grace period, the OneDrive — which is where a lot of people keep work that nobody else has a copy of. Disable first, extract what is needed, delete later.
Assuming a friendly departure is a lower risk. Most access left open after a leaver is not exploited by that person. It is exploited by someone else who finds a dormant, unmonitored account with nobody watching it. The risk is not about trust.
The awkward case: the departure nobody expected
Sometimes someone leaves suddenly, or is asked to leave. In that situation the process needs to run in minutes, not days, and usually before the conversation happens rather than after.
That only works if it is written down in advance. It is worth agreeing now who can authorise an immediate lockout and how they reach IT out of hours, because it is not a decision anyone makes well on the spot.
How to start
You do not need software. You need two documents.
A joiner template per role, listing every system, group and piece of equipment. And a leaver checklist that mirrors it, with a name against each line and a place to sign it off.
Build them by working backwards from the last three people who joined and the last three who left. The gaps will be obvious, and probably slightly alarming.
Once written, this is the sort of process that can largely be automated — but the automation is the easy part, and the document has to exist first. If you would like help building it, or an audit of accounts belonging to people who have already gone, both are short jobs and the second one is usually revealing.
