The last day is when everything breaks. Not because people leave angrily — because at a small company, offboarding is an event with no owner. Big companies have HR run a process. A five-person team has whoever remembers.
I've watched the same failure mode enough times to write it down: notice lands, everyone feels awkward for two weeks, the last day is a cake and a card, and three weeks later someone discovers the departed employee's forwarding rule is still mailing invoices to a personal address. Here is the checklist that makes the leaving boring instead.
Start it the day notice lands
Two weeks of notice is two weeks of runway. Spend it on paperwork, not awkwardness:
- Open the offboarding ticket the same day, date-stamped, with a name on every line.
- Pull the access inventory while you can still ask them what they have: SSO list, the apps that don't sit behind SSO, devices, badge, keys, vendors where they're the named contact.
- Freeze new grants. No new repo access, no new vendor portal in the final fortnight.
Revoke by blast radius, not alphabetically
SSO is the master switch — one toggle kills email, calendar, and every SaaS behind it at the exact hour employment ends. Then walk what's outside it: the directly-created accounts, contractor portals, social logins.
The quiet hole is never the password you changed. It's the forwarding rule set months ago, the OAuth grant nobody reviewed, the shared analytics login, the personal API key that outlives its maker. Rotate every shared credential they knew on day zero. Then prove the revocation: try the old password from a personal machine. Revocation systems have a way of quietly not revoking.
Hardware and keys come back before the farewell coffee
Laptop, phone, dongles, the Yubikey, the parking fob — one signed line each. Wipe and reimage the laptop the same week; a departed employee's MacBook in a drawer is an unpatched machine holding your source code.
And the physical stuff, which has no admin console to remind you: mark keys returned on the register, rotate the door codes they knew, deactivate the badge the day employment ends — not the end of the month.
Cut the mailbox over on day zero
Silent forwarding off. Out-of-office pointing at a real human's name and address, not back at the departed mailbox. Recurring meetings reassigned — meetings the person owned die the day their calendar does. And write the farewell email deliberately: it announces to every customer and vendor on the thread that a person with knowledge of your systems just left, and tells them exactly who inherits the relationship.
The two things teams always skip
The "only they know" list. One hour of "walk me through the things not written down anywhere" — where the deploy script actually lives, which vendor rep answers emails, why the payment webhook has that weird retry setting — beats two weeks of archaeology after.
The two-week-after check. Re-diff your SSO seats against the people list. Watch the audit logs for the departed account. Count the relics: the badge that wasn't returned, the calendar that still has their name. Every relic is a process gap.
One variant worth knowing in advance: if the exit is hostile, the sequence inverts — revoke before the meeting, preserve before you delete, and document the timeline. A deleted mailbox is evidence you can't un-delete.
This is one page of the HIVE80lab ops notes — the full checklist, including the printable one-page version, lives there. If you want the surrounding kit, the Ops Starter Kit covers incident response for small teams, The First 30 Minutes is a free one-page quick-start, and the Ops Mega Bundle is all five kits in one download.
Top comments (0)