Updated on November 4, 2026 by Whole Technology
Someone leaves your firm — a resignation, a retirement, a seasonal hire whose busy season just ended. The farewell lunch happens, the desk gets cleaned out, and everyone moves on.
But their access usually does not.
In Philadelphia-area accounting firms, a departed employee’s accounts are a quiet risk that lingers for months: a Microsoft 365 login nobody disabled, a QuickBooks user still active, a shared password they know by heart, a hardware security key sitting in a desk drawer. Attackers know that offboarding is where firms are sloppiest, and former-insider access is one of the easiest ways into client data.
Here is the offboarding checklist we recommend Philadelphia-area firms run the day someone leaves — not the week after.
1. Disable accounts the same day
Microsoft 365, email, VPN, and remote access go first, on the last day, before the person walks out. Not “when IT gets around to it” — same day. Every day of delay is a day a known credential still works.
2. QuickBooks and practice software
Payroll, tax, and practice-management software each have their own user lists, separate from Microsoft 365. QuickBooks Online, UltraTax, and your document management system all need their own deactivation pass. These are the accounts most often missed, because they live outside the main IT checklist.
3. Shared passwords and shared mailboxes
If the departed employee knew any shared passwords — the office Wi-Fi, a shared vendor login, a safe combination of credentials the team passes around — those passwords change now. Shared credentials are the hardest access to revoke, because there is no account to disable. The only fix is rotation.
4. Hardware keys and devices
If your firm uses YubiKeys or other hardware security keys, collect them on the last day and remove them from the person’s accounts. The same goes for laptops, phones, and any firm-owned device — wiped before reassignment, not after.
5. Forwarding, rules, and delegates
Check for mailbox rules, email forwarding, and delegate access the person may have set up — including rules that forward mail externally. A forwarding rule to a personal inbox is a data leak that survives account deactivation if it is not removed first.
6. Seasonal and part-time staff
Busy-season hires deserve the same treatment as full-time departures. Seasonal accounts created in January are still active in July unless someone closes them. Put a calendar reminder on every seasonal account’s end date when it is created.
Make it a written process
Offboarding should not depend on someone remembering. A one-page checklist — accounts, software, passwords, keys, devices, forwarding — signed off by whoever handles IT, turns a scramble into a routine. It also matters for compliance: the FTC Safeguards Rule and IRS expectations around access control both assume you can show who had access to client data, and when that access ended.
If you are not sure your firm’s offboarding is airtight, that is exactly the kind of gap our free 27-point IT assessment is built to find — before a former employee’s login becomes someone else’s way in.
