Why Bad Onboarding Is the Real Reason Your Offboarding Takes Three Weeks

By the time a staff member hands in their notice, the decisions that will make their exit clean or messy have already been made. They were made in the first weeks of that person’s tenure, back when nobody was paying close attention because there were a hundred other things going on. A shared login here, a quick SaaS sign-up there, a personal laptop used until the company one turned up. Six months later none of it looks like a decision any more. It just looks like how things are done.

We’ve sat across the table from Northern Beaches business owners who’ve spent three weeks untangling a single departure: chasing down logins, tracking a laptop that’s sitting at someone’s house, unpicking tools nobody remembers signing up for. Done properly, that same process takes about 90 minutes. The difference isn’t the offboarding. It’s what happened months earlier, on day one — and it’s the same reason a new hire is often a bigger cyber risk than people expect.

What’s really going wrong when offboarding takes three weeks

A clean offboarding is short because it’s mostly automatic. An account gets disabled in your identity system, which cascades access removal across every connected tool. The device gets wiped remotely or collected and wiped on site. Email forwards to a manager or converts to a shared mailbox. Accounts in your CRM and project tools get reassigned. A handover note, already templated because it was templated at onboarding, gets filled in and filed.

The messy version starts with a manual list of tools nobody can fully remember, usually reconstructed with help from the person who’s leaving. You find a Figma account, a Notion workspace, an Airtable base, each set up independently with passwords sitting in someone’s personal password manager. The laptop’s at home and they’re in no rush to return it. A client emails to say they got a strange message from a personal address. Six weeks later a vendor charges the company card for a seat everyone thought was cancelled.

Identity management people call this the “joiner, mover, leaver” lifecycle, and it’s the same three-phase model Microsoft and most identity vendors use. A rushed joiner phase is what turns the leaver phase into a scramble.

Four onboarding habits that guarantee a messy exit

Letting new hires sign up for SaaS tools on their own. When someone signs up for a tool with their work email and a password only they know, that account is functionally theirs. You can’t reset it without a notification going straight to them, and you might not know it exists until an invoice shows up, or until it goes dark after they leave and a project breaks. The fix is provisioning every tool through a central identity system, so any new app gets connected to single sign-on before the first login.

Tolerating personal devices “just until we sort something out.” Personal devices used for work rarely stay temporary. Apps get installed, client systems get connected, files get downloaded, and the temporary fix becomes how someone works day to day. When they leave, you can’t wipe company data off a device you don’t own and never enrolled in a management system. You’re relying on goodwill, which is fine most of the time, but it’s not a control.

Shared logins for tools nobody wanted to pay per seat for. Shared credentials are the worst offender at offboarding time. When five people use one login, you can’t remove one person’s access without changing the password for everyone, and you usually discover this the day the person who set up the account is the one leaving. Per-seat pricing is the cost of doing this properly; the money saved on shared logins comes back as wasted hours and exposed access later.

Letting client relationships live in one person’s inbox. This one bites agencies and professional services hardest. When a senior consultant or account manager leaves, the client relationship often leaves with them. The history, the preferences, the half-finished threads all lived in one inbox, and once that person’s gone, it’s either inaccessible or awkward to retrieve. A shared mailbox or a CRM where client communication gets logged, even something as simple as CC’ing client threads to a shared Microsoft 365 mailbox, is a meaningful step up from what most small businesses have in place today.

How to retrofit hygiene on the team you already have

You can’t go back and re-onboard your current staff, but you can audit what’s there and close the gaps before the next departure.

Start with a SaaS audit. Pull three months of business credit card statements and list every recurring charge. For each one, work out who set it up, who holds the login, whether it’s tied to a personal or company email, and whether anyone else could get in if that person left tomorrow. You’ll usually find a tool nobody remembers signing up for, at least one account with a single point of failure, and possibly one you’re still paying for after the original owner has already gone. It’s a spreadsheet and an afternoon, not a technical project.

Next, build a device register: who has what, when it was issued, whether it’s enrolled in management, and what company data it can reach. Ask every staff member to confirm what they actually use for work, personal devices included. For any personal device with access to company systems, the minimum fix is managed app access for email and files, so it can be disconnected remotely without touching anything else on the device.

Finally, move client communication somewhere shared. A shared inbox or a CRM with logged contact history means the relationship belongs to the business, not to whoever happens to answer the phone that week.

What your IT provider should be doing at onboarding

Most IT providers only get a call when someone resigns. They disable the account, collect the laptop if they can find it, and do their best with whatever documentation exists. That’s the wrong end of the process to show up at.

We set new accounts up in your identity provider, enrol devices in mobile device management, and provision access through single sign-on, so every tool a new hire touches is connected to one identity that switches off in a single action when they leave. We also keep a handover document for each staff member, listing every system they access, every client relationship they own, and every credential tied to their name. If your current provider can’t tell you what they do at onboarding, that’s worth a conversation.

A plan you can start this month

You don’t need to wait for a resignation to start tightening this up. Spend a couple of weeks running the credit card SaaS audit and flagging any account only one person can access. Spend the next couple building the device register and locking down personal-device access where it exists. Then look at where client communication really lives, and move the highest-risk relationships into a shared inbox or CRM. Use what you find to write the onboarding checklist you wish you’d had, and apply it to your very next hire.

None of this is a big technology project. It’s a spreadsheet, some honest conversations with your team, and a few hours of your IT provider’s time.

If your business is anywhere across the Northern Beaches and you’d like a hand running that audit or setting up proper onboarding from day one, get in touch with our team at Vaelis IT. Our managed IT support covers exactly this: setting logins, devices and access up properly from the start, so the next departure is a checklist instead of a three-week clean-up.