New employee access checklist: day-one accounts and removal on the last day

In a small company, access for new people is often arranged by whoever happens to remember. A manager sends a few messages, the new colleague gets some accounts on day one and the rest over the following weeks. Leaving is worse: people are thanked, a farewell is organised, and the accounts quietly stay active for months.

This article describes a simple checklist that a company of ten to a hundred people can introduce in a week, with no special software. A shared spreadsheet is enough.

What goes wrong without a list

• The first days are wasted. The new person waits for access to email, the shared drive or the main business system, and the manager chases each request separately.
• Too much access. To save time, someone copies the access of a colleague, including things the new role never needs.
• Nobody owns removal. Everyone assumes that IT, HR or the manager has done it.
• Forgotten accounts. Shared logins, subscriptions registered under a personal name and tools used by one team are not on anyone's list.
• No record. After a problem nobody can say who had access to what, and since when.

Step 1: write one access list per role

Make a table with a row for each system and a column for each role, such as sales, operations, finance and management. In each cell mark whether the role gets no access, read-only access or the right to change data. Keep it to one page.

The reason to define it by role is speed and consistency. When a salesperson joins, nobody has to think about what they need; the sales column is the answer. Anything beyond it is an exception that the manager requests and explains in one sentence.

Include the less visible places as well: the accounting system, the customer database, the shared mailbox, the password manager, cloud storage, the website administration and any external tool the team pays for.

Step 2: name two owners

• The person who opens accounts. This is often the office manager or whoever looks after IT. They work from the role list, not from a chat message.
• The person who confirms removal. This should be a different person, for example the head of operations or finance, so that removal is checked and not only performed.

In a very small company one person may do both, but then the owner or director should look at the completed leaving checklist.

Step 3: prepare day one before the day

A week before the start date the manager tells the account owner the role and the start date. By the first morning the new person should have:

1. Their own company email and a login to the shared drive.
2. The role's systems, each with a personal account (never a shared login).
3. A password manager account, with the team's shared folders only if the role needs them.
4. Short written rules on how to handle company data, one page at most.
5. A named colleague to ask when something does not work.

Mark each item as done with a date. A few minutes of preparation saves the whole first day.

Step 4: remove access on the last day, from a list

Use the same table in reverse. On or just before the last working day, the account owner goes through every system in the role's column and removes or disables the account. Where possible, disable first and delete later, so mail and files can be handed over.

Items that are often missed:

• Shared logins. If the person knew a shared password, change it.
• Forwarding. Set up forwarding or an auto-reply on the mailbox for a defined period, then close it.
• Personal-name subscriptions. Move any tool registered under the person's own email to a company address.
• Devices and keys. Laptop, phone, building access and company cards.
• External accounts. Customer portals, supplier systems and social media where the person acted for the company.

The second person then confirms by looking at each system's user list, not by trusting the checklist. This is the check that finds the account nobody remembered.

For work that was in progress, see also handing over work when someone leaves or falls ill.

Step 5: handle changes of role too

People move between teams, and access tends to accumulate. When someone changes role, compare the old and new columns and remove what the new role does not need. Do this on the day of the change, not "later".

Step 6: review the lists

Twice a year, and after any reorganisation, do two things. First, check the role table against reality: are there new systems, and do the columns still make sense? Second, take the user list of the two or three most sensitive systems and ask the manager of each person whether they still need their access. This takes about an hour and usually finds a few accounts that should not exist.

For access inside a single internal tool, the article on who may do what and how to review it every quarter goes into more detail.

What to avoid

• Copying a colleague's access "because they do the same job".
• Giving broad access at the start with the plan to reduce it later. Later rarely comes.
• Leaving removal to the departing person's manager alone, without a second check.
• Keeping the list in one person's head or private mailbox.

Summary

Define access by role, name one person who opens accounts and another who confirms removal, prepare day one in advance and remove access from a list on the last day. The result is a calmer start for new people, fewer forgotten accounts and a clear record when someone asks who had access to what.

Sources

• Our related articles linked above.
• The role table, the owner split and the review rhythm are a working practice, not a standard; adapt them to your company, contracts and legal requirements. Examples are illustrative. No client results or market figures are claimed in this article.