The IT Security Risk Hiding in Your Onboarding and Offboarding Process
Most businesses have HR paperwork for bringing on a new hire and checking out a departing one. Far fewer have an equally solid IT process running alongside it — and that gap is one of the most common, most preventable security risks in businesses of every size.
Here’s what tends to fall through the cracks, and why it matters more than it seems to at the time.
Onboarding: Access Granted Faster Than It’s Tracked
New hires need access fast — email, shared drives, line-of-business systems, sometimes a dozen different logins on day one. Under pressure to get someone productive quickly, that access often gets granted informally: someone shares a password, an account gets cloned from a similar role, permissions get set broadly “just to be safe.” The result is new employees frequently ending up with more access than their role actually requires — access that often never gets revisited.
Offboarding: The Bigger Risk, Handled the Least Carefully
This is where the real exposure lives. When someone leaves — whether it’s an amicable departure or not — every account they had access to needs to be disabled promptly: email, file storage, business applications, VPN access, any shared logins they knew. In practice, this step is often inconsistent. A departing employee’s email might get shut off quickly while access to a lesser-used system quietly stays active for weeks or months.
Why This Matters More Than It Seems To
A former employee with lingering access isn’t always a malicious risk — but it’s always an unnecessary one. Sensitive data, customer information, and financial systems shouldn’t remain accessible to someone no longer with the business, regardless of how the departure went. And for businesses in regulated industries, an inactive account that should have been disabled is exactly the kind of gap that turns up in a compliance audit.
What a Solid Process Actually Looks Like
A documented checklist of every system a role has access to — not tribal knowledge held by one person, which itself becomes a risk if that person is ever unavailable.
Access provisioned based on role, not convenience. New hires get exactly what their role requires, not a broad set of permissions cloned from someone else “to save time.”
Same-day deactivation on departure, across every system — not just email, and not on a “get to it when there’s time” basis.
A periodic access review, checking who has access to what against who actually still needs it. Roles change, projects end, and access frequently doesn’t get updated to match.
Why This Gets Overlooked
It’s not usually negligence — it’s that onboarding and offboarding happen in HR’s world, while access and permissions live in IT’s world, and the two don’t always talk to each other as consistently as they should. Closing that gap doesn’t require a major overhaul, just a clear, repeatable process both sides actually follow.
At Waypoint Technology Solutions, we help businesses build exactly this kind of process — so access is granted deliberately, revoked promptly, and never left to memory. If you’re not confident every former employee’s access has actually been shut off, that’s worth checking today, not at your next audit.