The 30-Day
Window

The Situation

A small office hires and loses people the way every business does — a few times a year, sometimes more. Each time, someone gets added to email, shared drives, software licenses, maybe a building access code. When someone leaves, in theory the reverse happens. In practice, "in theory" is doing a lot of work in that sentence.

The Problem with Assumed Offboarding

Onboarding has urgency — a new hire can't work without access, so it gets done. Offboarding has no urgency from the departing person's side, and often gets handled informally: IT removes the obvious stuff (email, maybe), and everything else — shared drive folders, third-party software seats, vendor portals — sits untouched because nobody owns the full list.

The result is a slow accumulation of "ghost access": accounts tied to people who no longer work there, quietly racking up license costs or, worse, sitting as unmonitored entry points.

The Approach

The fix isn't a big security platform — it's a checklist that actually gets followed. I built a simple audit framework: a single inventory of every system a person could have access to (email, drives, software, physical access, vendor portals), cross-referenced against current staff.

Onboarding and offboarding both run through the same list, in opposite directions. Adding access and removing it become mirror-image procedures, which makes gaps visible immediately — if there's no "remove" step for something that has an "add" step, that's the gap.

What the Audit Found

Running this against an existing staff roster surfaced exactly the pattern you'd expect: a handful of accounts tied to people who'd left months ago, two unused software licenses still being billed, and one shared-drive folder with edit access for a former contractor.

None of this was a crisis. All of it was invisible until someone wrote it down in one place.

The Outcome

The compounding cost of ghost access is invisible until you list it out. Once it's listed, it's a five-minute fix.