Shared Accounts Need an Offboarding Plan Too

Named accounts are easier to remove than the informal access people collect around a role. Before offboarding, inventory shared mailboxes, delegated calendars, shared drives, distribution lists, integrations, vault entries, and any service where the departing person is the only administrator.

Assign an owner to each business asset. Ownership does not mean copying private messages or personal files. It means confirming that the company can continue approved work, retain required records, and remove access on the authorized schedule.

The coordinator can collect system-owner confirmations and prepare transfer steps. Security, HR, and the relevant manager decide timing, exceptions, legal holds, forwarding, and access changes. Never ask for a departing worker's password or keep an account active merely because no replacement was named.

At the approved time, verify removal directly in each system. A closed helpdesk ticket is evidence of a request, not necessarily evidence that sessions, tokens, recovery methods, and delegated access are gone.

Keep unresolved items on an exception register with an owner and due time. Finish with a short handoff showing what transferred, what was removed, and which risks remain open.