Access removal after separation: a sampling protocol

This study asks whether access removal after separation is recorded, verified, and owned across every system in scope. It compares the separation date, the access inventory, the removal confirmation, and the owner sign-off. The result is intended to improve offboarding controls, not to evaluate the security of a specific system. The scope is a defined set of separations during a fixed period. The study may compare voluntary and involuntary separations, but it should not present a local rate as an industry benchmark. A small sample can reveal an unverified system even when most accounts were disabled. The report should show both so the team does not mistake a closed ticket for a verified removal.

The population is the set of employees who separated during the window and had access to at least one employer system. Include voluntary, involuntary, and retirement separations, and include cases with a legal hold. Exclude contractors unless the protocol treats them separately. The unit is one employee-system pair at the offboarding review. If an employee had access to five systems, that is five units rather than one. A case-level summary can be reported separately, but the system-level detail is what shows where the removal failed.

A complete removal record should show the system, the account identifier, the separation date, the removal date, the method, the owner, and the confirmation. If the account remains for a records or legal reason, the record should show the reason and the compensating control. A ticket marked complete is not proof that the system access was removed. The reviewer should check the system or a system-generated report. If the system cannot be checked, the unit is unverifiable, not complete.

Draw the sample across systems, departments, and separation types. Include a privileged account, a shared mailbox, and a case with a legal hold. These are the units most likely to expose a gap that a standard account review would miss. Record the selection method and the frame version. If the sample is stratified by system, report the number selected from each. A small system with a high-risk role may deserve an oversample for learning, but the weighted and unweighted results should remain separate.

Classify each unit as removed, not removed, or unverifiable. Removed means the system evidence shows the access is gone or disabled. Not removed means the access remains without an approved reason. Unverifiable means the reviewer could not obtain the system evidence. Use a small reason set such as late notification, missing owner, system unavailable, shared credential, legal hold, or records retention. Assign the reason to the stage where the evidence is missing, not to the person who noticed it.

Report the number of employees, the number of system units, and the number removed, not removed, or unverifiable. Show the result by system and by separation type. Include the time between separation and removal where the dates are available. Use counts and rates together. A high removal rate across standard accounts can hide a privileged account that remains active. The report should show the high-risk units separately rather than averaging them into the total.

A late removal may reflect a notification delay, an owner who was unavailable, or a system that requires manual work. A not-removed unit may reflect a shared credential or a group membership that the primary account check missed. Each cause suggests a different fix. Do not treat a single late removal as proof of a broken process, and do not treat a high removal rate as proof that the process is safe. The study observes the record and the system evidence, not the actual use of the account.

The study may miss systems that were not included in the inventory or accounts that were never linked to the employee. It cannot determine whether an account was used after separation. That question requires a separate log review or security investigation. System changes and legal holds can affect the result. Note the relevant dates and avoid comparing periods with different rules. A small sample may be useful for finding a control gap without supporting a precise estimate. The report should state the sample size and the period so a reader can judge how much weight the pattern can carry. It should also name the systems that were unavailable.

Use the minimum employee information needed to link the account to the separation. Keep the analysis in a restricted location and follow the retention rule. Do not include passwords, authentication codes, or unnecessary personal information. The identity and system owners decide how an account is removed or retained. The study should not be used to discipline an individual without a separate review. Its purpose is to improve the notification, ownership, and verification path.

Choose one change based on the most common or highest-risk gap. It might be an earlier separation notification, a system inventory requirement, a second review for privileged access, or a shared-credential rotation step. Name the owner and the next sample date. Recheck the same units after the change. If the removal rate improves but the unverifiable rate rises, the change may have improved ticketing without improving evidence. Report both outcomes and keep the decision log with the offboarding procedure.

An employee separates on a Friday and the manager notifies the identity team on Monday. The central account is disabled on Monday, but a shared application password remains unchanged. The study records the central account as removed and the shared credential as not removed with a reason code. The correction rotates the shared credential and records the change. The example shows why a single account check is not enough. The offboarding inventory should include shared credentials and group memberships, not only the primary login.

Review a sample after each quarter and after a significant separation or reorganization. A quarterly sample may be enough for a stable team, while a monthly review is more useful during a reduction or a high turnover period. Record the cadence and the owner in the offboarding procedure. Keep the exception log between samples so late removals and unverified systems stay visible. If the same system appears in every exception, check the notification path and the owner assignment before coaching the coordinator.

The report should not say that the organization is secure or that an account was not misused. It observes whether the removal record and the system evidence agree. A separate log review or security investigation is needed for the misuse question. The report also should not present a small sample as a firm-wide rate. If the review covered one department or one system, say so. A later review can expand the frame, but it should treat the first result as a baseline.

Report the number of employees, the number of system units, and the number removed, not removed, or unverifiable. Show the result by system and by separation type. Include the time between separation and removal and the number of high-risk units reviewed. Use counts and rates together and keep high-risk units separate from the total. Describe the systems checked and any system that could not be accessed. End with one change, one owner, and the next sample date.

Choose a change that addresses the most common or highest-risk gap. An earlier notification may shorten the removal delay, while a required system inventory may close an unverified unit. A second review for privileged access may be appropriate when the risk is high. Test the change on the next quarter and compare the same measures. If the removal rate improves but the unverifiable rate rises, the change may have improved ticketing without improving evidence. Report both outcomes.