Staff Joining or Leaving? 7 Steps to Manage Accounts and Access Safely
Every organisation has people joining, changing roles and moving on. Each change touches your systems: email accounts, shared folders, Wi-Fi, accounting software, door access and sometimes physical keys. When these changes are handled in a hurry, former staff can keep access long after they leave, and new staff can wait days before they are able to work. A simple, repeatable process avoids both problems. Here are seven practical steps for Bhutanese offices, schools and businesses.
1. Keep a list of every system that needs an account
Start by writing down everything a staff member may be given: business email, file sharing, internal software, the office network and Wi-Fi, printers, CCTV or gate controllers, social media pages, and any online portals your organisation uses. You cannot remove access you do not know about, so this list is the foundation of everything else.
2. Give access based on the role, not the person
Decide in advance what each role needs. An accounts assistant may need the finance system but not the server room; a front-desk officer may need the booking system but not payroll files. Giving only what the role requires keeps sensitive information safer and makes later changes much easier.
3. Use individual accounts instead of shared logins
Shared passwords such as one “admin” login for everyone are convenient, but when someone leaves, the password must be changed for all users, and it is impossible to know who did what. Individual accounts let you disable one person without disturbing the rest of the team.
4. Prepare a joining checklist
When a new staff member starts, work through the same checklist each time: create accounts from the role template, issue any ID or access card, set up the computer, and explain basic security habits such as strong passwords and how to recognise suspicious emails. A checklist means nothing important depends on someone’s memory.
5. Review access when roles change
Promotions and transfers are easy to overlook. Someone who moves from finance to administration may still have finance access months later. Whenever a role changes, add what is needed for the new role and remove what belonged to the old one.
6. Follow a leaving checklist on the last working day
When someone leaves, disable their accounts promptly rather than waiting weeks. Change any shared passwords they knew, collect laptops, access cards and keys, and update door or gate access lists. Before closing an email account, arrange for important messages and files to be handed over to a colleague so that nothing is lost.
7. Check the full list regularly
Every few months, compare your list of active accounts against your current staff list. Remove accounts that nobody uses and confirm that administrator rights are held only by those who genuinely need them. A short regular review often catches forgotten accounts before they become a risk.
Make it part of your routine
Managing staff access is less about expensive tools and more about having a clear process and following it every time. Once your list, role templates and checklists are in place, joining and leaving become quick, predictable tasks rather than last-minute worries.
Need help setting this up?
eDruk Private Limited, a Bhutanese software company established in 2004, can help you review your systems, organise user accounts and access, and plan secure networks and software that are easier to manage. Talk to our team:
- Email: edruk@edruk.com.bt
- Phone: +975 2 332277
- Website: https://www.edruk.com.bt