Departing Employees, Live Credentials: The Offboarding Gap in Lehigh Valley Professional Firms

An employee leaves your Allentown, Bethlehem, Easton, or broader Lehigh Valley firm. Human resources closes the personnel file. Their manager collects the key and laptop. Someone disables the company email account.

Then the business moves on.

Months later, an owner asks a concerning question:

“I think that former employee may still have access to our systems.”

For a law firm, accounting practice, consultancy, or financial services firm, that is not merely an IT housekeeping issue. It is a business risk involving client confidentiality, professional obligations, regulatory expectations, and the firm’s ability to prove who accessed sensitive information.

Offboarding is complete only when the former employee no longer holds a path into the business, directly or indirectly.

The offboarding gap is larger than one user account

Most firms understand the basic step: disable the employee’s Microsoft 365, Google Workspace, or network account.

That is necessary, but it is not enough.

A departing employee may still have access through:

• A personal device with saved browser passwords
• A VPN profile or remote desktop connection
• A shared accounting, tax, legal, or financial portal
• A delegated mailbox or shared inbox
• A cloud file link shared with a personal email address
• A password vault folder that was never reviewed
• A vendor account where the employee was the only administrator
• An application connected through OAuth or single sign-on
• A forwarding rule that continues sending firm email elsewhere
• A service account or shared login that nobody remembers to rotate

The risk is especially serious when the employee worked with client files, tax records, financial information, legal documents, intellectual property, or confidential business strategy.

A firm should be able to answer three questions for every departing employee:

1. What systems and data could they access?
2. Which access paths were removed or reassigned?
3. Who verified and documented that the process was complete?

If the answer to any of these is unclear, the offboarding process has a gap.

Disabling is not the same as deleting

One of the most common misunderstandings is treating account disabling as permanent access removal.

Disabling an identity generally prevents a new login through that account. It may not automatically:

• Terminate existing sessions
• Revoke active authentication tokens
• Remove saved credentials from a device
• Delete mobile email profiles
• Remove VPN certificates
• Revoke access granted through a group
• Eliminate mailbox forwarding rules
• Remove delegated mailbox permissions
• Revoke third-party application connections
• Rotate shared passwords the employee already knew

Deletion can create a different problem. If an account is deleted too quickly, the firm may lose mailbox records, ownership of cloud files, audit history, or information needed for litigation holds and retention requirements.

A controlled process usually begins with disabling the identity, terminating sessions, preserving required records, transferring ownership, and then deleting or archiving the account according to the firm’s retention policy.

The right sequence depends on the firm’s systems and obligations. The important point is that “the account is disabled” should be treated as one completed task, not the definition of a completed offboarding.

A documented offboarding checklist for professional services firms

A written checklist prevents a time-sensitive personnel change from depending on memory. It should identify the responsible person, the completion time, and any exceptions.

1. Identity and email

At the separation time:

• Disable the employee’s directory or identity provider account.
• Remove access to single sign-on applications.
• Terminate active sessions and revoke refresh tokens.
• Remove registered MFA devices, backup codes, and security keys.
• Reset the account password where appropriate.
• Remove group memberships and administrative roles.
• Review mailbox forwarding rules.
• Remove mailbox delegation and shared mailbox permissions.
• Set an approved auto-reply or convert the mailbox according to policy.
• Preserve email and records that the firm is required to retain.

Do not simply forward all incoming mail to another employee indefinitely. Establish a specific owner, retention period, and review process. A former employee’s mailbox may contain client instructions, engagement records, privileged communications, or evidence relevant to an active matter.

2. Devices: return, secure, and wipe

The firm should maintain an inventory of company-owned devices assigned to each employee. That inventory should include laptops, desktops, phones, tablets, security tokens, removable drives, and specialized equipment.

At offboarding:

• Recover the device and accessories.
• Record the asset’s condition and return date.
• Lock the device remotely if it is not immediately recovered.
• Confirm whether firm data was stored locally.
• Preserve information that must be retained.
• Remove the employee’s account and reset the device.
• Wipe or securely erase the device before reassignment.
• Document the wipe or destruction process.

A laptop returned to the office is not automatically safe to hand to the next employee. The device may contain saved passwords, browser sessions, downloaded client files, local email archives, VPN certificates, or authentication applications.

3. VPN and remote access

Remote access often remains outside the standard user-account process. Review and revoke:

• VPN accounts and certificates
• Remote desktop access
• Remote management tools
• Cloud workstation access
• Wireless network credentials
• Virtual private servers
• Remote access granted to home offices
• Personal devices enrolled in mobile device management

If the former employee had access to a shared VPN or remote administration credential, rotate it. The question is not whether the employee was expected to remember the password. The question is whether the firm can prove that the credential is no longer usable.

4. Cloud applications and file shares

Create an inventory of the applications the employee used, not only the applications IT officially assigned. Ask the employee’s manager about client portals, industry software, collaboration platforms, document management systems, and specialized tools.

Review:

• Microsoft 365, Google Workspace, or equivalent services
• SharePoint, OneDrive, Google Drive, and other file shares
• Teams, Slack, and collaboration channels
• CRM and project management systems
• Practice management and document management platforms
• Accounting, payroll, tax, and financial applications
• External sharing links and guest accounts
• Ownership of files, folders, sites, automations, and scheduled jobs

Transfer ownership to a named current employee or controlled business account. Avoid leaving critical files or workflows owned by an individual who no longer works for the firm.

5. Third-party portals and vendor accounts

Professional services firms frequently rely on portals that are not managed by the firm’s central identity system. Examples include:

• Client tax and payroll portals
• Banking and payment platforms
• Court filing or legal research systems
• Insurance and benefits portals
• Software vendor support accounts
• Building access and alarm systems
• Marketing, website, and social media accounts
• Hardware, copier, and telecommunications portals

Each vendor should have a current business owner and at least one backup administrator. Remove the departing employee’s access and rotate credentials when the employee knew a shared login.

This is also an opportunity to remove old accounts for contractors and former employees who left before the firm had a formal process.

Shared accounts create quiet ownership and accountability problems

Shared accounts may appear convenient, but they weaken two important controls: attribution and accountability.

If five employees use the same login to access a client portal, the firm may not be able to determine who viewed, downloaded, changed, or transmitted information. When one of those employees leaves, changing the password may protect the account, but it does not solve the underlying ownership problem.

For each shared account, identify:

• The business purpose
• The current owner
• The approved users
• The vendor relationship
• The location of the credential
• The last password rotation
• The recovery email and MFA method
• The procedure for adding and removing users

Where possible, replace shared logins with individual accounts and role-based permissions. Store unavoidable shared credentials in a managed password vault, not in spreadsheets, browser notes, email messages, or documents saved to a common drive.

Review password vault entries during offboarding. Remove the former employee’s vault access and identify every shared credential they could view. Rotate those credentials, including emergency administrator accounts and “break-glass” accounts.

Watch for admin accounts nobody owns

A surprising number of small and midsize firms have administrative accounts created for a specific employee, vendor, or project. Years later, the account remains active even though nobody can explain who is responsible for it.

These accounts are especially risky because they may bypass normal approval processes and provide broad access.

During an offboarding review, look for:

• Global or tenant administrators
• Domain administrators
• Local workstation administrators
• Firewall and network administrator accounts
• Cloud billing and subscription owners
• Backup system administrators
• Website and domain registrar accounts
• Password manager administrators
• Vendor support accounts
• API keys, certificates, and service accounts

Assign ownership to a role or controlled business identity rather than a single person whenever possible. Review these accounts regularly, not only when someone leaves.

The compliance and client-trust angle

Firms that hold client data have a responsibility to limit access to people with a legitimate business need. For accounting practices and tax professionals, the IRS guide Safeguarding Taxpayer Data specifically emphasizes limiting access, using unique credentials, protecting devices, maintaining audit trails, and immediately preventing terminated employees from accessing customer information.

The Tuesday IRS/FTC Safeguards Briefing is another useful resource for firms reviewing their obligations and security practices.

The FTC Safeguards Rule may apply to professional firms that meet its definition of a financial institution, including many tax preparation businesses. Requirements vary based on the organization and the information it handles, but a documented offboarding process supports core safeguards such as access control, risk assessment, monitoring, service-provider oversight, and protection of customer information.

Compliance is not the only concern. Clients may ask how the firm protects their confidential information. A firm that can show a repeatable process, completion records, access reviews, and clear ownership is in a stronger position than one relying on verbal assurances.

If you suspect a former employee still has access

Do not wait for the next quarterly review.

Start by preserving relevant logs and identifying the systems involved. Then:

1. Disable the former employee’s primary identity.
2. Terminate sessions and revoke tokens.
3. Remove MFA devices, VPN access, group memberships, and delegation.
4. Review mailbox rules, cloud sharing, and external links.
5. Identify shared credentials and rotate them.
6. Audit third-party portals and vendor accounts.
7. Review sign-in and access logs around the departure date.
8. Preserve evidence before deleting accounts or devices.
9. Escalate suspected unauthorized access to qualified cybersecurity and legal professionals.

Avoid making assumptions based only on whether the former employee can open their old email. A forgotten vendor portal or shared credential may be the more serious exposure.

Make offboarding a business control, not an afterthought

A secure offboarding process protects more than the network. It protects client relationships, firm reputation, professional obligations, and the continuity of the business.

Every firm should know who has the keys, where those keys work, who owns them today, and what happens when someone leaves. If that information cannot be answered quickly, the firm has an access-management risk worth addressing.

B&R Computers helps professional services firms across Allentown, Bethlehem, Easton, and the Lehigh Valley review access, devices, cloud systems, vendor accounts, and security documentation. Start with the B&R Computers resource center, or schedule a Business Review and Strategy Session to identify where former employees, shared credentials, and unclear ownership may still expose your business.