What are common mistakes with leaver process?

Common mistakes with the leaver process are late notification, incomplete asset recovery, and failing to disable all accounts and tokens promptly. Orphaned access often remains in SaaS apps, VPNs, email, and shared folders. Organisations should trigger offboarding from authoritative HR events, revoke access in sequence, and record completion checks for every system.

Why leaver process mistakes keep creating access risk

The leaver process is where identity, access, and asset control must close cleanly together. Mistakes usually happen when offboarding is treated as an HR admin task instead of a security workflow, so access removal, device return, and credential cleanup happen out of sequence. That leaves a window where a departing user can still reach email, SaaS apps, VPN, shared drives, or administrative tools.

A sound leaver process starts from the authoritative departure event, not from informal notification. The best results come when HR, IT, security, and managers share a single trigger, because delay at any handoff can leave access active long after employment or contract end. The joiner, mover, leaver path is easiest to get wrong when teams rely on memory, email chains, or manual tickets instead of a controlled workflow. Joiner-Mover-Leaver (JML) Guide

Another common failure is partial deprovisioning. Teams remove the obvious account first, then forget secondary accounts, delegated access, API tokens, shared credentials, or long-lived sessions that still function after the user is gone. The same pattern shows up when offboarding is handled system by system rather than as a complete inventory-driven revocation exercise, because orphaned access often survives in places no one checks until much later. SCIM and Automated Provisioning Guide IAM and IGA Basics Workforce Identity Security Guide

What usually gets missed during offboarding

The most persistent gaps are account sprawl, token sprawl, and asset recovery gaps. A leaver may lose their primary login but still retain access through SSO-linked SaaS apps, remote access tools, cached sessions, signing keys, or team-shared folders. Where organisations rely on multiple identity stores, the failure is often not lack of intent, but lack of confirmation that every downstream system actually executed the deprovisioning action.

Physical and logical handback also diverge more often than teams expect. Laptops, mobile devices, badges, removable media, and locally stored secrets can all outlive the formal offboarding step if the process does not tie asset return to access termination. In practice, the cleanest leaver workflows treat equipment recovery, credential revocation, and privilege removal as one coordinated closure, not three separate tasks. Top 10 Secrets Management Mistakes Top 10 NHI Issues

A particularly dangerous variant is when a departing employee also owned automation, application, or service credentials. If the leaver process only targets human accounts, production integrations can keep running on unattended tokens and keys. That is why good offboarding checks for credential-bearing assets as well as user accounts, especially where a person can still influence systems indirectly after departure. Ultimate Guide to NHIs — Lifecycle Processes for Managing NHIs Coupang Signing Key Breach

How to make leaver controls reliable in practice

The practical test is whether offboarding can be proven, not merely requested. Teams should be able to show that the leaver event was received, the right systems were targeted, access was removed in the right order, and exceptions were resolved before closure. If a process cannot produce completion evidence for each critical system, it is still manual and still fragile.

What to verify: Confirm that leaver triggering comes from an authoritative source, that all privileged and federated access paths are included, and that the final check covers both direct accounts and any shared or delegated access. The verification step should include SaaS, VPN, email, file shares, admin consoles, and any tokens or keys the user could have used to continue operating after exit.

Decision rule: If a system cannot prove timely deprovisioning, treat it as a residual-access risk and escalate until the dependency is fixed. If the person had elevated access, ownership of secrets, or responsibility for production tooling, require explicit attestation that revocation and handback completed before closure. Ultimate Guide to NHIs, what are non-human identities Twitter source code leak 2023

Practitioner takeaway: The strongest leaver processes are evidence-driven, not policy-driven, and they assume that any account, token, or shared resource left behind is still a live security exposure until independently confirmed otherwise.

Risk and Threat Considerations

Late or incomplete offboarding creates a direct opportunity for misuse, whether accidental or malicious. The risk is not limited to the former employee, because any retained session, token, or shared credential can become an access path long after the departure event has passed.

Failure mechanism: The organisation breaks the chain between the departure event and full revocation, so access persists in one or more systems that were not updated, not synchronized, or not checked for completion.

Impact: Residual access can support data theft, unauthorized changes, lateral movement, and continued use of trusted tools or shared folders after employment or contract end.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

Framework	Control / Reference	Relevance
NIST SP 800-53 Rev 5	IA-4 — Identifier Management	Leaver offboarding depends on timely removal of identifiers and access paths.
	IA-5 — Authenticator Management	Leaver mistakes often leave tokens, keys, or sessions valid after exit.
	AC-2 — Account Management	Offboarding failures usually show up as lingering or orphaned accounts.
Recommendation — Remove and disable identifiers promptly when employment or need-to-know ends. Revoke, rotate, or invalidate authenticators tied to departing users and related access. Disable and remove accounts through a controlled lifecycle process with completion checks.
CIS Controls v8	CIS-5 — Account Management	This topic is fundamentally about account inventory, disabling, and cleanup at departure.
Recommendation — Maintain and promptly disable all departing-user accounts, including SaaS and remote access.
ISO/IEC 27001:2022	A.5.18 — Access rights	Leaver process mistakes map directly to failure to remove access rights on exit.
Recommendation — Revoke access rights promptly and verify removal across all in-scope systems.

Practitioner Guidance

What to prioritise: Prioritise the systems that can cause the most harm if left active, especially email, VPN, admin consoles, cloud apps, and anything that can mint or sign credentials. Those are the highest-value paths for both misuse and post-exit persistence.

What good looks like: A good leaver workflow has one trigger, one owner for orchestration, one completion record, and a defined sequence for revoking access before or alongside asset recovery. The process should make it easy to see what was removed, what was deferred, and why.

Common mistake: Do not treat device return as proof that access is gone, or account closure as proof that all access paths are gone. Those are separate controls, and each can fail independently.

Practitioner takeaway: Offboarding is only complete when you can demonstrate that no practical path remains for the leaver to act with the old identity, whether through direct login, delegated access, or unattended secrets.