Topic starter
25/06/2026 5:09 pm
TL;DR: Clarity Security finds that manual leaver offboarding still leaves orphaned accounts, stale SaaS access, active sessions and audit gaps because identity, data, physical and billing controls are often revoked in separate steps. The real governance problem is whether every access path is closed before accountability disappears.
Editorial analysis by NHI Mgmt Group, based on content published by Clarity Security: “The Ultimate IT Offboarding Checklist and Template”.
Key questions
Q: What breaks when manual leaver offboarding is not in place?
A: The revocation chain breaks.
Q: Why do partially offboarded users increase audit risk?
A: Because auditors need proof that access was actually removed across the full estate, not just in the primary directory.
Q: How do security teams know whether offboarding is actually working?
A: Security teams should measure completion, not process start.
Practitioner guidance
- Tighten the leaver revocation sequence Disable the identity at the source, then revoke SaaS accounts, terminate active sessions, close VPN access and remove physical badge access in one governed workflow.
- Rotate shared credentials immediately If the departing user had access to shared passwords or other reused secrets, rotate those credentials as part of the same offboarding event rather than treating them as a separate task.
- Build an offboarding evidence log Record exactly what access was removed, when it was removed and which system enforced the change so audit teams can verify closure later.
Bottom line: Manual offboarding fails when identity, SaaS, session, VPN, data and physical access are revoked as separate tasks instead of one governed closure event.
What's in the full article
Clarity Security's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step offboarding checklist items for IdP, SSO, SaaS, VPN, storage and physical access revocation
- Guidance for preserving business continuity while transferring ownership of files, inboxes and applications
- A template-driven approach to logging what was removed and when for audit readiness
- Examples of how automated workflows can trigger notifications, tickets and access review actions
👉 Read Clarity Security's IT offboarding checklist and leaver workflow guidance →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 5:41 pm
Manual leaver offboarding is a control-chain problem, not a ticketing problem. The article shows that identity, SaaS, session, VPN, data and physical controls all have to close together or the leaver remains reachable through the weakest surviving path. That is why offboarding maturity is measured by revocation completeness, not by how quickly a request was opened. Practitioners should treat offboarding as a chained control with a single closure requirement.
A few things that frame the scale:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when a terminated user still has live access?
A: Treat it as an unresolved offboarding event, not as a minor exception. Revoke the remaining access path immediately, rotate any shared credentials, verify session termination and capture the action in the evidence log so the termination is closed consistently across systems.
👉 Read our full editorial: Leaver offboarding gaps still create orphaned accounts and audit risk