What happens when offboarding is not coordinated between HR and IT?

How misaligned offboarding turns termination into a gap

offboarding is not just an HR event or an IT task, it is a controlled handoff. When HR and IT work from different timestamps, different records, or different approval paths, the person may be terminated in one system but still active in another. That split creates a window where access, devices, licenses, and delegated authority are no longer aligned with employment status.

The practical effect is usually uneven deprovisioning. Some accounts are closed quickly, others linger, and some are forgotten entirely because they live outside the main joiner-mover-leaver flow. That inconsistency matters because the most dangerous exposure is often not a single missed account, but the accumulation of small misses across email, SaaS, VPN, cloud consoles, and shared operational tools.

A coordinated process also has to cover the assets that support access, not only the login itself. Device return, certificate revocation, session termination, license recovery, and ownership transfer all belong in the same closure sequence. If those steps happen late, IT ends up reacting after the employee has already left, which increases both security exposure and administrative drag.

What gets left behind when HR and IT do not share a closure process

The most immediate leftover is active access. Terminated staff may retain accounts long enough to read mail, access files, or use systems that were assumed to be closed. Even when the person is trusted, stale access creates an avoidable trust gap because the environment is still relying on an employment relationship that no longer exists.

Device recovery is the second common miss. If laptops, badges, mobile devices, or tokens are not collected and accounted for promptly, organizations lose control over hardware that may still contain cached sessions, local data, or reusable credentials. License reassignment is a quieter failure, but it still has cost and governance impact because unused entitlements remain consumed instead of being returned to the pool.

Teams that do this well treat offboarding as a checklist with ownership, not as a courtesy notification. HR confirms the termination event and timing, IT executes closure tasks, and the business owner confirms what must be preserved, transferred, or revoked. That shared sequence matters most where the departed employee had elevated access, access to production systems, or access to sensitive data.

Why the failure persists, and why it scales badly

Coordinated offboarding often fails because the process depends on manual communication rather than a single authoritative trigger. If HR and IT maintain separate systems of record, the closure can be delayed by missing notifications, unclear effective dates, or ambiguity about who owns the final step. In practice, that means deprovisioning may be late even when everyone believes it has happened.

The risk increases with scale. A small miss in a single case is an incident waiting to happen; repeated misses across many exits become a structural weakness in access governance. The same weakness also slows audits and incident response, because it becomes harder to prove when access ended, who approved revocation, and whether every dependent system was reached in time. For background on lifecycle governance, NHI Lifecycle Management Guide is a useful reference.

Offboarding problems also tend to be correlated with privilege. The more systems a person can access, the more places there are to forget a revocation. That is why the risk is not just loss of efficiency. It is also residual access after separation, which can enable unauthorized use, accidental misuse, or, in a worse case, deliberate abuse of still-valid accounts and credentials.

Risk and Threat Considerations

When offboarding is not coordinated, the core risk is residual trust. A departed employee can retain access longer than intended, and any surviving credential, session, device, or delegated permission extends the period in which the organization is exposed to unauthorized access or misuse.

Failure mechanism: HR records the termination event, but IT closure does not happen on the same timeline, so accounts, devices, and entitlements remain active or partially active after employment ends.

Impact: The organization may face unauthorized access, delayed containment if the departure is adversarial, recoverable hardware and license waste, and weak audit evidence for when access actually ended.

Practitioner Guidance

What to verify: The termination workflow should have one authoritative trigger, a defined closure SLA, and a reconciliation step that proves all accounts, devices, and licenses tied to the person were handled. If any system depends on a separate notification path, treat that dependency as a gap until it is reconciled.

What to prioritise: Focus first on identities with privileged access, shared credentials, mailbox or file access, and any account that can reach production or sensitive data. Those are the exits where a short delay creates the largest blast radius, and where manual cleanup is least reliable.

Practitioner takeaway: The key control is not faster email between teams, it is a single, auditable offboarding chain that closes access before departure becomes a security problem.

Related resources from NHI Mgmt Group

• What is the difference between runtime protection and NHI lifecycle management?
• What is the difference between rotating a secret and revoking access?
• What is the difference between rotation and deprovisioning for NHIs?
• What happens when offboarding is not tied to HR events or ticketing system triggers?