Most access problems in small businesses are not sabotage. They are the login of someone who left eleven months ago, still active, still able to read email, because switching it off was nobody's specific job on their last day. The former employee has usually forgotten it exists. The trouble is that anyone who steals that password inherits a live account nobody is watching.

The checklist is short enough to do properly. Disable the account rather than delete it, so nothing breaks and you keep the audit trail. Convert their mailbox to a shared one or set an auto-forward, so the customer emailing them does not vanish into a dead inbox. Move any files they owned to a manager, because files owned by a deleted account have a way of disappearing later.

Then the physical side, which people forget because it feels old-fashioned. Collect the kit - laptop, phone, any door fob or key. Change any shared passwords the person knew, especially the ones taped to the router or living in a spreadsheet. A leaver who knew the shared Wi-Fi password and the shared inbox login still knows them the day after they leave.

Last, log the date. A one-line note that the checklist was done, and when, is what turns this from good intentions into something you can prove. It matters for insurance, it matters if there is ever a dispute, and it matters because “we think we did it” is not an answer when a regulator asks. Eleven minutes on the day beats a week of untangling in six months.