You Can’t Govern
What You Can’t See

Your Employee Left Six Months Ago. Are You Sure They Left Your Systems?

Because there’s a difference between someone leaving your organization and someone losing access to it.

And that difference could be costing your business more than you realize.

The Employee Is Gone. The Access Isn’t.

Consider this scenario.

An employee leaves your organization after three years. During that time, they’ve accumulated access to Microsoft 365, shared drives, cloud applications, customer databases, vendor portals, and perhaps a few systems that nobody remembers granting them access to in the first place.

HR closes their file. IT disables their primary login.

Problem solved?

Not necessarily.

What about the project management platform they signed into using a separate password? The vendor portal where they were listed as an administrator? The shared documents accessible through a personal account?

And what about the applications nobody in IT even knows your employees are using?

These aren’t necessarily signs of a careless organization. They’re signs of something far more common: a lack of visibility.

Why Should You Care?

An active account belonging to a former employee is more than an administrative oversight.

It can create opportunities for unauthorized access, data exposure, financial fraud, and compliance failures.

And here’s something worth considering: the former employee doesn’t have to be malicious.

Perhaps they reused a password that was later compromised. Perhaps their personal device was infected with malware. Or perhaps an old account remains active long enough for someone else to exploit it.

The account is still there. The permissions are still there.

Your organization may not even realize the door is open.

So, Where Should You Look?

Start by asking a simple question: Can we produce a complete list of every system our former employees could access?

If the answer is no, you’ve already identified a visibility gap.

Here are five places worth examining.

1. 
   Identity and email systems. Review Microsoft 365, Google Workspace, and other identity providers. Confirm former employees’ accounts are disabled and active sessions have been revoked where appropriate.
2. 
   Cloud applications. Examine CRM platforms, accounting software, project management tools, file-sharing services, and other applications that may have separate user accounts.
3. 
   Remote access. Check VPN accounts, remote desktop services, and any other tools that allow connections from outside your organization.
4. 
   Vendor and partner portals. Employees may have been granted direct access to external systems that aren’t controlled by your internal IT team.
5. 
   Shared credentials and administrator accounts. If a departing employee knew passwords used by multiple people, disabling their individual account may not be enough. Those credentials may need to be changed.

This isn’t necessarily a one-afternoon exercise. And that’s precisely the point.

The Bigger Problem Isn’t the Former Employee

It’s the process that allowed the access to remain.

Who is responsible for notifying IT when someone leaves?

Who maintains the list of systems each employee can access?

Who verifies that access was actually removed?

And perhaps most importantly, who checks afterward?

If your answers involve phrases like “I think,” “usually,” or “someone should,” you may have a process that exists more in theory than in practice.

A reliable offboarding process requires coordination between HR, IT, security, and the business owners responsible for individual applications.

It also requires verification.

Because checking a box that says access removed isn’t the same as confirming that it was.

You Can’t Fix What You Don’t Know Exists

Before you invest in another security tool, consider looking at the access you already have.

Start with a small sample of former employees. Review the systems they used, compare those records against your current user lists, and investigate anything that doesn’t match.

You may find everything is exactly as it should be.

Or you may discover that people who left your organization months ago still have access to information they no longer need.

Either way, you’ve learned something valuable.

Security doesn’t begin with assuming your controls work. It begins with knowing.

And that’s the entire premise behind Map Your Mess™.

You can’t govern what you can’t see.