Late August: clean up old accounts before autumn kicks off

Before the autumn rush hits, now is the perfect time to check which accounts are still open for people who no longer work at your company. Four quick lists and you're done.

The summer holidays are drawing to a close. In a few weeks, colleagues will be back from their holidays, interns will be starting, and you may well be welcoming a new employee. It's a handy moment to pause and think about something that often gets overlooked: which accounts and access rights are sitting there — still open — for people who are no longer with you?

At many SMBs without a dedicated IT department, the list of accounts quietly grows over time. Someone leaves, and their mailbox stays open "just in case." A former colleague still has access to the shared Dropbox. Last year's accountant is still in the client portal. No malice intended — but it is a risk.

Why late August is a great time to do this

The relative calm of summer is exactly the right moment to get things in order before the autumn rush begins. Two reasons:

• You still have a moment to spare. By mid-September, quotes, tenders, and annual plans start flying. By then, "going through all the accounts" is the last thing on your mind.
• New people are joining. If you tidy up now, you can add them cleanly — without last year's loose ends tagging along.

The four lists you make now

You don't need to be an IT person to do this. Grab a blank sheet of paper or a spreadsheet and create four columns.

1. People who have left this year

Think beyond permanent staff — include interns, freelancers who worked on a project, a temporary bookkeeper, or the web developer who built your new site last year. Put them all on the list, even if they left on good terms. This isn't about trust; it's about hygiene.

2. Systems and services where someone can log in

This list is usually longer than people expect. A sample:

• Email and calendar (Microsoft 365, Google Workspace)
• Files (SharePoint, OneDrive, Dropbox, Google Drive, NAS)
• Accounting software (Exact, Moneybird, e-Boekhouden)
• Webshop or website management (WordPress, Shopify, Lightspeed)
• Customer or project systems (CRM, planning tool, ticketing system)
• Social media (Facebook page, LinkedIn company page, Instagram)
• Online banking and payment apps
• Domain registrar and hosting provider
• Password manager (if you use one)

3. Physical items

Not everything lives online. Also check: office keys, alarm code, access pass, laptop, phone with a company SIM, hardware key (YubiKey), company debit card.

4. Shared accounts

This is the trickiest category. Think of the "info@" mailbox that multiple people can access, the shared login for the parcel carrier portal, or the one Facebook password that "everyone knows." When someone leaves, nothing usually changes here — but it should.

From list to action

Now that you have an overview, do three things for each person who has left:

1. Deactivate, don't delete straight away. Set accounts to inactive so that emails still come in and files are preserved, but the person can no longer log in. You can delete them later.
2. Change the passwords on shared accounts. Everything the departing person had access to: new password. Yes, it's a bit of a hassle, but it's the only way.
3. Set up a forwarding rule. Let mail sent to the old address forward to a colleague or general inbox for a few months, so nothing slips through the cracks.

What you'll discover the first time you do this

Almost every time, things surface that you'd forgotten. A former intern who can still access the client folder. An external contact who ran a training course three years ago and is still in the Teams environment. An old subscription in the name of someone who no longer works there. That's not a problem — it's exactly why you do this.

And if you do this twice a year (say, late August and late February), it gets faster every time. The first time might take half a day. Next time, an hour.

Small but important: check 2FA while you're at it

While tidying up, you'll likely come across accounts where two-factor authentication (2FA) is linked to a former colleague's phone number. Those codes will then land with the wrong person — or nowhere at all. Go through them and update them to a current phone number or an authenticator app that stays with the business.

Need a hand?

Not sure where to start, or feel like you've lost track of who has access to what? Our access check is designed exactly for this: together we map out who can get in where, and we clean up what no longer belongs. Want to tackle it yourself but need support setting up 2FA for the remaining accounts? Take a look at implementing 2FA.

Half an hour now will save you a lot of headaches come autumn.