Staff Offboarding in Singapore SMEs: The Access Removal Checklist to Finish Before the January Intake

Offboarding a staff member in a Singapore SME means closing every door that person can still walk through, settling what you legally owe them on time, and writing down that both were done. For a company of 10 to 30 people with no IT department, that is typically eighteen to twenty five software accounts, two or three shared logins nobody has changed in years, a company phone number, possibly a bank token, a door card, and work files sitting on a personal laptop. The workable answer is one named checklist, owned by one person, finished within 24 hours of the last working day, and signed off in writing. Below is that checklist, and the reason December is the month it goes wrong.

What does offboarding actually mean when there is no IT department?

In a large company, offboarding is a ticket that fires automatically when HR changes a status field. In a small company it is a person remembering. That is the whole problem. Nobody forgets the obvious items. What survives is the quiet tail: the Canva seat, the Meta Business Manager admin role, the shared Dropbox link sent to a client two years ago, the courier portal login that was created in the leaver's personal email, and the subscription billed to their expired company card.

Each forgotten seat costs real money. A single unused productivity or design seat runs roughly S$120 to S$250 a year, and most SMEs we review are paying for three to six of them. The bigger exposure is not cost. An ex-staff member who still holds an admin role in your advertising account, your accounting software or your customer database is a live risk for as long as nobody notices, and under the PDPA that access is still your responsibility, not theirs.

Which accounts matter most when someone leaves?

Work through these in order of damage, not in order of convenience:

1. Money. Bank access, bank tokens, authorised signatory status, PayNow and corporate card. Removing a signatory usually requires a form at the bank, not a click, so start this first because it is the only item with an external waiting time.
2. Identity. Corppass roles, Singpass-linked business access, your accounting software (Xero, QuickBooks), payroll and HR system.
3. Email and files. Suspend the mailbox, do not delete it. Transfer ownership of their documents first, then set forwarding to a manager for 60 to 90 days so client replies are not lost.
4. Customer reach. WhatsApp Business access, the shared sales number, your CRM, your e-commerce admin, Meta and Google Ads roles.
5. Infrastructure. Domain registrar, hosting, VPN, server keys, CCTV app, password manager, and any two-factor codes sitting only on their phone.
6. Physical. Door card, keys, laptop, phone, SIM, and the uncollected items in their drawer.

Two items catch almost everyone. First, shared logins: if the password was shared, removing the person changes nothing until you change the password. Second, two-factor authentication seeded on a departing person's phone, which can lock you out of your own account weeks after they have gone.

Why is December the worst month to get this wrong?

December stacks three things on top of each other. Resignations cluster before bonus and new-year moves. The people who would normally notice something odd are on leave. And the finance team is pushing the year-end payment run, which is exactly when an email from a familiar name asking to update bank details is least likely to be questioned.

A mailbox that is still active but unwatched is the ideal tool for that. So is a departing employee's forwarding rule, set up quietly before the last day, copying every quotation to a personal address. Neither is common, but both are cheap to prevent and expensive to discover in February.

What does Singapore law require you to settle?

Four items have deadlines, and they do not move for the holidays.

Final salary. If the employee serves their full notice, the final payment is due on the last day of employment. If they leave without serving notice, you have seven days. Include unused annual leave encashment, any outstanding claims, and deductions in a written itemised payslip.

Tax clearance for foreign employees. Form IR21 should be filed at least one month before the employee ceases employment, and you are expected to withhold monies pending clearance. This is the item that most often gets discovered late, because it has to be done before the person leaves, not after.

Employment records. Records for current employees must be kept for two years, and for an ex-employee, one year after they leave. Do not delete a leaver's file in a tidy-up.

Retention of everything else. The PDPA expects you to stop keeping personal data once there is no longer a business or legal reason for it. In practice that means writing down a retention period, commonly 6 to 12 months for unsuccessful job applicants, and actually deleting on schedule. An untouched folder of CVs from 2023 is the single most common finding in an SME data review.

How do you run the whole thing in one afternoon?

Build the list once, then reuse it. Open a spreadsheet with one row per system and four columns: system name, who can remove access, done date, done by. Fill it by reading your last three months of software invoices and your password manager, not by memory. That exercise alone usually surfaces two or three subscriptions nobody can account for.

Then split the work across three moments. A week before the last day: file IR21 if applicable, start the bank signatory change, and ask for a handover note naming every recurring task, client and login the person holds. On the last day: collect equipment, suspend the mailbox, revoke the top six accounts, and change every shared password. Within 24 hours after: work the rest of the spreadsheet, confirm the final payslip, and have the manager sign the sheet.

What must be ready before the January intake walks in?

A new joiner inherits whatever mess the leaver left. Before the first January start date, confirm three things: no ex-staff member appears in any admin list across your top ten systems, every shared login has a current password held in one place, and each system has a named owner who can grant and remove access without hunting for a password.

Do that once and onboarding becomes the same spreadsheet read in reverse. That is the real return here. The checklist is not only about shutting doors behind people. It is the first accurate map most SMEs have ever had of what they are paying for and who can reach their money.

Frequently asked questions

Should we delete a departing employee's email account?
No. Suspend it instead, transfer document ownership to a manager, and forward incoming mail for 60 to 90 days so client enquiries and supplier replies are not lost. Delete only after the forwarding period ends and you have confirmed the mailbox contains nothing you still need.

How long should we keep records after someone leaves?
Employment records must be kept for one year after an employee leaves, and for two years while they are still employed. Tax and CPF related documents follow their own longer periods. Everything else, including CVs from candidates you did not hire, should have a written retention period and be deleted when it expires.

What if the person left months ago and we never did any of this?
Run the same checklist now, starting with bank access, accounting software and advertising accounts. Then change every shared password regardless of who is still listed. Backdating the record is not possible, so note the actual date you completed each item. An honest late record is defensible. A missing one is not.