Short answer: when a member of staff or a contractor leaves, the organisation should have one authorised process that removes their physical access at the agreed time, recovers or cancels every credential, reviews shared access arrangements and records what was completed. A returned pass is not proof that all access has ended, and a disabled account does not recover a key, fob or parking permit.
The process should cover planned departures, expired contractor access, role changes and urgent removals. Human resources, the contract owner, facilities, security and the access-control administrator may each hold part of the information, so one named owner should coordinate the handover.
This is general planning guidance for commercial premises. The exact process should follow the organisation’s policies, contracts, risk assessment and legal advice. It does not provide door locations, system settings or instructions for bypassing an access-control system.
Set one trigger and one process owner
Start with a reliable notification from the person authorised to confirm the change. For an employee, that may be an approved HR or management instruction. For a contractor, it may come from the sponsor or contract manager who controls the engagement.
The notification should state the person’s identity, the effective date and time, whether the change is a departure or a move to another role, and who can resolve questions. Avoid informal messages such as “they finish this week” or “remove them when convenient”. Ambiguous timing can leave access active after it is needed or remove it while the person is still authorised to work.
The National Cyber Security Centre’s identity and access-management guidance recommends a joiners, movers and leavers process so access can be revoked when it is no longer needed or changed when someone moves role. That guidance addresses digital identity, but the same coordination question is useful for physical credentials: who owns the decision, what access changes and when?
Make an inventory of physical credentials
Do not limit the checklist to the main door card. Depending on the site and role, the person may hold or use:
- an employee or contractor pass, fob or mobile credential;
- a physical key, locker key or authorised key-cabinet access;
- a parking permit, vehicle tag or barrier credential;
- access to another tenant’s area, loading zone or out-of-hours entrance;
- a temporary pass issued for a project or maintenance visit;
- authority to approve visitors, deliveries or replacement credentials;
- a shared code or shared key arrangement that needs separate review.
The inventory should come from the relevant systems and accountable teams, not only from the leaver’s memory. A person may not know that an old credential remains active, and the person collecting property may not administer the access-control platform.
Match the timing to the authorised decision
For a routine departure, agree when access is no longer required and schedule the change accordingly. If employment or contractor access ends unexpectedly, follow the authorised management, HR and legal process; do not ask a reception officer or guard to decide the timing from rumours or workplace discussion.
Where a role changes rather than ends, review the access needed for the new duties instead of copying every existing permission. The NCSC’s access-control principle says rights should be reviewed and removed when no longer required, including when someone changes role or leaves. Physical systems should likewise avoid accumulating permissions simply because nobody requested a review.
Consider time zones, night shifts, weekend work and access shared across more than one building. The effective point may not be the end of an office day. Record the agreed time and the person who authorised it.
Revoke access and recover property as separate tasks
Disabling a card, fob or mobile credential prevents further use of that credential if the system and relevant doors are operating as intended. Recovering the item supports stock control and prevents confusion. Complete both where applicable, but do not postpone revocation merely because an item has not yet been returned.
Physical keys need their own decision. If a key is not returned, the responsible facilities or security manager should assess the affected lock and authorised response. Do not publish which doors it opens or treat a general blog checklist as a lock-change instruction.
If a person reports that a credential was already lost, use the approved lost-card process rather than marking it as returned. The guide to responding to a lost commercial access card explains why reporting, disabling, identity checks and replacement records should be controlled separately.
Review shared codes and delegated authority
A shared code cannot usually be removed from one individual’s possession. If the person knew a code that remains in use, the authorised system owner should decide whether and how it is changed, how the new information is distributed and how older copies are withdrawn. Do not send new codes through an uncontrolled group message or store them in an ordinary shift log.
Also remove delegated authority that can outlive the credential itself. Examples include the ability to sponsor visitors, approve contractor arrivals, request spare passes, collect keys or ask a guarding team to admit someone. Reception and security instructions should identify the current authorised roles or contacts rather than relying indefinitely on familiar names.
Coordinate multi-tenant and contractor access
Shared premises often have several access owners. The building manager may control the entrance, while an occupier controls an internal floor and a service contractor controls a plant area. The leaver process should identify who must notify each system owner and how completion is confirmed.
For contractors, use an expiry date wherever the system and working arrangement support it. Expiry is a useful control, but it does not replace close-out: recover passes and keys, confirm whether work has genuinely finished, and remove any approval or visitor-sponsorship authority linked to the engagement.
Where guarding staff support a gatehouse or reception, give them the minimum current instruction needed to apply the decision. Do not expect an officer to infer employment status, adjudicate a dispute or disclose why access has changed. Escalation should go to a named authorised contact.
Keep access records proportionate
Access-control logs can contain personal information. The Information Commissioner’s Office gives an example of a swipe-card system that records entry and exit for workers with permission to enter a restricted area. It explains that such monitoring must be necessary and proportionate for the stated purpose. See the ICO’s guidance on monitoring workers.
Keep a factual record of the instruction, credentials covered, actions completed, unresolved items and the person responsible for follow-up. Avoid copying unnecessary employment details into a security log. The ICO’s storage-limitation guidance says organisations should justify retention periods, document them where possible and review information that is no longer needed.
Verify closure without exposing the site
Completion should be checked by an authorised administrator or manager. Verify that the correct identity and credentials were changed, that linked permissions were considered and that any exception has an owner and deadline. Do not publish door lists, card numbers, codes or a map of the former access.
If a test is required, use the system owner’s approved method. Security staff may report an observed result or check a current authorised list, but they should not experiment with doors, reactivate credentials or change system settings outside their assignment and authority.
Questions for the offboarding checklist
- Who is authorised to trigger the access change?
- What is the precise effective date and time?
- Is this a departure, a role change or the end of a contractor visit?
- Which cards, fobs, keys, permits and mobile credentials are involved?
- Does the person hold authority to sponsor visitors or request access?
- Are any shared codes, shared keys or multi-tenant systems affected?
- Who confirms each action and follows up missing property?
- What record is needed, who can see it and how long is it retained?
- How will guarding or reception instructions be updated without disclosing unnecessary personal information?
For a commercial site where static guarding may support agreed gatehouse or access-control duties, provide the site postcode, proposed hours, intended duties and the current authorisation process. Send an enquiry so the scope and feasibility can be considered for the individual premises. Do not include access codes, credential numbers or detailed vulnerabilities in an initial enquiry.
Featured image: an illustrative stock-style image from the existing site media library showing an electronic door-entry panel beside a glass door. It does not depict a K9 Security Services employee, a client site or a specific access-control installation.