Is offboarding an HR or IT responsibility?

HR may be missing a critical step when it comes to offboarding employees — and the gap is creating a real security risk, a new study finds. 

More than half of former employees — 79 per cent — say they were able to keep working and retain access to work accounts after their last day. Sixty-four  per cent admit they could still access company information — including customer records, client data, and financial systems — and 30 per cent say their access lasted more than a month, according to the Saggis 2026 Employee Offboarding Survey. 

The company surveyed more than 1,000 U.S. adults in September 2026 who had left jobs in the past five years, on whether they had access to company systems after being laid off or separated. Twelve per cent  per cent report that, as far as they know, they still have access to work accounts today. 

For a third of those employees, it is unclear who was responsible for handling their offboarding. Among them, 17 per cent say it may have been their company’s IT team, 18 per cent say HR, and 17 per cent point to their manager or another team member. 

While the technical side of offboarding has typically been treated as an IT responsibility, the report highlights the issue of  of whether it should be reconsidered as a shared IT and HR function. 

Alina Maria Dulipovici, a professor at the University of Montreal and cybersecurity expert, says the issue points to a broader failure of governance rather than a simple breakdown between departments. 

“It’s not because HR and IT do not currently talk to each other,” she says. “The situation is more profound than that. The devil’s in the details. Clearly, there’s an offboarding process. Clearly, there are some accesses that are cut off — but not entirely. And I think it goes to a governance issue or perspective, rather than an HR or IT issue.” 

Company size and access gap 

The lack of a formal process plays a key role in explaining why these gaps exist — and company size appears to make a difference, the report finds. Among employees who left companies with fewer than 250 employees, 82 per cent report lingering access, compared to 70 per cent of those who left organizations with more than 1,000 employees. 

Dulipovici notes that while bigger companies are more likely to have formal processes in place, the number of apps, platforms, and systems they rely on also raises the risk of errors slipping through. 

Organizations need to move away from managing access from employee by employee and instead build the system around the role. 

“ You connect people to a role, and you disconnect people from that role. One side is identity and access management; the other is really looking at the infrastructure — the interdependencies and connections — and how all of it works together,” she says.. 

In smaller organizations, formal offboarding processes can be overlooked entirely, she adds. 

“The approach tends to be we’ll say, ‘Goodbye, bring back the laptop’, and that’s it,” Dulipovici says. “And I think the real question becomes whether resources exist to formalize processes.” 

A governance problem, not just IT 

Treating technical offboarding as an IT-only problem is part of what allows these gaps to persist, Dulipovici says. 

“There is a part — assigning accesses, revoking them — where it is completely IT,” she says. “But what those IT people do should be based on a policy, and the policy should be developed by managers, not IT people alone.” 

The reason both functions need to be at the table, she says, is that neither has the full picture on its own. HR understands the responsibilities tied to each role — but not the systems underneath. IT knows the systems — but not the full scope of what each role involves. 

“HR doesn’t have a complete understanding of the systems and platforms underneath that need to be used to make that work efficient,” she says. 

This interconnectedness also matters across different parts of an organization, Dulipovici says, pointing to a parallel problem her research has identified with shadow artificial intelligence (AI) — where employees use AI tools that organizations have not fully secured or accounted for. 

“When organizations tell employees, ‘You can use our Copilot — we configured it, it’s safe, it’s not going to go on the internet, it’s just for our company’ — and then we discover that internal confidential data is available on the internet,” she says. “IT looked more deeply and realized, ‘We secured one door, but that door had a corridor, and then another door — and that final door was not secured, and we had no idea that access there was even possible.’” 

What a proper offboarding policy should look like 

Dulipovici says effective offboarding requires a formal process where IT, HR, and sometimes a department head all have a seat at the table. 

If an organization is offboarding an employee from the marketing department, for example, HR brings knowledge of the responsibilities formally assigned to that role. The functional manager contributes insight into how that role evolved in practice and what access it required over time. IT then brings its knowledge of the underlying systems. 

 “Together, they can build an accurate, complete picture of what access needs to be provisioned — and what needs to be revoked at offboarding, “she says 

This kind of structured process, she adds, should also account for remote employees and situations where a company laptop is lost or unreturned. The report highlights that collecting equipment did not always close off access — 82 per cent of former employees whose equipment was collected by their employer still reported having at least one active access point. 

“Everything should be configured so that, at any point — not just during offboarding, but in a situation like a lost laptop — you can cut access remotely,” Dulipovici says. “The general issue is the same: you don’t want equipment or data on a device to get into the wrong hands and be used in a harmful way.” 

Perhaps most importantly, organizations need to design their offboarding policies with unintentional errors in mind — not just the worst-case scenario of a disgruntled former employee, she says. 

“You cannot design your processes only with the intentional cases in mind — people who want to harm the organization now that they no longer have a job,” she says. “Those cases always exist; you can never fully eliminate them, and you often don’t know in advance that someone intends harm. So, you have to put measures in place and keep that in mind when defining your offboarding processes.”