There is a substantial literature on what goes wrong when someone leaves a company, and nearly all of it is about accounts.
The numbers are genuinely bad. Beyond Identity surveyed former employees and found that 83% still had access to accounts at a previous employer after leaving, and that 56% admitted using that access to harm the company. A OneLogin study of 500 IT decision-makers found that half of departing employees' accounts stay active more than a day after departure, and that 32% of organisations take over a week to fully de-provision someone. Wing Security put 63% of businesses in the position of having former staff who can still reach corporate data through SaaS applications nobody switched off.
So offboarding is a solved problem, in the sense that everybody knows it is a problem. There are checklists, there are products, there is an entire software category.
The number I keep returning to is a quieter one from the same Beyond Identity study. Only half of respondents were asked to return company devices at all. Not returned them late. Were never asked.
The list everybody has
Ask an HR or IT team for their offboarding checklist and the physical section is remarkably consistent across companies. Laptop. Dock and monitor. Phone and SIM. Building access badge. Keys and fobs. Corporate card. Parking pass. Occasionally a headset.
Every item on that list shares one of two properties. It is worth money, or it opens a door. The list is sorted by two anxieties: asset value and physical access.
Business cards fail both tests. A box of them costs almost nothing and it opens nothing at all. So it is not on the list. I have never seen a return-of-company-property clause that mentions them, and I would be glad to be shown one.
What a card actually is
Here is the uncomfortable part.
A business card is a company-issued document. It carries the registered company name and usually the logo. It states that a named individual holds a named position at that company. It is handed to third parties as evidence of precisely that, because that is its entire function.
Every other artifact with that property is controlled. The badge is collected on the last day. Letterhead lives on a server. The email signature dies with the mailbox. The card is the only one that leaves in a coat pocket and stays there.
And unlike every account in those studies, a printed card cannot be de-provisioned. There is no console. Deactivation is not on the menu, because the thing you would be deactivating is cardboard.
Three ways it surfaces
The first is simple continuation. Someone leaves in March and hands a card to a stranger at a conference in September. This is almost never malicious. There is a stack in a laptop bag, the bag goes to the next job, and cards get handed out at events because that is what one does at events.
The second is the title. A card does not just carry a stale job description, it carries a claim about seniority and, in some jurisdictions, about authority. I have written before about how a job title on a card is read as a statement the company makes about a person, and about the doctrines under which a company can be bound by someone it held out as authorised. Those doctrines do not check the payroll first.
The third is the one that lands in a security review. Ask how many cards bearing the company's name are in circulation in the hands of people who no longer work there, and there is no answer. Not a bad answer. No answer, because no system was ever asked to hold one.
Why the literature misses it
Because offboarding guidance was mostly written by security people, and security people reason in terms of access. A card grants no access to anything, so within that frame it is not a risk, and it drops out of the analysis before anyone thinks about it.
The frame is too narrow. The exposure on a card is not access. It is representation. A former employee with a live card cannot get into your building or your data. They can be you, in front of someone who has no means of checking.
Everything else on the offboarding list is collected because it opens a door or cost money. The card is neither, which is exactly why nobody built a process for it.
An offboarding checklist that covers identity, not just access
Most checklists stop at accounts and hardware. This one adds the places where the company keeps speaking on the leaver's behalf after they have gone.
Access
- Disable the account in the identity provider and end active sessions.
- Revoke tokens and app passwords, and check SaaS tools that were never connected to single sign-on.
- Transfer ownership of shared files, calendars and mailboxes.
Hardware and physical access
- Collect laptop, phone, building badge, keys and corporate card.
- Record what was not returned, rather than leaving the line blank.
Identity and representation
- Remove or replace the email signature everywhere it is deployed, including shared mailboxes.
- Deactivate the digital business card, or point its link somewhere sensible, such as the team page.
- Note how many printed cards were issued to the person, and when.
- Remove them from the directory, the org chart and any public team or contact page.
- Reassign CRM accounts and open leads to a named owner.
- Update partner portals, supplier records and press contacts that list them as the contact.
What would actually fix it
Not collecting the cards. That is unenforceable and mildly insulting, and it would fail anyway, because the ones already handed to other people are the ones that matter.
I should declare an interest, since this is the category I work in. The fix is that the object stops mattering. If the card resolves to a record the company controls, then a departure changes what the card does without anyone chasing the card. The leaver keeps the rectangle and loses the claim. The cards already sitting in strangers' drawers stop pointing anywhere the company would object to.
That is a smaller and more achievable thing than it first sounds. It does not require anyone to remember the card on the last day, which is fortunate, because the evidence says half of companies do not even remember the laptop.
The offboarding checklist does not need another line on it. It needs the card not to require one.
Want a leaver's card and signature to stop on their last day? Book a demo and see how DBC1 ties both to the HR record. More on the HR side on our page for HR teams.
