Microsoft’s documented Finance leaver Review + create screen shows selected tasks, a department scope and a checked schedule. This is configuration, not executed offboarding or coverage of every application; verify each required cutoff and preserve authorized business records separately.[4]
One former seasonal worker can leave several different problems: a disabled directory account, a still-active tax-portal login, payroll permissions and a report nobody else owns. Treat each as a separate cleanup item. The worked closure record below shows why closing the main IT ticket does not establish that the person’s access and client handoffs are complete.
Use the firm’s authorized HR and security decisions for timing. Do not delay an approved cutoff while someone finishes transferring files. IRS Publication 5708 provides a sample written security plan with employee-departure controls; adapt the sample to the firm’s actual systems, preservation requirements and responsible owners. [1]
How to choose the right CPA and financial firm employee access improvements
A successful cleanup leaves every active identity tied to a current worker, supervisor, role, client set, device, authority, end or review date, and training status. Former and stale access is closed, unfinished work has an owner, and departures can be proven complete.
- System accounts do not match the HR, contractor, and seasonal rosters.
- Workers accumulate old client groups, administrative roles, or financial authority after promotions and transfers.
- Seasonal accounts remain active year-round or are reused by a different person.
- Client work, deadlines, mailboxes, files, reports, or automation depend on one employee.
- Returned or lost devices remain active in management, security, remote access, or recovery systems.
- Training reports show completion while support tickets reveal unsafe sharing, phishing, verification, or AI behavior.
Find stale identities, roles, clients, devices, and worker dependencies
Roster and account mismatch
Diagnosis: Compare HR, payroll, contractor, seasonal, directory, email, application, and device records using a stable worker identifier. Investigate missing people, duplicate identities, accounts without supervisors, and status or date conflicts.
Correction: Choose an authoritative roster and investigate unmatched identities with the appropriate owner. Distinguish user, administrator and service identities; contain confirmed unauthorized access at the approved time, transfer legitimate dependencies through authorized administration, and keep unresolved ownership visible.
Measurement: Track active identities matched to approved workers, unexplained accounts, time to close departures, temporary accounts with end dates, and reconciliation exceptions.
Accumulated access after role changes
Diagnosis: Compare current duties and client assignments with historical groups, applications, privileges, financial authority, local administration, and temporary exceptions. Review promotions, service transfers, remote changes, and returns from leave.
CPA and Financial Firms HR improvement: Remove obsolete access, rebuild from the current role, retain only documented exceptions, separate high-impact authority, and require manager review after every material move.
Measurement: Track inherited roles removed, client mismatches corrected, financial and admin authority reduced, post-change reviews completed, and exceptions with expiration.
Seasonal accounts remain active or are reused
Diagnosis: List seasonal and temporary identities with person, supervisor, start, end, last sign-in, clients, applications, devices, tokens, licenses, extension, and prior-year history. Identify generic or recycled accounts.
Correction: Keep each identity attributable to its actual person. Review a returning worker’s role, clients, recovery and cutoff before reactivation; never transfer that identity to another worker. Implement the approved end action for each application and retain proof of denied access, rather than treating an end-date field as enforcement.
Measurement: Track named-account coverage, access past end date, reused identities eliminated, approved extensions, devices returned, and seasonal closure time.
Correct authority, seasonal access, training, and support workflows
Broad client and document access
Diagnosis: Sample portal, workpaper, tax, accounting, payroll, collaboration, email, and archive access across active, inactive, unrelated, and restricted clients. Include public links and inherited groups.
CPA and Financial Firms HR improvement: Assign clients from current engagement rosters, separate sensitive service groups, close stale links, remove inactive access, expire temporary exceptions, and test search and export paths.
Measurement: Track client-access mismatches, public links closed, inactive access removed, restricted-client tests, exception age, and manager review completion.
Financial and administrative authority is too broad
Diagnosis: Review e-file, payroll, bank, payment, refund, write-off, report, vendor-change, local administrator, cloud administrator, recovery, and application-administrator roles by person and last use.
CPA and Financial Firms HR improvement: Separate preparation, review, release, reconciliation, and administration, reduce standing authority, add independent verification, expire emergency access, and monitor high-impact changes.
Measurement: Track high-impact roles by business need, standing authority removed, independent approvals, emergency-role duration, high-risk changes reviewed, and test transaction results.
Device and remote-access ownership is unclear
Diagnosis: Reconcile procurement, inventory, device management, endpoint security, encryption, VPN, remote support, return, disposal, and worker records. Find devices without people and people with unknown devices.
CPA and Financial Firms HR improvement: Assign, recover, enroll, patch, encrypt, quarantine, retire, or securely dispose of each device. Remove former-user sessions, unknown remote tools, unnecessary local privilege, and stale recovery records.
Measurement: Track device-to-worker match, returns, last-seen exceptions, encryption and protection, unsupported equipment, unknown remote tools, and disposal evidence.
Training does not change risky behavior
Diagnosis: Compare course completion with phishing reports, payment verification, portal use, support tickets, unsafe attachments, password sharing, lost devices, remote work, and unapproved AI or file tools by role.
CPA and Financial Firms HR improvement: Use short role-specific scenarios, fix workflows that push users toward bypass, coach repeat issues, restrict sensitive access until readiness is shown, and test behavior after training.
Measurement: Track reporting rate, independent verification, unsafe sharing, repeated incidents, coaching completion, role-readiness tests, and support requests after improvement.
Transfer work and close every departure and recovery path
Leave and departure work is not transferred
Diagnosis: List active clients, deadlines, approvals, mailboxes, calendars, workpapers, reports, automations, secure messages, devices, and service identities owned by unavailable or departing workers.
Correction: Assign new owners and preserve required records using supported delegation or administrative transfer. Prepare ahead of a planned cutoff where possible, but do not retain the former worker’s interactive access while transfer continues. Microsoft separates preventing sign-in, preserving data, transferring work, license removal and account deletion in its offboarding guidance. [2]
Measurement: Track orphaned work found, transfers completed before access closure, missed deadlines, shared-password use, backup owner coverage, and continuity test results.
Offboarding closes only the main account
Diagnosis: Review recent departures across identity, sessions, devices, portals, tax and accounting applications, payroll, bank and payment roles, tokens, recovery, forwarding, remote access, vendors, physical access, and shared secrets.
Correction: Execute the approved sign-in and session actions, then close the application-specific and remote paths in the inventory. Microsoft Entra cannot directly revoke a session cookie issued by another application; the application owner must verify its own deprovisioning and session behavior. [3] Record device custody and preservation separately, and let an independent authorized reviewer verify the closure evidence.
Measurement: Track complete departure verification, systems missed, time to revoke, active sessions closed, devices returned, shared secrets rotated, and post-departure access alerts.
Support and access requests repeat the same errors
Diagnosis: Group tickets for missing access, excessive access, portal failures, password resets, device setup, role changes, seasonal starts, leave, and departures. Identify flawed templates, unclear approvals, late notices, and workarounds.
CPA and Financial Firms HR improvement: Correct role catalogs and checklists, clarify approval and lead times, automate reliable tasks, create safe user guidance, train managers, and review exception patterns each month.
Measurement: Track first-day readiness, repeat tickets, approval delays, emergency access, seasonal setup time, departure misses, self-service success, and root causes closed.
Measure access accuracy and employee readiness
Review employee-access cleanup with HR, managers, service leaders, security, and support. Each action should name the worker, role, client or service impact, deadline, record or work transfer, access change, communication, verification, owner, and follow-up date.
- Roster alignment: Active identities and devices matched to approved permanent, seasonal, temporary, contractor, leave, transfer, and departed worker records.
- Role and client accuracy: Sampled service, client, application, group, privileged, and financial permissions matching current duties and manager approval.
- Seasonal access control: Named temporary accounts with approved start, end, supervisor, client assignments, extension, device return, and closure evidence.
- Readiness: Workers who pass representative identity, client, portal, device, fraud, support, and secure-work tests before handling production information.
- Continuity: Active clients, deadlines, approvals, mailboxes, reports, and automations with a responsible owner and tested backup coverage.
- Departure completeness: Departures with work and record transfer, timely revocation, closed sessions and recovery, returned devices, rotated secrets, and independent verification.
Close the worker record only after the separate paths are verified
These are proposed checks for fictional worker S-07, not a reported incident or a promise of instant revocation. Apply the firm's authorized cutoff and preservation decisions; an open row remains open even if the main help-desk ticket is marked complete.
| Path or dependency | Action owner | Evidence that changes the row to closed |
|---|---|---|
| Directory sign-in and refresh sessions | Identity administrator | The approved actions and verification time are recorded; remaining application sessions are assessed separately. |
| Tax portal with its own login or session | Tax application owner | The local account/role and existing session are handled by the supported process and an authorized test confirms the intended denial. |
| Payroll release authority | Payroll owner | The release role is removed or reassigned under approval, with an independent check of the resulting role. |
| Client work and scheduled report | Service manager and report owner | A named replacement can continue the fictional work through approved access; no shared former-user credentials are needed. |
| Laptop still offline | Device custodian and security owner | Custody and required controls are verified. An undelivered remote command is recorded as unresolved, not completed. |
Use the seasonal onboarding setup guide to prevent the same gaps in the next seasonal intake. The employee-access evidence review helps a manager distinguish a documented decision from a completed and retested correction. ALLMSP’s software support services can help investigate the approved application handoffs and recurring support failures.
Frequently Asked Questions
How can CPA firms keep employee accounts aligned with the worker roster?
Reconcile named user identities against a dated HR, contractor and seasonal roster using a stable worker identifier. Allow for legitimate separate administrator or service identities, but require an owner and purpose for each. Investigate duplicates, missing supervisors and conflicting dates. Contain confirmed unauthorized access under the approved process; do not bulk-delete unknown accounts before understanding their ownership and client-work dependencies.
How should a firm clean up access after employee promotions and transfers?
Ask the current manager to approve the new role and the specific old duties that must end. Remove obsolete client groups, application roles, delegated authority and temporary exceptions, then test the new allowed and denied paths. Keep a reason and review date for any retained exception. A promotion should not silently preserve every permission held in the person’s earlier job.
What is the right way to clean up seasonal tax worker accounts?
Separate returning workers from accounts that changed hands. Keep the identity attributable to the same person, review its recovery and prior permissions, and remove last season’s client access before reactivation. For workers who have finished, enforce the approved cutoff across the directory and individual applications, reconcile devices and record any unresolved path. Do not count a populated end date as a completed revocation.
How can managers reduce excessive employee access to client records?
Choose an actual role and test its approved and unrelated client boundaries using authorized fictional records. Trace direct permissions, inherited groups and sharing links to their granting source. Correct that source, then retest search, downloads and exports where relevant. A manager’s denial recorded in a spreadsheet has not removed access until the controlling system is changed and the result is checked.
How can financial firms reduce excessive employee authority?
Start with high-impact actions: transmitting returns, releasing payroll or payments, changing bank details, administering systems and approving one’s own work. Ask the service owner to justify each assignment and separate duties where the approved process requires it. Remove obsolete authority and expire emergency exceptions. Verify the restriction with a safe test; a low-privilege directory role does not establish low financial authority inside a separate application.
How should a CPA firm clean up employee devices after staffing changes?
Match each device to its worker, custody, management status and last successful check-in. Follow the approved return, containment and preservation decision before retiring or wiping it. Closing a cloud account does not erase files already available offline. Record an offline or missing device as unresolved, with an owner and follow-up, rather than assuming a remote command has completed.
How can accounting firms make security training more practical?
Select a repeated real problem, then practice the correct action with fictional data. For a changed bank instruction, the worker should use the established verification route and escalate the mismatch; a course completion date alone is insufficient. Fix the workflow if it forces people into personal email or unsafe sharing. Retest the failed behavior and record the supported outcome instead of using training attendance as the sole success measure.
What should managers transfer before employee leave or departure?
Identify active client work, deadlines, approvals, mailboxes, files, reports and automations with their new owner and backup. Prepare supported delegation and preservation before a planned departure when possible, but enforce the approved access cutoff on time. Authorized administrators can complete the handoff afterward. Do not solve continuity by sharing the departing person’s password or retaining their interactive login.
How can CPA firms verify every employee offboarding path?
Keep a per-system closure record with the approved cutoff, administrator action, time and verification result. Check sign-in, sessions, direct application logins, financial roles, remote tools, recovery and device custody separately. Use authorized tests and logs to verify the result. A reset password, removed license or closed ticket is not enough evidence that every independent application session has ended.
How can help desk data improve employee onboarding and offboarding?
Group failures by role, application and root cause, such as a missing client-group approval or a late seasonal end notice. Change the responsible template or handoff, assign an owner and test the next comparable onboarding or departure. Measure a useful outcome such as first-day tasks completed or missed access paths closed. Keep the denominator and unresolved cases visible so fewer tickets does not merely mean fewer reports.
Sources
- IRS Publication 5708, Creating a Written Information Security Plan (August 2024): adaptable sample plan ↩
- Microsoft Learn: remove a former employee, with separate access and data-preservation steps ↩
- Microsoft Learn: revoke user access, including token and application-session limitations ↩
- Microsoft Learn: Microsoft Entra Suite deployment scenario, modernize remote access ↩
