In short
- Week one is about access. Get every account back under a name you control before you think about anything else.
- Write down what you own and who to call for each piece of it while people still remember. That list is worth more than any new software you could buy this month.
- Replace nobody and buy nothing this week. The order is access, then email and the domain, then backups, then a plan.
The person who knew where everything was has handed in their notice, or has already gone. The computers still work this morning, which is the trap: the damage from this arrives weeks later, on the day a password is needed and nobody has it.
The short version of this page is at our IT person quit. What follows is the long version, in the order the days actually come.
You can do the whole of this first week yourself. None of it requires technical skill. It requires a notebook, an afternoon, and a willingness to ask blunt questions.
Work through it in order. The order matters, because each step protects the one after it.
Before you start: one page, one list
Take a sheet of paper and write down the things you would notice if they stopped this morning:
- Your website and your domain name
- Where the files live
- The accounting system
- Payroll
- The phone system
- Your customer list or practice management software
- The internet connection and whatever box it plugs into
- Anything with a licence you pay for monthly
Beside each one, write the name of the account it lives under and who can sign into it. Most owners discover in the first ten minutes that the answer to several lines is the name of the person who is leaving. That is the whole problem in one page.
Day one, the first two hours
Ask for the handover in writing, today. If they are still with you, ask for a written list of every account, every password, every supplier and every renewal date. Ask for it as a document, sent to your email. A person on their way out is at their most helpful in the first two days and least helpful in the last two.
Find out whose name the accounts are in. Sign into your email service, your domain registrar and your file storage, and look at the account owner and the recovery email address. When the recovery address is a personal Gmail belonging to the person leaving, every one of those accounts is reachable by them and unreachable by you the day they change their mind.
Change what you can reach right now. The administrator password on email, the file storage, the accounting system, the router or firewall if you have the login. Write each new one into a single business password manager, and give a second person in the business access to it. A password only you know is the same problem you are currently solving, with a different name on it.
Day one, the afternoon
Turn off their staff account, and keep their mailbox. Their sign-in should stop working the day they leave. Their mailbox should stay, converted to a shared mailbox, for at least 90 days. Suppliers, banks and clients will keep writing to that address for months, and deleting it deletes correspondence you may need.
Take administrator rights off their account before you disable it, so nothing scheduled continues to run under their name. The same steps apply to anybody leaving, which is covered in an employee is leaving.
Check which sign-ins they still hold outside the office. Remote access, the VPN, the website hosting control panel, the domain registrar, the phone system portal, and the bank. Each one is a separate account with its own list of users, and turning off the office email does not touch any of them.
Day two: email and the domain name
This pair is where a quiet departure becomes an emergency, so it gets a day of its own.
Your domain name. Find out which company it is registered with, what date it expires, whether automatic renewal is on, and which email address the renewal notice goes to. A domain that lapses takes your email and your website down with it, and getting it back after somebody else registers it is expensive and sometimes impossible.
The registrant contact. The name on the registration should be your business, at an address you control. If it is the person who left, or the company they used to work for, start moving it now. This takes days, and it takes weeks if you wait until it matters.
Two-step sign-in on every mailbox, starting with yours and whoever pays the bills. This is the single cheapest protection in the whole list, and it is the one that stops the invoice scam that targets businesses in exactly your position, because a company in the middle of an IT handover is a company where an odd request looks normal.
Check the mail rules on the mailboxes you own. A rule that quietly forwards or deletes messages is how a compromised mailbox stays hidden. Your email provider shows the rules on each mailbox in its settings.
Day three: prove the backup works
Everybody has a backup. Far fewer have a backup somebody has restored from.
Find it. Which system runs it, where the copies are kept, when the last successful one ran, and who receives the warning when one fails. If the warning email goes to the person who left, change it to you today.
Restore one file, on purpose. Pick a document you know, ask for it back from the backup, and open it. That single test tells you more than any report. If nobody in the building can perform the restore, write that down. It is the most urgent line on your list.
Check Microsoft 365 or Google Workspace separately. What those services keep on your behalf is shorter than most owners assume, and the copy inside them does not protect you from a mistake nobody noticed for a month.
Ask where the off-site copy is. Three copies, on two kinds of storage, with one somewhere else. The short answer to the question behind this day is at how do I know if our backups work. Our infrastructure checklist sets out the rest of what a healthy setup looks like, section by section.
Day four: the paper trail
One list of every supplier. The internet company, the phone company, the hosting company, the software you pay for monthly, whoever sold you the machines. Account number, renewal date, and a human being to call.
Check the credit card statement, line by line, for the last three months. Every technology subscription your business runs shows up there, including the ones nobody told you about. This is the fastest way to find them.
Ask what is under warranty and what is out of it. Serial numbers and purchase dates, for the server and the main machines.
Collect the documentation. Passwords, network diagrams, the note about how to restart the server. If it exists only inside a tool the person who left controlled, get a copy out of it this week.
Day five: decide what happens next
You now know what you own, who to call, and where the holes are. Write the holes on one page and put them in order of what a failure would cost you. That page is your plan, and it is worth more than the advice anybody could give you over the phone before you had it.
Then decide the shape of what replaces the person who left:
- Hire again. One salary buys one person with one set of skills, and the same problem in two years when they leave. Our guide to hiring against handing it over works through the numbers.
- Hand it to a company. Several people, cover when one is away, and the accounts stay in your name. What that costs is in what IT support costs.
- Both. Keep a person for the daily questions and put a company behind them for security, projects and the hours nobody wants to work.
Things to leave alone this week
Do not cancel software you do not understand yet. The line item that looks pointless is sometimes the thing your accounting system talks to.
Do not let a helpful staff member take over the administrator accounts as a favour. You are solving the problem of one person holding the keys. Handing the keys to a different single person repeats it.
Do not rip out the firewall or the server. Nothing about a departure makes working equipment worse. Replacements come after you have a plan and a price.
Do not skip the exit conversation because it is awkward. Ask directly: what would you tell your replacement on their first day, and what were you worried about that you never got to fix. Most people answer that question honestly, and the answer is a gift.
What we would take over
If you hand this to us, the first thirty days look like this. We take ownership of your accounts and put them in your business name, with a password vault you and one other person can reach. We put monitoring on every machine so faults are seen before they stop the office. We test a restore rather than reading a report about one. We build the supplier list, the renewal dates and the written instructions your business did not have. Then we tell you plainly what we found, including the parts that are fine.
After that you get a named account contact who knows your business, a fixed monthly price published on the pricing page, a month-to-month agreement, and a written hand-over plan so the same thing never happens twice. What the day-to-day looks like is on the managed IT page.
Ask for a person
Leave your name and number on the contact page and a person calls you back the same business day, usually within an hour. Bring your one page of holes to that call, and we will go through it line by line, whether or not you ever become a client.
If nobody can answer the questions above, the free infrastructure audit answers them for you and hands you the written report. It costs nothing and there is nothing to sign.
itopsi is a managed IT provider working with Canadian businesses from a Toronto base.
