The account you forget to revoke is the one that answers your phone.

Somebody hands in their notice on a Tuesday. By Friday the bank card is cancelled and the keys are back on the hook. Everyone considers the matter closed.

The accounts that get remembered are the ones with money in them. The ones that get forgotten are the ones customers actually touch.

Nobody has the list

Ask most small businesses who has access to what and you will get a thoughtful pause rather than an answer.

This is not carelessness. Access accumulates sideways in a small company. Somebody adds the office manager to the Google profile so she can answer reviews at the weekend. Somebody gives the apprentice the WiFi password, which is also the password on the shared email, because it was easier. The Facebook page is attached to a personal profile belonging to a person who left in 2022 and whose surname nobody can now recall. None of that was a decision, and all of it is still live.

The dangerous one is not the obvious one

Google's own documentation is clear about what a manager on your Business Profile can do. Managers have mostly the same access as owners; the exception is that they cannot add or remove users or delete the profile.

Read that again with a departure in mind. A manager can edit your business information and respond to reviews in your name.

That includes the phone number. The profile is where a large share of your calls originate, and a change to it does not look like a breach — it looks like an edit. Only owners can add and remove users, remove profiles, or edit all URLs, so the manager role feels like the safe one to hand out. It is the one worth auditing first.

The seven-day trap

Here is the part that catches people at the worst possible moment.

Only owners can remove other owners and managers. So if the person leaving is the only owner on the profile and you are not on it at all, your first move is to get yourself added. And new owners and managers must then wait seven days before they can manage some features, including removing other users and transferring ownership.

A week is a long time when a relationship has ended badly. Worse, a primary owner cannot remove themselves until primary ownership has been transferred to somebody else, and the profile has to have at least one other owner or manager to transfer to. If they have already gone and stopped answering the phone, you are no longer doing offboarding. You are filing a request for access to your own listing and waiting on Google.

The lock-out nobody causes

The other failure has no villain at all.

Shared accounts usually have two-factor authentication pointed at one phone. When that phone belonged to the person who left and the number gets cancelled, nothing breaks immediately, which is exactly why nobody notices. It surfaces months later when somebody signs in from a new laptop and the code goes to a number that no longer exists. Nobody did anything wrong and the account is gone anyway.

Check where the codes go before you need them. It takes two minutes on a quiet afternoon and it is unrecoverable on a busy one.

The routes to your customers

Work outward from anything a customer can reach.

The Business Profile, first, for the reason above. The shared inbox, particularly if enquiries have been forwarding to a personal address, which is a habit that starts as a convenience and quietly becomes the only route a lead has. Your CRM, where the departing person can still see every contact and every open job. Social pages and review platforms. Then any answering service or texting number, because the number customers text is a customer route in exactly the way the phone line is.

The infrastructure underneath gets missed for a different reason. Domain and DNS, hosting and the website login rarely have day-to-day users, which is precisely why an old account can sit there unexamined for years.

Do it while everyone is still here

The genuine fix is not a better checklist for the day somebody leaves. It is having written down who holds what while nothing is happening, because the day of a departure is the worst possible time to be discovering your own access map.

That list should sit next to the one about which accounts the business itself should own, and the two overlap heavily. An account registered to the business rather than to a person is an account no departure can take with it, which turns offboarding from an emergency into an afternoon of tidying.

If you are not certain what a former employee can still reach, book a strategy call and we will map it with you. It is a shorter conversation than most people expect, and a much shorter one than the alternative.