The audit said our access revocation was 'untimely': moving offboarding into the ticketing system

The audit report said, in effect: system access revocation is not timely — some accounts outlived their owners’ employment. The root cause wasn’t negligence; it was a process built on email relay: HR emails IT, the email drowns, gets skimmed, or dies in “I thought you were handling it.”

The fix: move the entire offboarding flow into the ticketing system (Inistate) as a stateful pipeline with reminders and sign-offs.

The four-step design

Every step has an owner, a trigger and a sign-off — “I thought you handled it” is eliminated by mechanism

1. HR logs the exit: the day a resignation notice arrives (typically two months early), HR creates the entry — the information now has a single home;
2. Confirmation 7 days before the last day: the system automatically emails HR reminders to confirm final dates and any email-forwarding needs. HR’s confirmation automatically triggers the downstream IT tasks — no one needs to remember to send anything;
3. IT software team deactivation: on notification, they lock ERP and other business-system accounts on the last working day (or next), deactivate cost centers, update user matrices — then sign off in the system;
4. IT infra team deactivation: disable the AD account, configure requested mail forwarding, sign off, ticket closed.

The thoughtful details

• Confirmation at 7 days out, not on the day: exit dates change (earlier/later) all the time; the buffer prevents IT from killing accounts against a stale date;
• Business accounts and infrastructure accounts as two separate steps: business systems can lock during the final day; AD/mailbox waits until the person has actually left — different timings, different owners, so the process separates them;
• Sign-off is the audit trail: next time an auditor asks “when was this person’s access revoked”, the answer is a timestamped, signed record in the system — not an email archaeology dig.

Lessons

1. An audit finding is the best process-change sponsor you’ll ever get — nobody has time for process improvement until it carries a remediation deadline;
2. Any cross-department process driven by email will fail eventually: a process without a state machine is not a process;
3. The real payoff of digitizing isn’t speed — it’s traceability + unskippability: every step demands a sign-off to advance, so leaks die by design;
4. We kept a testing period and a policy-amendment window before cutover — however good the tool, run it end-to-end first; don’t let the first real leaver be the guinea pig.