What sorts of failsafe processes/controls, etc, do you rely on to make sure terminated or suspended employees’ access credentials are revoked immediately? Does your org generally rely on direct communications from HR or do you have an HRM or similar system to automate this?
Sort by:
Our HR team goes and logs a ticket in the IT Infra ticketing system for us to keep a track of the request. And same is get recorded in HRM as well (we are yet to integrate these two systems, WIP).
Important point here from IT Infra perspective is to have single sign-on enabled so that the dependency on people to go and check every other system is taken off. We also practice that as a first step we temporarily disable the credentials; it then goes through the approval process to permanently disable the credentials.
I recommend leveraging your organization's ticketing system to initiate account deactivation through corporate IT. In environments where Microsoft tools are standard, IT teams typically handle this by disabling the user's account via Active Directory. Using a formal ticket not only provides traceability for internal audits or legal proceedings, but also supports reversibility if the action needs to be undone.
It's essential that access revocation is not performed based on verbal requests alone. Proper documentation is critical to protect the organization in the event of disputes or adversarial legal actions. A structured, documented process ensures accountability and minimizes risk.
Our HR system, Workday, triggers call to other systems to revoke access. Same way, if someone gets hired, Workday will triggers call to create employee's credentials.
Is it bulletproof, maybe not, but chances are quite high that if someone job is terminated, it will be reflected in the HR system.