What Happens When Your IT Person Quits

A common arrangement in businesses of 15 to 75 people: one person handles the technology. Sometimes it is their job, more often it is attached to another role because they were the one who understood computers when the question first came up. The arrangement usually works, right up until the day that person resigns, and then it exposes a gap that has been there the entire time.

Where the gap comes from

The gap is ownership. Over several years that person accumulated administrative access to every system the business runs on, and in most cases the business never formally took possession of any of it. The credentials live in their memory, a personal password manager, or a spreadsheet on their laptop. The firewall reflects a design that made sense at the time and was never written down. Nobody but that person has ever opened the backup console to see whether it works.

What happens after they leave

What follows their departure is predictable enough that I can usually describe it before the owner finishes explaining the situation. Within days, someone discovers the business cannot access its own domain registrar, which controls the email everyone depends on. Within 2 weeks something breaks and there is nobody who understands why it was built that way, so an outside engineer is billing hourly to reverse-engineer decisions made years earlier. Within 1 month, someone finally checks the backups and finds out whether they work, which is a poor moment to learn the answer.

The 6 accounts the business should own

The remedy is to treat administrative access as a business asset, the same way you treat bank signatories, insurance policies or the lease. There is a defined list, and it is shorter than most owners expect:

• Domain registrar and DNS: the accounts that control your web presence and email routing.
• Microsoft 365 or Google Workspace global administrator.
• Firewall, router and wireless administration.
• Backup console, together with written evidence of the last successful test restore.
• Line-of-business applications: accounting, practice management, CRM.
• Accounts held with your internet provider and any technology vendors.

For each of these, the business should hold the credentials in a company-owned password manager, and at least 2 people should be able to reach them. That is a half-day exercise conducted calmly, and it removes most of the risk described above.

Write down how it works

The other half of the work is documentation: a plain description of what runs where, why it was configured that way, which vendors support it, and what has to happen when it fails. Nobody enjoys writing it. It is worth insisting on all the same, because it is the difference between a resignation that is an inconvenience and a resignation that costs you a month of disruption and a five-figure recovery bill.

If your technology currently rests on one person, ask them to walk through that list with you this quarter. A good employee will not read that as distrust. Formalizing access protects them as much as it protects the business, and most of them already know it. If no one can produce the list, you have learned something valuable at the point where it costs the least to fix.