Ever since the Covid-19 pandemic began a year ago, businesses have spent a lot of time on onboarding new employees and helping them adjust to the challenges of remote work.
They need to focus just as much energy on offboarding workers who are leaving, experts say.
“The whole basic premise of how you say goodbye is as important as how you say hello,” said Mary Cavanaugh, a senior vice president at Keystone Partners, a career development and consulting firm. “Because we are in this virtual environment, the process may be rushed.”
Still, “even more time and attention needs to be put into what the process is when it’s virtual because you don’t have the luxury of being able to walk up the hall, have a conversation [with a worker] and walk through the process,” she added.
In fact, failing to properly offboard employees can have serious consequences, past cases make clear.
Disgruntled ex-employees with ongoing data access
Among the possible consequences of not offboarding employees correctly is data theft. Many of these incidents are either not reported or not detected because discovering them can be difficult.
In the case of Coca-Cola, data thefts by former employees were discovered at least twice. In 2014, according to news reports, the company notified almost 75,000 current and former employees that their personal information may have been compromised by the theft of unencrypted laptops from the firm’s Atlanta headquarters by a former employee. Coca-Cola regained possession of the stolen machines.
The company said there was no evidence that the stolen information had been used for criminal activity. Nevertheless, it provided free credit monitoring for a year to the affected individuals.
Then in 2018, Coca-Cola announced that a former employee had taken the personal information of 8,000 employees the previous year. (Law-enforcement officials had asked the largest soda company not to disclose the theft while it was under investigation.) Again, there was no evidence that the employees’ information was used to commit a crime. The company again gave affected employees free credit monitoring for a year.
Coca-Cola is not unique in its vulnerability to data theft. In fact, a 2014 Osterman Research study found that 89 percent of employees could still access computer networks with sensitive corporate information of a former employer well after their departure.
The 2019 Verizon Data Breach Investigations Report found that 40 percent of employees that have stolen corporate data admitted that they would use it in their new jobs.
“Organizations simply cannot afford to overlook this security threat,” writes Neel Lukka, managing director for software company CurrentWave, in a column on SCMagazine.com.
“The danger also doesn’t end once the employee leaves the premises. Gaps in the employee offboarding process can leave a disgruntled ex-employee with ongoing access,” Lukka added.
The importance of a thorough exit interview
Businesses should conduct exit interviews with remote employees to learn the reasons for their departures, experts say. They also advise companies to then flag those who may have a score to settle and cause trouble later. Throwing a goodbye party (virtual or otherwise) for workers who are leaving on good terms is a good idea.
“Sometimes exit interviews are [conducted] in a cursory manner,” Keystone Partners’ Cavanaugh said. “It’s very important for a company or organization to find out how that employee’s experience was. It’s not just about the reasons they’re leaving, but how their employment process was when they were hired. How [does the departing employee] look at it now? That is valuable information for a company to use as they continue to look at and continue to improve their culture.”
Some companies are including language in their offer letters to new employees about what would happen to them if their employment doesn’t work out, according to Ash Athawale, a senior managing director at staffing company Robert Half. This may be particularly important when the employee is teleworking, he says.
“Being remote can be lonely,” Athawale said. “You’re sitting there, you haven’t met anyone [in person] at the company and now all of a sudden they’re telling you that they don’t want you anymore. People tend to react adversely.”
Long-term monitoring is wise
Monitoring employees’ use of data is key because data theft can occur as many as 90 days before a worker resigns, CurrentWave’s Lukka says.
Lukka recommends that businesses monitor email attachments, web browsing and USB file transfers, along with bandwidth usage, server access and printer logs. He also suggests that departing employees should be prevented from accessing data egress points such as email, cloud storage sites, FTP servers and external storage devices.
Companies also need to make sure that laptops and other equipment provided to employees are returned and that software accounts are terminated or deprovisioned, Lukka says.
“Letting employees share accounts complicates the deprovisioning process and reduces the utility of user activity data,” Lukka wrote in SCMagazine.com. “If evidence of an anomalous file transfer or other high-risk activity becomes present on a shared account, there’s little security pros can do to verify who was responsible.”
Cavanaugh offers a final word of advice regarding employees who have announced their departure. Businesses need to be careful before making a counteroffer to entice a departing employee to stay as it may not be worth the bother, she says.
“Once they make that decision to interview [for a new job], that’s an intensive process,” Cavanaugh said. “Trying to turn that situation around is difficult and may not be of value to the organization or the employee, because they’ve, in a way, already left.”