Remove a former adviser's access to shared finance folders

A former adviser's name can disappear from a folder's sharing panel while another permission still allows access. The person may belong to a group, inherit access from a parent location, hold a separate file invitation or possess a broadly usable link. Start with the locations used during the engagement and trace each access route. The aim is to establish the person's effective access after the change, with evidence that the intended restriction actually works.

Microsoft's sharing guidance distinguishes direct access, sharing links and access obtained through the site or parent folder. Its link documentation also distinguishes links usable by anyone holding them from links restricted to specified people. Those mechanisms need different treatment. Deleting one named invitation will not necessarily neutralize an independent link. Check the actual platform configuration rather than assuming that all sharing is attached to a single visible user entry.

List the folders, workspaces and individual documents shared for bookkeeping, payroll, tax preparation, board reporting and special projects. Include older tender rooms and one-off files sent outside the main folder. Ask the engagement owner and document administrator to compare their records. A finance team often remembers the primary close folder while overlooking a separate file shared during an urgent question months earlier.

Identify the actual accounts used. An adviser may have a named business account, a guest identity and an older address from a previous firm. Distinguish the individual from a group representing the whole provider. If the engagement is ending for one person but continuing for colleagues, remove the correct access without disrupting authorized work. If the provider relationship has ended, determine whether the entire provider group and its individual exceptions need removal.

Confirm that the company still controls the records before deleting or moving anything. Access removal is different from destroying the engagement's evidence. Ensure that the incoming team has the required documents and that a company owner can administer the location. Where the departing adviser owns a shared workspace, arrange a supported ownership or records transfer through the agreed handover. Do not depend on an expiring invitation as the company's only copy of its own close package.

Inspect the sharing links associated with the relevant folders and sensitive files. Determine their intended audience, permissions and continued business purpose. A link meant for a completed project may be removed entirely. A link still used by authorized colleagues may need replacement with a narrower route. Tell those colleagues where the approved records now live so they do not respond to an access problem by creating another unrestricted link.

For inherited access, find the parent permission that grants it. Removing a local entry may have no effect if a site membership still supplies the same right. Ask the platform administrator to explain the effective permission path when the interface is unclear. Keep a record of the specific change rather than a screenshot showing only the person's absence from one panel. That makes the review reproducible when another administrator checks the result.

Consider a hypothetical adviser with three routes: membership in a finance project group, direct access to a tax folder and an old broad link to a forecast. Removing the group addresses only the first route. The direct grant and link need their own review. This simple example is why an offboarding checklist should identify mechanisms and locations, not merely ask whether the person's name was removed somewhere in the document system.

Use the platform's administrative permission inspection and an approved test method. Do not ask the former adviser to share a password or attempt to enter their account. Where a controlled test account is useful, reproduce the relevant group and link conditions without giving it unnecessary live access. The administrator should be able to explain why each former route is now denied and which continuing routes remain available to the authorized team.

Check the actual sensitive file as well as the folder above it. A document may have an individual grant that differs from its neighbors. Include a sample of older files with known exceptions, then expand the review if those checks reveal a broader problem. Verify that legitimate users can still retrieve the final records. The goal is a deliberate access boundary, not a widespread lockout that drives people toward uncontrolled duplicate copies.

Remember that revoking online access cannot recall a copy already downloaded or a screenshot already taken. Handle retained copies under the engagement terms, record policy and applicable obligations. Ask for the agreed return, retention or disposal confirmation where relevant. Avoid promising that an access change erases every historical copy. If there is evidence of unauthorized disclosure, use the company's incident process rather than treating routine permission cleanup as a complete investigation.

Record the scope reviewed, accounts removed, links revoked or replaced, groups changed and verification performed. Note any location outside the company's control and the action agreed for it. Keep sensitive permission details restricted to those who need them. The handover owner should know whether removal is complete or whether a particular external workspace still requires follow-up, with a named person responsible for that remaining item.

Improve future sharing by using the narrowest appropriate audience, an identifiable owner and an end condition for project access. Review exceptions when an engagement changes rather than waiting for the next annual cleanup. A well-managed folder allows the company to continue its work after an adviser leaves while making the former access paths understandable and removable. That is a stronger result than a reassuring checkbox with no account of how permission was actually granted.