How to Answer Employee Access Removal and Deprovisioning Questions
Your customer asked: “How do you remove access when an employee or contractor leaves?”
The short answer
Describe who triggers access removal, who performs it, which account types are covered, and any timing you can actually support. Avoid promising immediate or same-day removal unless that is a verified company practice.
Educational guidance only. This page does not determine what is true about your company and does not create a security, compliance, testing, or certification claim.
What the customer is really asking
Understand the question before you answer it.
Reviewers want to know whether former workers can retain access after their relationship with the company ends. The important facts are ownership, scope, timing, and whether the company can verify completion.
How to answer accurately
Start with the version that matches reality.
If you have an offboarding process
Describe the trigger and the responsible roles, then identify the systems or identity provider included in the process.
If access removal is manual
Manual is not the same as absent. Explain the actual manual process and avoid presenting it as automated.
If you cannot verify a removal timeframe
Do not invent one. State the process you know and confirm the timing before making a contractual-sounding commitment.
A useful answer structure
Status → scope → current practice → supporting information. Start with the direct answer, narrow it to what you can verify, explain how the practice works, and reference evidence only when that evidence actually exists.
Evidence that may help
These are examples, not requirements and not proof that your company has the practice. Use only evidence that really exists and is appropriate to share.
- Offboarding checklist
- Account suspension or deletion logs
- HR departure notification
- Identity-provider audit history
What not to say
- “Access is immediately revoked” unless your records and process support that timing.
- That every SaaS account is automatically disabled if some are managed separately.
- That an offboarding policy proves each departure was completed correctly.
How Oredra handles this
Answer it once. Keep the truth behind the answer.
Oredra can preserve the approved wording and remind you when the underlying offboarding practice needs review.
Inside Oredra, a written policy, stated company practice, implemented control, available evidence, tested control, and independent certification remain distinct. Oredra uses approved information to draft future answers and flags questions that the approved profile cannot support.
Authoritative references
Oredra uses primary guidance where a technical or assurance concept benefits from verification. These references do not determine your company's answer.
Related questionnaire questions
Do you require multi-factor authentication (MFA)?
The reviewer is usually asking whether access requires more than a password and, just as importantly, where that requirement applies. Do not answer “yes” simply because your software supports MFA. Confirm that your company actually requires it for the users and systems in scope.
How do you provision user access?
Explain how a person receives access, who approves it, and how the access level is chosen. A written procedure is useful, but do not claim a formal approval workflow if access is actually granted informally.
Do you follow the principle of least privilege?
Least privilege generally means limiting access to what a person needs for their responsibilities. Before answering “yes,” confirm how permissions are actually assigned and whether broad administrator access or shared accounts create exceptions.