SOC 2 Offboarding Evidence: The Reconciliation That Prevents Exceptions

A CPA firm's SOC 2 guide, updated on 14 October 2026, says access removal is where it finds more exceptions than anywhere else. The pattern it describes every year: the offboarding checklist says access is removed on the last day, but when the auditor compares termination dates to deactivation dates for a sample, a couple of accounts stayed active for weeks. Usually it is a contractor or a secondary system nobody remembered. Its advice: reconcile your terminated user list against every system the person may have had.

The same guide includes a mock test row: a sample of 25 terminated employees, and two exceptions where production access was removed 9 and 16 days after termination. It is an illustration, not a statistic, but it shows how little it takes.

What's affected

Any control that says access is removed promptly when a person leaves, and the matching criterion on removing credentials when access is no longer authorized. The auditor typically asks for the full list of leavers during the period and tests a sample.

A separate CPA firm piece from 3 December 2025 cites a 2022 Beyond Identity survey of over 900 employees in the US, UK and Ireland in which 83% said they kept some access to a former employer's digital assets. Treat that as a reason to check, not as a benchmark for your company.

How to check if you're exposed

Export the list of leavers for the last 90 days from your HR system. For each person, check every system for an active account:

# leavers.csv has one email per line; idp_users.csv and github_members.csv are exports
comm -12 <(sort leavers.csv) <(sort idp_users.csv)
comm -12 <(sort leavers.csv) <(sort github_members.csv)

Any output means an active account for a leaver. Repeat for the cloud console, production database users, the support tool, the code host, the password manager, shared mailboxes, and anything with its own login.

Then check dates: HR termination date against deactivation timestamp, per system.

What to do now

1. Make the HR record the trigger. The offboarding ticket opens from the termination entry, not from an email.
2. Keep a list of every system with its own login, including marketing, analytics and legacy tools. Owners confirm removal on that list.
3. Prefer single sign on so one deactivation covers many apps, and list the apps that sit outside it.
4. Run the reconciliation monthly. Save the output and the removals.
5. Treat contractors like employees. The CPA firm names them as the usual miss.
6. For each leaver, retain: termination date, ticket, per system deactivation proof, device return, and shared credential rotations.
7. Rotate shared secrets the leaver knew.

How to avoid this trap

• Do not rely on a checklist alone. The sample compares dates in two systems.
• Do not leave secondary tools out of the inventory.
• Do not let managers email IT. The ticket is the evidence.
• Do not forget role changes. Access review should catch accumulated permissions.
• Do not delay removal for convenience, like keeping a mailbox for hand off. Use delegation.

Why it matters

Removing access is an ordinary security control, and the audit just checks it with dates. A leaver with live access is a risk with or without an auditor. Two reconciliations a quarter cost minutes and turn a probable exception into a clean sample.

Try it yourself

Run the comparison above for your identity provider only. Then list three systems with separate logins and run it there.

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Linford and Company: What Is SOC 2? (14 October 2026)
• Linford and Company: User access review best practices (3 December 2025)