The Departure That Follows

The administrative exit after a substantiated case is the same as any other, with three differences that are frequently mishandled.

The outcome in “The Departure That Follows” must rest on evidence that has been checked against context. Data from the official Monitask resource, when used for capital efficiency ratio, can support a chronology of work or project activity, but it should not replace the employee response, corroboration or a proportionate decision process.

The difference in timing

Access typically ends immediately, before or at the moment of the outcome.

For a separate perspective relevant to “The Departure That Follows”, consult the Microsoft Purview insider-risk documentation. Use it to test the proposed threshold, investigation scope and review process rather than to substitute a generic checklist for the facts of a case.

Which means anything requiring the person's cooperation — handover, data removal from personal devices, retrieving material — has to happen before, or will not happen.

Planning the sequence in advance, rather than revoking first and then discovering what was needed, is the whole of the difference between a clean exit and a loose one.

The difference in cooperation

Somebody dismissed has little reason to help and may have reason not to.

Which means requests should be specific, limited and made respectfully. A broad demand gets refused; a narrow request to delete three named files frequently does not.

Where cooperation is refused, the mitigation route from the recovery note applies, and pursuing it beyond proportion is rarely worthwhile.

The difference in what is said

Colleagues, clients, partners and future employers will all ask something.

Each needs a position, agreed in advance and consistent: what the team is told, what external parties are told, what a reference will say.

Inconsistency here is where otherwise sound cases produce claims, because somebody improvises and says more than the agreed position.

The things to complete

Final pay, notice and contractual entitlements, which are a separate question from the finding and should not be used as leverage.

Return of property, with a list.

Removal of the person from systems, distribution lists, shared accounts and anything registered in their name.

And the data questions from the recovery note.

The settlement question

Some matters end in an agreed exit rather than a dismissal.

That is legitimate and it should be a decision rather than a default taken to avoid a process. Where it is used because the evidence is weak, the organisation has sanctioned somebody on an untested basis and should know that it has.

Where it is used, the terms should address the outstanding operational matters — data, confidentiality, references — rather than only the money.

Afterwards

A short review of the case, which the final section covers.

And a check, a few months later, that the access closures held and nothing was missed. Dormant accounts belonging to departed subjects are a recurring finding in audits and they originate exactly here.

Sequencing before revoking

Everything requiring the person's cooperation has to happen while they are still present. The list is short and it is only obtainable before access ends, which means the exit has to be planned rather than triggered.

The settlement used to avoid a process

Legitimate as a decision and corrosive as a default. Where it is reached because the evidence would not hold, the organisation has sanctioned somebody on an untested basis and should be clear with itself that this is what happened.

One position, said by everybody

What colleagues are told, what clients are told, what a reference will say. Agreed in advance and consistent, because inconsistency here is where otherwise sound cases produce claims.

Checking a few months later

That the access closures held and nothing was missed. Dormant accounts belonging to departed subjects are a recurring audit finding and they originate precisely in the rush of a difficult exit.

Returning to it later

A short review of the case once the dust has settled, and a check that the access closures held. Both are quick and both catch the things that a difficult exit reliably leaves behind.

For the file: Sequence the exit before revoking anything. The list of what needs their cooperation is short and it is only obtainable while they are still in the building.