Employee Offboarding Checklist for Singapore SMEs: Fix It Before December

Offboarding should begin the day notice is given, not the day the laptop comes back. For a Singapore SME, a working process has five parts that run in parallel: a written acceptance and final-day calculation, a sequenced access revocation list, a knowledge capture session while the person is still motivated to help, the statutory filings (final CPF contributions, IR21 for foreign employees, release of any outstanding leave or AWS), and a short exit record kept on file. The reason to build this in October rather than December is simple — resignations cluster after bonus payouts, and they land in the same six weeks that annual leave empties your office. If your process lives only in your own head, December is when that becomes expensive.

Why does December make offboarding harder for a 10-person business?

Three pressures stack. Bonuses and AWS land in November and December, which is exactly when people who have been planning to leave finally give notice. Annual leave has to be cleared or forfeited by 31 December in most SME leave policies, so the colleagues who would normally absorb a handover are themselves away. And year-end is when invoicing, stock counts, GST filing and client renewals all compete for the same attention.

In a 10-person company there is no HR function to carry this. The owner carries it, usually while also closing the year. That is why the process fails quietly — not because anyone is careless, but because a one-month notice period overlapping two weeks of leave leaves roughly eight working days of real handover time, and nobody counted them.

What actually breaks when access revocation is late?

The honest answer is that most of the time nothing dramatic happens — which is precisely why the habit never forms. The failures that do occur are these.

A departing staff member keeps access to the shared mailbox and continues receiving customer enquiries nobody is monitoring. A WhatsApp Business number stays linked to a personal device, so client messages arrive at a phone that no longer works for you. A cloud accounting login remains active for months, which is both a PDPA exposure and an audit finding waiting to happen. Marketing or e-commerce admin access stays open on a Shopee or Meta Business account, and when the person stops responding you discover you cannot remove them without a platform support ticket.

The worst version involves money. Business email compromise attempts rise at year-end, and a dormant but live account belonging to someone who has left is an attractive route in — nobody reads its security alerts.

Which accounts should be revoked, and in what order?

Build the list once, as a spreadsheet, and keep it as a living document. Three tiers work well.

Revoke on the last working day, before they leave the premises: email and single sign-on, accounting and payroll systems, banking and payment approvals, customer databases and CRM, cloud file storage, password manager vaults, and any admin role on a platform account (Google, Meta, Shopee, Lazada, TikTok Shop). Transfer ownership of documents and calendars before you disable the account, not after — disabling first can orphan files in some tenancies.

Revoke or transfer within 48 hours: physical access cards and office keys, shared phone numbers and WhatsApp Business device links, VPN and remote access, SaaS seats you are paying for monthly, two-factor authentication devices registered to company accounts, and any API keys or integration tokens created under their name.

Review within two weeks: domain and hosting registrar contacts, recurring subscriptions charged to a card in their name, vendor portals, and the delivery addresses or recovery emails on accounts you rarely touch.

The seat-cancellation step is worth a note of its own. Every departure is a chance to check whether that SaaS licence needs replacing at all, or whether the work it supported has already moved elsewhere. Paying for an empty seat for eleven months is a common and entirely avoidable cost.

How do you capture what only that person knows?

Ask for a handover document, but do not expect it to be sufficient. People document procedures; what matters is the judgement. Sit down for 45 minutes and record answers to specific questions: which clients have informal arrangements not written in the contract, which supplier contacts actually respond, which recurring task has a quirk that trips up newcomers, what is half-finished and where does it live, and what would go wrong in the next 90 days if nobody picked this up.

Record it, transcribe it, and file it where the next person will look. This is also the moment to notice how much of your business depends on one undocumented person — including yourself. If a departing staff member's knowledge gap takes weeks to close, the same gap exists around the owner, and it is larger.

What does a defensible paper trail look like?

Keep the resignation letter or termination notice, your written acknowledgement with the agreed last day, the final salary and leave computation, and a dated record of what was returned and what access was revoked. Under the Employment Act, notice periods and final payment timing are not discretionary; under the PDPA, you are accountable for personal data that a former employee can still reach. A one-page signed exit record covers both and takes ten minutes.

For foreign employees, file IR21 at least one month before the last day and withhold final payment until tax clearance. Missing this is one of the few offboarding errors that creates a direct liability for the company rather than an inconvenience.

What should you do this month?

Before November: write the access list for every system your business uses and note who holds admin rights on each. Add a single owner for each platform account so no system depends on one person's personal login. Then draft the one-page exit record template. That is a two-hour task in October. In December, the same work costs you a week and the goodwill of whoever is covering.

Frequently asked questions

How long should we keep a former employee's email active?
Disable the login immediately, but keep the mailbox itself for at least 12 months with an auto-forward to a current staff member and an auto-reply naming the new contact. This preserves business correspondence and avoids lost enquiries without leaving an accessible account open. Do not convert it to a shared login.

Can we withhold final salary until the laptop is returned?
Not as a general deduction. Final payment timing is governed by the Employment Act, and deductions for unreturned property need a clear contractual basis and must stay within statutory limits. The practical answer is to collect equipment on the last working day as a scheduled step, not to use salary as leverage after the fact.

We have no HR system — is a spreadsheet enough?
Yes, for a team of this size. A spreadsheet that is actually updated beats an HR platform nobody logs into. Keep it in shared storage with version history, assign one person to own it, and review it each time someone joins or leaves. Consider software only when the manual process is working and the volume has outgrown it.