When someone leaves a small business, there is usually a clear and well-observed routine for the physical things. Keys come back, a vehicle is returned, a uniform is handed in, equipment is accounted for. Nobody has to be reminded, because the items are visible and their absence is obvious. The equivalent routine for access to systems is frequently missing altogether, and the reason is that access has no physical form. Nothing sits on a desk unreturned. A person who has left can still be signed in to the mail, the file storage, the accounting, the online banking view, the supplier portals, the social accounts and the phone system, and the business will not notice, because nothing looks any different from the inside.
Most of the time this causes no harm, which is precisely what makes it persist. Departures are usually amicable, and a former colleague with a still-live account is not doing anything with it. But the risk is not really about the person; it is about the account. An account that nobody is monitoring, attached to an address nobody checks, protected by a password nobody has changed, is exactly the kind of door that gets used months later - by whoever ends up with an old phone, or by an attacker who finds those credentials in a breach somewhere else entirely and tries them. And the awkward cases do happen: a departure that turns sour afterwards, a dispute over final pay, a person who moves to a competitor. The time to have closed the accounts is before anybody knew which kind of departure this was going to be.
The harder version of this problem is not the accounts the business remembers, but the ones it does not. In a small business, people sign up for things in order to get on with the work: a scheduling tool, a stock portal, a delivery account, a supplier's website, a subscription paid on a personal card and claimed back. Those registrations are made in an individual's name, often against their own mailbox, and they are frequently unknown to anyone else. When that person leaves, the business may discover that an account it depends on cannot be recovered, because the recovery address belongs to somebody who no longer works there - and that discovery tends to arrive at the least convenient moment, when something has to be changed urgently.
The remedy is a list, made now rather than during a departure. Write down every service the business uses, who has access to it, and which address the account is registered against - and treat the address as the important column, because that is what controls recovery. Work through it so that accounts the business depends on are registered to the business rather than to an individual, and so that at least two people can get into anything critical. Then, when somebody does leave, the routine for access looks like the routine for keys: a defined list, worked through on the last day, including signing out of existing sessions rather than only changing the password. It is half an hour of dull work at a calm moment, and it replaces an unknown with something that can simply be checked off.