What should happen, IT-wise, when we hire someone new or when someone leaves?

Onboarding first: a new employee's first day should not be spent watching someone hunt for a spare laptop. With a proper process, the account is created, the machine is prepared with the right software and access, email works, and the phone extension exists before they walk in. The manager fills out one request form; IT does the rest on a checklist. Beyond the good first impression, checklist onboarding means access is granted deliberately (only what the role needs) instead of 'copy whatever Susan has', which is how permission sprawl starts.

Offboarding is where the real risk lives, and it is routinely botched. The day someone leaves (especially involuntarily), their access should end: account disabled, passwords they knew rotated, MFA devices removed, remote access revoked, and any shared credentials changed. At the same time, nothing should be lost: their mailbox and files preserved and delegated to a manager, phone and email forwarded during transition. Companies without a process discover ex-employee accounts still active months later; audits find this constantly, and it is a leading source of both breaches and data walking out the door.

This is bread-and-butter managed IT: a defined request path, same-day execution, and documentation that proves who has access to what at any moment. If you cannot say with confidence that every former employee's access is dead, that is worth fixing this week, provider or no provider.