A lot of small businesses run on institutional knowledge: one person who knows the Wi-Fi password, the admin login, which server does what, and how the backup actually works. That arrangement is invisible until the person is no longer available, and then it becomes a real problem.
Secure administrative ownership
Start with every account that can change, recover, purchase, delete, or transfer a business system. Record the platform, account name, responsible owner, recovery method, and where the credential is stored. Confirm the business controls the recovery email and phone number rather than relying on a departing employee's personal information.
Prioritize the domain registrar, DNS, email tenant, cloud platforms, internet provider, firewall, network equipment, backup platform, website, accounting systems, and line-of-business applications. Losing control of a domain or tenant can affect many other systems at once.
- Primary and secondary administrator accounts
- Recovery methods and emergency codes
- Domain, DNS, website, and email ownership
- Cloud, network, security, and backup portals
- Software licensing and billing accounts
Capture how the environment fits together
A network diagram does not need to be elaborate. It should show internet connections, firewalls, switches, wireless access points, servers, important network segments, remote access, and links between locations. Label devices with their location, purpose, management address, and support status.
Cloud documentation should identify tenants, subscriptions, identity providers, storage locations, shared mailboxes, groups, security policies, and integrations. The goal is to reveal dependencies. If changing one system affects another, the relationship should not exist only in someone's memory.
Document recurring operations and unfinished work
Ask for the procedures that keep the environment running: employee onboarding and departure, account recovery, device setup, patching, certificate renewal, backup review, vendor escalation, and after-hours response. Include who approves access and how unusual requests are handled.
Also record work that is incomplete, temporary, or intentionally postponed. A future consultant needs to know which settings are deliberate, which risks have been accepted, and which changes were waiting on budget, a vendor, or a business decision.
Verify backups and vendor relationships
A backup record should state what is protected, how often it runs, how long data is retained, where copies are stored, who receives failure alerts, and how a restore is started. If possible, perform a representative restore while the current IT person is still available.
Create a vendor list with account numbers, support contacts, contract dates, renewal terms, and the services each vendor provides. Confirm that invoices and contracts are accessible to the business. This prevents a future outage from beginning with a search through old email.
Make the handover usable
Store the final record in a location the business controls and restrict sensitive credentials appropriately. Separate passwords from general documentation while making sure authorized leadership knows how to obtain them. Review the material with the incoming owner rather than treating a folder transfer as a complete handover.
Documentation should be current enough to support the next decision, not impressive enough to sit untouched. A concise diagram, accurate access record, vendor list, recovery procedure, and known-issues log are more valuable than a large document nobody can maintain.
Create a record the next owner can verify
Use one entry per system. Keep passwords, recovery codes, and keys in an approved secure store; this worksheet should point authorized people to that store without copying secrets into a general document. This guide focuses on preserving the departing person's knowledge. Coordinate the actual access removal and provider transition through their own checklists.
| Record | What to enter or verify |
|---|---|
| System and purpose | Service name, business use, and the people or applications that depend on it. |
| Business owner | The person authorized to approve access, spending, and changes. |
| Administrative access | Approved account, secure credential location, and the date access was verified. |
| Recovery path | Who can authorize recovery, what it depends on, and when it was tested. |
| Routine work | Updates, renewals, recurring tasks, and where the current instructions live. |
| Vendor and agreement | Support contact, account reference, renewal date, and contract location. |
| Open decisions | Known issue, business impact, next action, owner, and target date. |
| Acceptance | Incoming owner's name, verification date, and any unresolved gaps. |
Finish with a short walkthrough
Ask the authorized incoming owner to complete a representative task using the record: locate a vendor, identify the correct administrator, or explain how to request a restore. Keep this within approved access and change controls. A production change is not necessary just to demonstrate that the instructions are usable.
For example, an instruction that says 'call the internet provider' is incomplete if it omits the account reference, circuit location, and authorized caller. Filling those gaps is useful knowledge transfer. Record what remains unverified and assign a follow-up owner before the departing person's access is withdrawn.