If a contractor's engagement ends without HR knowing, then how do we catch it?

Start

A contractor's work may have ended unnoticed

Contractors and agency workers are the people most often missing from HR, which is why the sponsor register, not the HR record, is the only source for their lifecycle events. In the pack's example a contractor's project ended without anyone telling HR or the service desk, and it did not matter: the end date recorded at joining ended the access.

• Then: Is the contractor in the sponsor register with an end date?

Decision

Is the contractor in the sponsor register with an end date?

Every non-employee has a sponsor and an end date, recorded before any account is created and no more than 12 months after the start by the pack's default. A contractor whose account was created on a manager's request, with no register entry, has no end date to expire it. If you cannot find the entry, take the no branch.

• No, or not known: Treat the account as orphaned and disable it
• Yes: Has the recorded end date already passed?

Step

Treat the account as orphaned and disable it

An account that matches no current person in the HR record or the sponsor register is orphaned. Disable it within 1 working day of finding it by the pack's default, and ask the system owner to name an owner or confirm deletion. If the person is still working for you, their sponsor records them, with an end date, before access is restored.

• Then: Raise it as a finding; a pattern is a process weakness

Outcome

Raise it as a finding; a pattern is a process weakness

Raise the orphaned account with the access review coordinator as a finding. An account created with no register entry means the joiner route was bypassed; if it has happened more than once, send it to the process owner as a process weakness with a fix and a date.

Decision

Has the recorded end date already passed?

At the end of the recorded end date every account set to expire stops working, whether or not anyone told HR. Local accounts in systems that cannot expire accounts are removed from the leaver checklist at the same time.

• Yes: Check each account expired, local accounts included
• No, it is still ahead: Has the work stopped before the recorded end date?

Decision

Has the work stopped before the recorded end date?

This is the case the end date cannot catch on its own: the work stops early and the accounts stay live until the date arrives. The sponsor is the person who knows, and the reminder before the end date is the routine moment to ask. The periodic access review is a later backstop: it raises an account with no sign-in for 90 days, by its default, as dormant. If the sponsor cannot say whether the work continues, treat it as stopped.

• Yes, or the sponsor cannot say: The sponsor records the early end; it is a leaver today
• No, the work continues: Does the sponsor want to extend the end date?

Decision

Does the sponsor want to extend the end date?

The service desk reminds the sponsor 10 working days before the end date by the pack's default. The sponsor decides: let the engagement end, or extend it. Only the sponsor can extend it.

• Yes: The sponsor records a new end date; renew extras separately
• No: Let the accounts expire at the end date

Step

The sponsor records a new end date; renew extras separately

The sponsor records the new end date in the sponsor register, no more than 12 months ahead. Extending the end date does not extend non-standard access: each extra right still needed is renewed on its own request, with the same approvals and an expiry no later than the new end date. Update each account's expiry to match.

• Then: Let the accounts expire at the end date

Outcome

Let the accounts expire at the end date

Nothing more is needed while the work continues: the accounts expire at the end of the recorded end date. Non-standard rights end sooner if their own expiry comes first. The month-end reconciliation confirms that expired accounts are gone.

Step

The sponsor records the early end; it is a leaver today

The sponsor records the new end in the sponsor register the day the work ends, and the person is a leaver that day. The service desk opens the leaver checklist, with a line for every system the person's access reaches. Recover equipment and badges the same day.

• Then: Is any account still active in any system?

Step

Check each account expired, local accounts included

Check the directory and every system with local accounts, from its own user list or audit log. A configured end date is not evidence that access stopped, and a system that cannot expire accounts depends on its named administrator removing them from the leaver checklist.

• Then: Is any account still active in any system?

Decision

Is any account still active in any system?

A removal counts only when it is confirmed in the system. If you cannot confirm a system's state, because its extract did not arrive or nobody can check, treat its accounts as still active.

• Yes, or not confirmed: Remove it now and record the removal as late
• No: Did they hold privileged access or know shared credentials?

Step

Remove it now and record the removal as late

Call the named administrator, then the system owner, and block sign-in at the gateway where the account cannot be removed. A removal after the end date is late: raise it with the access review as a finding. Where a supplier runs the system and cannot remove it in time, the system owner raises the removal time against the contract.

• Then: Did they hold privileged access or know shared credentials?

Decision

Did they hold privileged access or know shared credentials?

A supplier's engineer may hold a named supplier administrator account, enabled only for agreed windows, and a contractor may have been given administrator rights for a project. Check the privileged account inventory and the vault's access log for this person. If you cannot tell, take the yes branch.

• Yes, or not known: Disable privileged accounts; change what they could read
• No: Was any account used after the work ended?

Step

Disable privileged accounts; change what they could read

Disable every privileged account the person holds, end its sessions and revoke its tokens. A supplier's engineer is disabled the same day the supplier tells you, and the supplier must tell you within 1 working day by the pack's default. Change every shared, service and break-glass credential the person could read within 1 working day.

• Then: Was any account used after the work ended?

Decision

Was any account used after the work ended?

Look at each system's sign-in log for the period between the end of the work and the removal. In the pack's example the log of a warehouse account removed late showed no sign-in after the last working day. If the logs do not cover the period, you cannot rule use out.

• Yes, or not known: Report it as a possible security incident
• No: Record the removal times; the month end checks again

Outcome

Report it as a possible security incident

An account used after its owner left is reported through your incident route. Keep the account and its logs unchanged, and export the sign-in log before anything else is done to the account.

Outcome

Record the removal times; the month end checks again

Record each removal time on the leaver checklist and in the provisioning log. At the month end the reconciliation compares every non-employee's accounts with the sponsor register and lists any that survived, and a repeated cause goes to the process owner as a process weakness.