A director leaving a business can create more than an HR or governance issue. It can create an immediate payment risk.
Many companies focus on recovering a laptop, changing an email password, and updating internal records. They may overlook banking portals, payment platforms, approval apps, registered devices, security tokens, supplier systems, and shared finance inboxes.
If a former director can still view balances, approve transfers, add beneficiaries, or receive payment notifications, the business remains exposed.
This risk is not limited to hostile departures. A former director may have no intention of causing harm, but access that is no longer needed can still lead to mistakes, missed alerts, or an unclear audit trail. A structured exit process protects the business, the remaining directors, and the person who has left.
Start With a Clear Payment-Access Inventory
The first task is to identify every system through which the former director could initiate, approve, view, amend, or receive information about payments.
This should include the obvious systems, such as business bank accounts, payment providers, corporate cards, foreign-exchange platforms, and accounting software. It should also include less obvious access points, such as:
- Banking applications on personal or company phones.
- Physical security tokens and card readers.
- Shared finance email addresses.
- Payment approval notifications sent by SMS.
- Supplier portals that store bank details.
- Expense-management platforms.
- Payroll systems.
- Cloud-storage folders containing payment files or bank statements.
- Password managers and shared browser profiles.
The business should not rely on memory alone. A short access inventory will usually reveal systems that no one has considered for months.
For companies with multiple approval routes, it is useful to review the principles behind multi-user payment approvals and role-based controls before deciding who should retain access after the departure.
Remove Access Before the Formal Handover Drifts
There is often a temptation to keep a departing director’s access active “just in case” they need to help with a final payment or explain a previous transaction. This can turn a short handover into an open-ended risk.
Where possible, payment access should be removed on the director’s final working day. If there is a genuine business reason to retain limited access for a defined period, that access should be read-only and documented in writing.
The business should immediately:
- Remove the director from online banking user lists.
- Revoke payment-approval rights and transaction limits.
- Remove their registered phone number and email address from alerts.
- Disable app-based approval on their devices.
- Cancel or collect physical tokens, cards, and security devices.
- Remove them as an authorised contact with payment providers.
- Change shared passwords that they may know.
- Update access to cloud folders containing payment files.
A clear record should be kept of when each action was completed and who confirmed it. If a question arises later, the company should be able to show exactly when the former director ceased to have access.
Review Who Can Approve Payments Now
Removing one person’s access can create a different problem. The company may suddenly find that it no longer has enough authorised users to approve payments.
For example, a business may have required two directors to approve large transfers. If one director leaves, payments may become blocked until a replacement is added. A company could also discover that the remaining approver has a lower transaction limit than expected.
Before the former director is removed, the business should check:
- Whether there are enough active approvers for everyday payments.
- Whether approval limits are still appropriate.
- Whether any payment requires more than one sign-off.
- Whether backup approvers have been appointed.
- Whether banks and providers need updated board resolutions or signatory forms.
- Whether the remaining finance team understands the approval process.
This step is particularly important when payroll, supplier payments, tax payments, or customer refunds are due soon after the departure.
Protect Supplier Bank Details and Beneficiary Lists
A departing director may have been responsible for supplier relationships or beneficiary management. The business should therefore review whether they were able to add, amend, or delete payees.
It is sensible to run a short review of recent changes to beneficiary details, especially changes made shortly before the director’s departure. This is not an accusation. It is a sensible control that protects everyone involved.
The finance team should compare current bank details against recent verified supplier records and confirm that no unusual changes are waiting for approval. Any new payee or amended bank account should be checked through an independent supplier contact, rather than by replying to an existing email thread.
The company should also remove the former director from supplier communication lists where payment details, invoices, or remittance advice may be sent.
Update Banking Mandates and Company Records
Online access is only one part of the process. Many banks and payment providers still rely on formal mandates, authorised signatory forms, director registers, and corporate records.
A company should confirm that its external records match its internal position. Depending on the provider, this may involve submitting updated documents, board resolutions, identification documents, or proof of the new director’s authority.
The business should also check whether the departing director remains listed as:
- A bank account signatory.
- A beneficial owner or controlling person.
- A primary compliance contact.
- A payment-provider administrator.
- A card programme administrator.
- A contact for account-security alerts.
- A person authorised to discuss account information.
Delays in updating these records can cause payment interruptions later, especially when the bank requests a periodic compliance review.
Keep a Short, Defensible Audit Trail
A payment-access exit process does not need to become a long internal report. It does need to be clear.
A simple checklist should record the systems reviewed, the access removed, the person responsible, the completion date, and any follow-up action. It should also note whether there are outstanding payments, supplier changes, token returns, or mandate updates.
The board or remaining directors should receive confirmation that the checklist has been completed. This ensures that payment security is treated as part of the director’s exit, rather than as an informal task left between HR and finance.
Conclusion
A director’s departure should trigger a payment-access review as a matter of routine. The business must know who can see financial information, who can approve money leaving the account, and who can change the details that make payments possible.
Fast removal of access, sensible replacement planning, beneficiary checks, and a clear record of the handover can prevent a small oversight from becoming an expensive problem.
#PaymentSecurity #CorporateGovernance #BankingAccess #FinanceControls #BusinessRisk #PaymentApprovals #CruisePay
Recent Comments