When a Foreman Leaves: Offboarding Checklist for Contractors

A superintendent gives notice on a Friday, works out the week, turns in the truck keys, and is gone. Three months later the office is still getting Procore notifications addressed to him, his email is still receiving subcontractor invoices, and the login he used for the site cameras is the same one everyone still uses. Nobody did anything wrong. Nobody was assigned to do anything at all.

In an office business, a stale account is an embarrassment. In construction it is a financial exposure, because the people who leave are the people who approved pay applications, held the camera passwords, and sat on the email threads where money moves. Below is the checklist we run with contractors, split by what has to happen the same day and what can wait until the end of the week.

Same day: identity

Everything else hangs off the person’s company login, so it goes first.

Disable the Microsoft 365 or Google Workspace account rather than deleting it. Disabling blocks sign-in immediately and keeps the mailbox and files for whoever inherits the projects. In Microsoft 365, also revoke active sessions and reset the password; a signed-in phone will keep syncing mail for hours after the account is disabled unless you force the sessions out. Remove the account’s multi-factor authentication methods so the departed person’s phone cannot be used to approve anything.

Then decide what happens to the mailbox. Convert it to a shared mailbox and give the project manager taking over access to it, set an auto-reply naming the new contact, and leave it that way for the length of the longest open project. Do not forward mail to a personal address, and do not let the inbox sit live with nobody watching it. Invoices, lien waivers, and change orders will keep arriving there.

If the person had a company phone or laptop enrolled in device management, issue the remote wipe or retire command now, before the device leaves the building. If it was a personal phone with company email on it, use the app-level wipe that removes only company data.

Same day: the construction platforms

Project platforms are usually invited per project, often by someone at the general contractor or owner, so they are not tied to your email system and do not go away when the account does.

Go through each one and remove the person from every project and from the company directory: Procore, Autodesk Construction Cloud, Buildertrend, Bluebeam Studio sessions, the scheduling tool, the daily log app. Where the person was a project admin, transfer that role before removing them, or the next person will not be able to add anyone. Check the owner’s and general contractor’s portals too; if your super was added to a GC’s Procore project under a personal email years ago, that access survives everything you do in your own systems. Email the GC’s project engineer and ask for it to be removed.

Same day: anything that touches money

This is the part most contractors skip, and it is the part that costs the most.

Cancel purchasing cards and fuel cards issued in the person’s name, and check whether their login is tied to a card in the fuel network or the supply house account. Remove them as an approver in the accounting system and in any pay-application workflow. If they had authority to change vendor banking details or approve ACH batches, remove it today and tell the bank. Review the open pay applications they approved in the last 30 days, not because you suspect anything, but because the person who could answer questions about them is gone.

Why the stale account matters more than it seems

Business email compromise in construction rarely starts with a dramatic hack. It starts with an account someone can quietly sit in. An attacker who gets into an orphaned superintendent mailbox can read every draw request, every subcontractor payment thread, and every “please update our remittance address” exchange, for weeks, with nobody noticing because nobody is reading that inbox. When the moment is right, they send the email that changes where the money goes.

We wrote about a South Carolina town that wired $545,000 meant for its contractor to a fraudster using a lookalike domain. The pattern in that case and the others like it is the same: a trusted thread, a plausible request, and a payment process that trusted email. An unwatched account inside your own company is the easiest seat at that table.

Within the week: shared passwords and shared things

Construction runs on shared credentials in a way office businesses do not. One login for the site cameras because the camera system only supports one admin. The Wi-Fi password written on the trailer whiteboard. A shared “fieldops” email that four people use. The router password that has been the same since 2019.

Make a list of every shared credential the person knew, and rotate them: site cameras and their cloud accounts, trailer routers and access points, time clock admin logins, the shared mailboxes, the company’s accounts at the supply houses and equipment rental yards, the drone registration, the dumpster service portal. It is tedious. It is also the only way a shared password stops being a key the departed person still holds. Where a system forces a shared login, put the password in a password manager with access by role, so the next departure is a one-click revoke instead of a scavenger hunt.

Within the week: devices and data

Collect the laptop, tablet, phone, and any USB drives, and check them in rather than tossing them in a drawer. Before anything is wiped for reuse, confirm the project files that live only on that device have been copied to the project folder. Field staff keep photos, marked-up drawings, and daily logs locally more often than anyone admits, and a wiped tablet is a lost record if a dispute surfaces a year later.

Keep the disabled account and shared mailbox for as long as your retention policy and your contracts require. Project records are discoverable, and the cheapest way to have them later is to not delete them now.

The checklist

Same day:

• Disable the company account, revoke sessions, reset the password, remove MFA methods
• Convert the mailbox to shared, assign an owner, set an auto-reply
• Wipe or retire company devices; app-wipe company data on personal phones
• Remove from every project and company directory in Procore, Autodesk Construction Cloud, Buildertrend, Bluebeam, and the scheduling tool; transfer admin roles first
• Ask GCs and owners to remove the person from their portals
• Cancel purchasing and fuel cards; remove approval and banking-change rights; notify the bank
• Review pay applications and vendor changes they touched in the last 30 days

Within the week:

• Rotate every shared credential: cameras, routers, Wi-Fi, time clocks, shared mailboxes, supplier and rental accounts
• Move vendor and subcontractor portal accounts off personal emails
• Check in devices, recover local project files, then wipe and reissue
• Confirm retention of the mailbox and files per policy and contracts
• Record what was done and who did it

Assign the list to a role, not a person, so it still happens when the office manager is the one leaving. Put it on the same form as the truck keys and the final paycheck. If the list looks like more than your office can keep up with across every departure, it is one of the routine things handled under our construction IT support: accounts, devices, and shared credentials tracked from the day someone starts, so the day they leave is a procedure instead of a scramble.