BFD S1EP14 â Before a Team Member Holds the Keys
Clean transcript (lightly edited: name spelling fixed, paragraphs added, one in-recording editing note removed)
So it is Wednesday morning. My 15-year-old Kip, who plays competitive hockey, just got cleared to skate again after being out for six weeks. His team has one more big tournament this weekend in Detroit, and we leave Thursday afternoon. That would be tomorrow.
So I called his coach and I said, we have good news and more good news. Then I booked the hotel and laid out the plan for the next five days. Done. Yes, we will be there.
And here's why that was easy. Because I run my home, my life, and my business with the fire drills already done. Nothing was sitting there waiting to fall apart while I needed to leave town at the drop of a hat.
I'm attorney Tamsen Horton. Business moments are predictable. Panic is optional. This is your Business Fire Drill: Before a Team Member Holds the Keys.
Here's the part I realized I don't say enough. Yes, we run fire drills before the fire so that we stay safe. But the bigger perk, the real reason for me underlying all of it, is that it lets me say yes.
So if someone emails, "Hey, I had a cancellation. Could you be on my podcast this afternoon?" and their audience is millions of people I've been dying to reach. Or I'm invited to speak. Or a client you've always wanted to work with shows up. If your business is full of loose ends, the answer can unfortunately land with, "Ooh, let me get back to you." And then the opportunity could be gone. If everything is taken care of, your answer is, "Of course, yes." You're not only protected, you're ready.
So let's close one of the loose ends that quietly stops a lot of yeses. And that is someone else holding a key, or keys, to some or all of your business.
We're specifically talking about the offboarding experience, not onboarding someone. Although as you're listening, I am going to blend that in, because if we're talking about offboarding, then we simply reverse engineer it when we bring someone on board.
So here is how this fire alarm goes off. Someone leaves, on good terms or not, and nobody revokes their access the same day. Your social media VA still has the logins. Your developer still has admin on your hosting or your site. Your bookkeeper still has the bank portal.
Or it's worse. Someone decides to hold your credentials, your passwords, whatever the keys (we'll just call them the keys), as leverage, getting you to do something outside of the scope. There's more and more of this that I'm witnessing, people holding accounts hostage as a business model. Not a huge fan.
Or someone changes a password out of spite. Or you realize nobody has a full list of all of the people, all of the places, and all of the things that person could get into.
If you remember what I was chatting with you about yesterday (because I am recording these in real time), that was the episode about before you get locked out of social media. I'm still a Facebook admin on business pages for people I haven't worked with in 10 years. I am holding the key to someone's business. That is exactly why this matters.
Now, this lives in onboarding not done properly. Because if you are properly onboarding someone, you are keeping track of their hire date, the person, the places, and the things they have access to. You are maintaining all of those records. So where this begins smoldering is if that onboarding process is not zipped up.
And my favorite question, because we have to ask it: why do you have a smoke detector, or detectors, in your house? To warn you before there's a fire so you can get out safely. That's why I have it.
Now, I built one for your business. I called it the Smoke Detector. It is 11 questions. It will take about three minutes, and it will clearly show you which fires your business is most likely to have, including ones that may already be smoldering. The link is in the description.
The only thing I cannot do is take it for you. I have made it accessible, understandable, targeted. All of my creativity, all of my legal knowledge, the very best way I know how to do it. But I cannot take this for you.
When the fire alarm goes off, we need to ask ourselves: are we reacting, or are we, I am so tongue-tied today, responding?
Reacting can look like this. The offboarding process is really informal. "Hey, we'll get to it eventually." "Yep, we're all good here." Or a difficult departure, an angry, frustrated, irritated person leaving quietly or very loudly, becomes leverage. They can hold you hostage. They can leave things a really big mess before they walk out the digital door. And you end up in not just a public standoff about access and payment, but there could be far more disastrous consequences.
Responding looks very different. Every departure triggers the same checklist. And because you're running the checklist, you have a running list of all the people, all of the places, and all of the things they have access to. Revoking their access is simply checking off a list. No one is relying on personal, individual memory banks.
We're going to come back to the dog thing again. If you've been following along, you know this dog story is just so relevant. If you missed it, it first came up in the episode on before you get locked out of your email, and then it showed up again in before you lose access to social media.
When we got our first dog, the breeder told me, book the groomer every four weeks. I did that. And she said, great, good job. But you still have to know how to bathe your dog. They could get sick. They could roll in something they weren't supposed to roll in. Then what are you going to do? And I was like, oh, that makes a lot of sense. I guess I'm learning how to bathe my own dog.
The groomer is your team member. They have a specialty. They know how to get the job done. You hire them to get the job done. You rely on them to get the job done. And you still have to know how to bathe your dog. So you still have to know all of the people, all of the places, all of the things they have access to. The keys.
Which brings us to running the drill. D-R-I-L-L.
D: Don't react. If the team member or contractor is leaving under what I'll call hostile facts and circumstances, don't get pulled into a public standoff over access and payment. Revoke access immediately, every single time. If that means you shut down everyone's access because you don't know who has access to what, that is much easier. I'll use another metaphor: cancel the credit card. If fraud shows up on your card, the credit card company just, in one fell swoop, says, sorry, card's done. That's what we're talking about. So don't react in terms of back and forth with the person. And if they're doing things that are honestly illegal, holding things hostage, changing passwords, loop in an attorney ASAP.
R: Record everything. Keep a running list of exactly what each person has access to, which places and which things, and keep it updated forever. You create it when you bring them in, you update it when you modify it, and you update it when they leave your business in whatever capacity they were there.
I: Identify the real risk. Is this simply "I forgot to revoke," like the Facebook accounts I'm still an admin on? Or is someone actively trying to hold an account hostage, change passwords, do stuff that, I can't blanketly say it's all illegal, but they're bad actors. If you're thinking, whoa, this is wrong, loop in the attorney ASAP.
L: Lead with calm. Handle offboarding the exact same way every single time, no matter how the departure felt. We're taking emotions out of this. We are running checklists. We are moving through the process.
L: Lock in the lesson. Verify that every single access point for that team member is in fact closed. Not assumed, verified. Double-check the work. Make sure all of the locks have been changed and all of the doors are metaphorically closed.
If you're thinking, "I'm not sure who still has access to what," that is exactly what the Smoke Detector helps you find. Again, I can't take it for you, but I could build it for you, and I did. We have smoke detectors in our houses. My business is just as important, if not more important in some respects, because it funds all of the things that happen inside the house. And nobody had a smoke detector. So much like the person who's going first doesn't always have a map, I didn't have a map. I needed a smoke detector. I built it. I'm happy to share it with you. I just can't take it for you.
You're also going to build this before the fire. When your house is on fire, this is not when you go to the store for a fire extinguisher. You got the fire extinguisher when you moved into your house so that you would have it if an emergency happened. We're going to build your fire extinguisher before the fire, before you need it. Because once the fire starts, you call the professionals. Once your house is on fire, you don't go buy a fire extinguisher, you call the fire department. Same principle here.
Number one: a written offboarding checklist you use for every single departure, no exceptions ever.
Number two: a running access inventory. All the people, all the places, all the things that person has access to, updated any time access is granted, modified, or terminated.
Number three: access is revoked the same day for any termination or resignation, which has you updating number two.
Number four: no single key holder. Use shared or role-based admin so no one person holds the key. If someone can lock all of your digital doors, that's not good. We need at least two people with admin-level access, so that one person can't shut the whole thing down or turn the whole thing on.
Number five: contractor agreements. Independent contractor agreements that address all aspects of the work relationship, but specifically in this instance, the returning and deleting of access when the work ends.
If your fire is already burning, reset every credential that you know about right now. This is the same as when you report fraud to the credit card company and they just shut the card down. It's easier to stop future fires and charges on that card if they just shut it down. They don't wait for you to keep charging and say, "Hey, what about this?" Doesn't work that way.
If someone is intentionally withholding access, that may be a legal matter. Document it and talk to an attorney ASAP. Then rebuild your access list so you know your exposure: all the people, all the places, all the things they have access to.
And don't try to negotiate with someone who is exploiting what they have access to. If they're holding an account hostage, demanding payment before they release something, threatening to change a password, all of these things happen in my world. All of them. Loop in the attorney ASAP and don't do anything.
Which brings us to your Next Right Decision. You have three options.
One, do nothing. You already have same-day offboarding and a current access list. You're good.
Two, put this drill in place. If your offboarding process has been informal or delayed, start with the access list. All the people, all the places, all the things they have access to.
Three, you thought of a friend. Anyone with a team or independent contractors is one bad departure away from finding out somebody still had keys they shouldn't have. Send them the link to this episode. They will send you a thank-you note.
Any choice is valid. You are going to choose one.
Which brings me to your free homework for today. Make a list of every person who has access to anything in your business. Next to their name, write all the places and all the things they can get to. And then ask: should they still have these keys? Is this still appropriate given the nature of the work relationship? Or, oh, that's right, I quit working with them six months ago. I should probably turn that off.
Because here's the point of all of this. When the cancellation call comes, the tournament pops up, the big opportunity, the trip, whatever it is, you want to say yes without needing to think about what could fall apart. That is what these fire drills really buy you.
And I apologize for not making this explicit and saying it sooner. I forget. I say this to my family: I don't organize for the sake of organizing. I organize because nothing infuriates me more than when I can't find something. I don't plan fire drills because I like fires or because I like to save the day. That's not what it is for me. It's that I want to say yes. When something pops up in my world that I really want to do, or that someone I care about really wants to do, I want to be able to just say yes, and not have to go through any sort of process other than, you know, I put plans in place, but they're fun plans. I don't have to wonder, oh my gosh, is that taken care of? No.
So these fire drills are really yes drills. They just don't have the same ring. They really don't. But they're really yes drills. So consider yourself in the true inner circle, because you know that the fire drill is really a yes drill.
In order to have a yes drill, please run the Smoke Detector. The link is in the description.
Because business moments are predictable. Panic is optional. And say it with me: we're going to run the fire drill before the fire alarm goes off.
