Exits Done Properly: Final Dues, Clearance & Access That Actually Ends
Exits are run on goodwill and a cake, and the parts that carry real risk — final dues, clearance, custody of company property, access that outlives employment — get done in the following weeks, by whoever remembers. A sequence that closes, and the two things most Kenyan employers discover too late.
Onboarding gets attention because it is optimistic and because somebody is waiting. Offboarding gets a checklist that lives in a document nobody opens, and it is executed in fragments — HR calculates the dues, the manager takes the handover, IT eventually disables something, and the laptop sits on a desk for three weeks because nobody is sure whose it is.
The cost is mostly invisible, which is why it persists. But two parts of it are not invisible at all: a final payment that turns out to be wrong, and a former employee who could still sign in a month later. Both are avoidable with a sequence rather than a document.
The exit has four workstreams, and they do not share a clock
Trying to run an exit as a single list is what makes it fail, because the four things that have to happen answer to different people and different deadlines.
| Workstream | Who owns it | When it must finish |
|---|---|---|
| Money — final dues and the last payslip | HR and payroll | By the final payroll run that includes them |
| Property — assets in their custody | Whoever maintains the asset register | On or before the last physical day |
| Access — logins, approvals, deliveries | HR with the system administrator | The last day of employment, precisely |
| Work — open tasks, tickets, approvals, projects | The line manager | Before the handover conversation, not after |
The dates genuinely differ, and the one that catches people out is access. The last day in the office and the last day of employment are different when someone takes terminal leave, works notice from home, or is placed on garden leave — and access should track the second, not the first.
The record you are about to need
Everything difficult about a final settlement comes from records that were never kept properly during employment, and it is always the same three: what the contract actually said, how much leave was genuinely left, and what the employee is holding.
-
The contract, in the file
Signed, with its terms, variations and any letters that changed them. A notice-period dispute is nearly always a dispute about which version of the terms applies, and the version in the file wins.
-
The leave balance, maintained continuously
Not reconstructed at exit. A balance assembled from memory and a WhatsApp thread during someone's final week is a negotiation, and the employee will remember the days they did not take rather more clearly than the days they did.
-
The custody list, current
Filter the asset register by custodian and you have the clearance list in five seconds. Without it, clearance is a memory exercise run by a person who is leaving.
-
The compensation record, with its history
What they are paid now and since when. Final dues computed on a superseded figure is the single most common cause of an exit dispute that reaches a lawyer.
Every difficult final settlement is a records problem that became visible at the worst possible moment. Nothing about an exit is hard when the leave balance and the custody list were true the day before the resignation arrived.
Final dues: state the components, not the amounts
A final settlement is not one number, and presenting it as one is how disputes start. It is a set of components, each of which the employee can check — which is exactly why itemising it protects the employer as much as the employee.
The shape of a final settlement — components, not a total
We state no amounts, rates or entitlements anywhere here. Which of these apply, and how each is computed, depends on the contract, on Kenyan employment law and on the circumstances of the exit — confirm with a qualified employment adviser. What the system contributes is the evidence behind each line, which is the part employers most often cannot produce.
Recoveries need a paper trail more than a calculation
Deducting for an unreturned laptop or an outstanding advance is where exits turn adversarial. Two things prevent that: the item was recorded as being in their custody at the time it was issued, and the deduction is disclosed in writing before the payment is made. A surprise deduction discovered on a final payslip is a dispute regardless of whether it was justified.
Access: the part that is wired, and the part that is not
This is worth being precise about, because it is the step organizations most often assume is manual when it is partly automatic — and partly automatic in a way that leaves a specific gap.
Where an employee record is linked to a login, terminating or archiving the employee revokes that login and clears its active sessions, so an in-flight session cannot outlive the change. Re-enabling access afterwards is deliberately a separate, explicit administrative action rather than something that can happen quietly. There is also a reconciliation view listing employees who are offboarded but still hold active access, which is the backstop for anything that slipped.
The gap: this follows the employee-to-user link. A contractor, consultant or administrator who was given a login without an employee record behind them is outside the mechanism entirely — nothing connects their departure to their access, and they will not appear on the reconciliation screen either. Those are the accounts that survive exits, and they need a named owner and a quarterly review. See logins, MFA and the leaver problem.
Reassign before you close anything
The sequence matters and it is the opposite of what urgency suggests. Revoking access first feels decisive and creates a mess: open approvals stall with an owner who cannot act, assigned tickets sit in a queue attributed to nobody, tasks lose their assignee, and assets stay in the custody of someone who has left.
- Pending approvals — reassign to whoever inherits the authority, before the last day.
- Assigned tickets and tasks — move to a named person, not to a team inbox that nobody owns.
- Assets in their custody — check each one in physically and on the register, on the last working day.
- Scheduled report deliveries and notification recipients — replace their address, or the report simply stops being read.
- Shared credentials they knew — third-party portals, the safe, the router. Their account being disabled does nothing about these.
- Only then: change the employment status, which closes the login and its sessions.
What we do and do not do
What AWRA OpsHub does today
- Employment status changes that revoke a linked login and clear its active sessions, with re-enabling as a separate explicit action.
- A reconciliation view of employees who are offboarded but still hold active access.
- Employee files with contracts and compensation history, so final dues are computed against evidence rather than recollection.
- A maintained leave balance rather than one reconstructed at exit.
- Approved overtime records available as payroll inputs for the final run.
- Asset custody by named holder, so the clearance list is a filter rather than a memory exercise.
What it does not do
- No offboarding checklist workflow. There is no guided exit process that walks an administrator through the steps and refuses to finish until each is done.
- No final-dues calculator. Notice pay, service pay and gratuity are not computed for you — the payroll run handles ordinary components, and the terminal elements are your policy and your adviser's determination.
- No automatic reassignment. Tasks, tickets, approvals and report recipients do not move to a successor by themselves.
- Nothing covers logins with no employee record, which is where most surviving access actually lives.
The absence of a guided workflow is why the sequence above is worth writing into your own procedure. Everything it depends on exists as a record; what does not exist is something that forces the steps to happen in order.
The exit interview nobody uses
One last thing, outside the mechanics. The departing employee knows which supplier overcharges, which control is routinely bypassed, which report is quietly wrong, and which colleague is about to resign. They are the only person in your organization with both the knowledge and no remaining reason to soften it.
Most exit interviews collect none of this because they are scheduled on the last day, run by the line manager, and shaped as a courtesy. Move it earlier, have someone other than the manager conduct it, and ask operational questions rather than emotional ones. It costs half an hour and is frequently the most useful half hour in the whole exit.
Our take
Keep the leave balance and the custody list true during employment and the exit stops being difficult. Then run the sequence in the right order — reassign work, recover property, disclose recoveries in writing, and change the employment status last so access ends on the correct date. Give one named person the quarterly job of reviewing logins that have no employee record behind them, because that is the gap nothing else closes.
See employee records and HR
Contracts and compensation history, maintained leave balances, approved overtime, asset custody by holder, and employment status changes that close a linked login.
Explore employee managementFrequently asked questions
Does the system calculate final dues?
It computes the ordinary payroll components for the final period against date-effective statutory rules, and it supplies the evidence behind each line — days worked, approved overtime, the leave balance, the compensation history. It does not calculate notice pay, service pay or gratuity, because whether those apply and how they are computed depends on the contract, the circumstances of the exit and Kenyan employment law. Confirm the terminal elements with a qualified employment adviser and record them as components in the final run.
When exactly should we disable access?
On the last day of employment, which is frequently not the last day in the office — terminal leave, notice worked from home and garden leave all separate the two. Changing the employment status revokes a linked login and clears its active sessions, so the date you record is the date access actually ends. Do the reassignment of work and custody first, because revoking access before reassigning turns every open item into an orphan.
How do we handle an employee who will not return company property?
The position is far stronger if the item was recorded as being in their custody when it was issued, which is the whole argument for maintaining the register during employment rather than at exit. Beyond that, disclose any intended recovery in writing before the final payment rather than presenting it as a deduction on a payslip, and take advice on what may lawfully be deducted — this is exactly the area where a defensible claim becomes a dispute purely through how it was communicated.
Is there a guided offboarding checklist in the product?
No — there is no workflow that walks you through the steps and blocks completion until each is done. Everything the steps depend on exists as a record, but the sequencing is yours. That is why it is worth writing the order into your own procedure, with one named owner: reassign work, recover assets, settle and disclose, then change the employment status last.
What is the most commonly missed step?
Two, and they share a cause. Scheduled report deliveries and notification recipients still pointing at a departed employee, which is how a weekly report quietly stops being read by anyone; and logins that have no employee record behind them — contractors, consultants, directly-created administrators — which no offboarding mechanism touches. Both survive because they belong to nobody. Assign the second to a named person as a quarterly review.
