SSO and offboarding risk: the departed-employee account problem it actually solves

The actual risk SSO closes isn't a stolen password — it's a departed employee whose account in some specific tool was never deactivated, because offboarding was handled as a list of applications someone had to remember, and that list didn't include every tool the firm had quietly adopted over the years. With SSO, deactivating one account at the firm's identity provider cuts off access to every connected tool at once, including the ones nobody thought to check.

How offboarding actually fails

Most firms have a reasonably solid process for the obvious things: email gets disabled, the person's name comes off the engagement letters, HR closes the file. The audit software login is a separate decision, made by whoever remembers to make it, usually days or weeks after the person's last day — sometimes never, if the person was a seasonal reviewer or an articled clerk who rotated through and whose account nobody owned clearly in the first place.

This isn't a hypothetical. A mid-size firm running six to eight tools across audit, tax, workpapers, and a client portal will typically have at least one tool where a password-based account from a former employee is still technically active a year later. Nobody is using it maliciously — but it's sitting there, unmonitored, as a credential that still works.

What SSO changes about this specific problem

• Offboarding becomes one action — disable or remove the person at the firm's identity provider — instead of N actions across N tools.
• A tool the firm adopted two years ago and half-forgot about is still covered, because it was never a separate decision to begin with.
• The firm's IT or admin team doesn't need a current inventory of every connected application to offboard someone correctly.
• The audit tool itself needs no separate 'delete this user' step for the authentication side — though their engagement memberships and role still need the firm's own review, covered below.

What it does not fix

Turning off someone's identity-provider account stops them from authenticating. It does not retroactively clean up what they could see while they still had access, and it does not address role or membership changes short of full departure — someone who moves from associate to manager, or off one engagement and onto another, still needs the firm to actually update their role and engagement memberships inside the audit tool. SSO has nothing to do with that; it only ever governed how someone proved who they were, never what they were allowed to see once they were in.

Where this matters most

The risk scales with headcount, turnover, and the number of tools in use — not with firm prestige or revenue. A firm with five long-tenured staff and one tool has a small exposure here even without SSO. A firm running eighty engagements across two offices, with articled clerks rotating annually and staff turnover at the normal rate for the profession, has a real and recurring exposure every time someone leaves, and that is exactly the situation where 'disable one account centrally' beats 'remember to disable six accounts individually.'