Cross-border Trade
When a forwarding operator leaves, close access—not the shipment
A practical departure checklist for independent freight forwarders: transfer live shipment responsibility, remove access and verify that the replacement operator can work.
Treat departure as an operating change
An operator’s last day should not leave the forwarding desk choosing between an unattended shipment and an account that remains open indefinitely. Our recommendation is to manage two separate outcomes: transfer responsibility for the work, and remove the departing person’s access. Completing one does not demonstrate the other. A returned laptop is not evidence that a carrier portal account has been disabled; a disabled mailbox is not evidence that tomorrow’s collection has a new owner.
The US Federal Trade Commission recommends limiting access to what employees need for their jobs and having a departure or transfer procedure that removes access to sensitive information, terminates passwords and collects keys and identification cards. [1] For independent US forwarders, the practical application below is our operational recommendation, not a new freight-specific rule or a legal interpretation.
Map the accounts before the final handover
We recommend creating one departure record owned by the operations manager, with technical actions assigned to the authorised administrator or IT provider. Include company email, the forwarding application, document storage, remote access, accounting permissions and any customer, carrier or overseas-agent portals the person used. Record the account identifier and administrator contact, never the password. Add company devices, access badges and authentication tokens to the same checklist.
Do not assume every account follows the company’s main login. Ask each service owner whether access is centrally managed or must be removed separately. Where a portal administrator sits outside your business, request removal through the established support channel and retain the confirmation. Mark an unanswered request as outstanding rather than treating an email asking for removal as proof that removal happened.
Transfer shipment decisions, not somebody’s identity
Our recommended handover is a short register of live files: shipment reference, current stage, next action, relevant cutoff, unresolved instruction and replacement owner. Have the replacement operator confirm that they can open the necessary documents through their own authorised account. Include pending quotations, unresolved supplier queries and customer follow-ups where relevant. Use existing approval rules for any change in who can release instructions or approve expenditure.
The Netherlands National Cyber Security Centre recommends defining access by role, updating rights when people change roles or leave, and using personal rather than shared user accounts. [2] Applying that principle, do not hand a replacement the departing operator’s login. We recommend arranging authorised mailbox delegation or a monitored team contact where appropriate, with a named owner and review date, instead of leaving personal sign-in available for convenience.
Set a cutoff and account for shared access
Agree the access-removal time with the authorised manager and IT provider. The timing should reflect the departure circumstances and your business policies; the handover should not become an excuse for indefinite access. New Zealand’s NCSC recommends revoking access when staff leave, including cloud services and physical devices, and changing shared-account passwords when someone with access departs or no longer needs them. [3]
For a forwarding desk, our recommendation is to identify shared portal credentials, delegated mailbox access, recovery contacts and any company authentication methods associated with the departing person. Have the authorised administrator assess active sessions and application-specific access as well as passwords. If a shared credential supports an integration, identify the service owner and arrange a controlled change so an account cleanup does not unexpectedly interrupt shipment messages. Never copy credentials into the handover register.
Verify closure without destroying the working record
We recommend recording a completion time, responsible administrator and confirmation reference for each system. Ask the administrator to verify the actual account state using approved administrative tools. Do not test by asking a former employee to sign in, and do not circulate their credentials. Keep unconfirmed external-portal removals visible to the manager until the responsible provider confirms completion.
Separately, confirm that the replacement operator can find the latest instruction and explain the next action on each priority shipment. Preserve business records under your established retention and privacy arrangements; removing someone’s ability to sign in is a different decision from deleting their mailbox or shipment history. Refer employment, privacy, retention and regulated-access questions to the appropriate adviser or service owner rather than improvising a deletion policy during offboarding.
Practical actions for this week
Start with a tabletop review of one recent departure. Can the manager identify who inherited the live shipments, who removed each account and what evidence closed the checklist? Our recommendation is to record gaps without assuming misconduct, assign each gap to an owner and agree a completion date. Then use the same checklist for contractors and role changes, adjusting permissions to the work that remains authorised.
The useful finish line is straightforward: the former operator’s access is closed, the replacement can perform the next authorised task and unresolved exceptions have a visible owner. This AI-assisted article offers general operational guidance, not legal, employment, customs, privacy or specialist security advice. Use appropriately qualified professionals and your authorised system providers for those decisions.
Sources
- Protecting Personal Information: A Guide for Business — US Federal Trade Commission
- Basic principle 4: Limit access to data and services — Netherlands National Cyber Security Centre
- Responding to third-party data breaches — New Zealand National Cyber Security Centre
General operational guidance. Apply the approval and regulatory requirements relevant to your business and shipment.