The Leaver's Badge

A person leaves. Their credential should stop working, their biometric template should be deleted, their final hours should be reconciled, and the card itself should come back.

The credential problem in “The Leaver's Badge” also affects how time records are interpreted. When evaluating open the official page for internal transfer policy, administrators should keep identity, access control and attendance evidence distinct, document replacement and revocation, and let employees correct a record created by a lost or shared badge.

Four things, four owners, and on most sites no single person checks that all four happened. The result is the drawer of live credentials, the templates still on the server, and the occasional awkward discovery that somebody who left in March was still opening the side door in July.

For an independent benchmark relevant to “The Leaver's Badge”, consult the Fair Work record-keeping guidance. Use it to test notice, accessibility, security, recordkeeping, retention and exception handling against the real operating process rather than treating a device report as self-explanatory evidence.

Why the card itself is the least important part

The physical object matters less than the deactivation. A returned card that was never deactivated is worse than an unreturned card that was, and sites routinely chase the first while neglecting the second.

Put the deactivation on the leaving date and make it automatic where the system allows — a termination date in the HR record that propagates. Where it cannot be automatic, it belongs to whoever processes the leaver in payroll, because that is the one step that always happens.

The template, which is the step nobody owns

Biometric data has retention obligations in most jurisdictions, and the common position is that it should not be kept once the purpose has ended. Employment ending is the clearest possible end of purpose.

Almost no site deletes templates on exit. They sit in the system indefinitely, because deletion is not on anybody's checklist and because some systems make it awkward — the record is tied to the user, and deleting the user would break the historical attendance data. The answer is usually a separate purge function that exists and is never run.

Reconciling the last week

The final payroll run is the one where an error cannot be corrected next month. It is also the run most likely to contain a fallback entry, because somebody leaving has often already handed back a card or stopped being on the enrolment list.

Check the final period's entries specifically for second-method and override entries, and confirm them with the supervisor before the run rather than after. It takes minutes per leaver and it prevents the single most common final-pay dispute.

The list that makes it work

One leaver checklist with the four items, held by one owner, with a tick and a date against each: credential deactivated, template deleted, card returned or written off, final hours reconciled.

Not four separate processes in four departments. The point of a single list is that somebody can see which of the four did not happen, which is currently impossible because no one view contains all of them.

Who should hold it

Whoever already has a leaver process that reliably runs, which is almost always payroll, because the last payment concentrates the mind in a way that an access record does not.

Facilities and security then act on it rather than maintaining their own version. The common failure is each department holding a partial list and assuming the others are complete, which produces exactly the pattern where three of the four steps happen for everybody and a different one is missed each time.

The audit that finds the backlog

Match the active credential list against current employees, and the stored template list against the same. Both exports exist; neither is routinely compared.

Expect a backlog on the first run — on a mature site, credentials and templates for people who left years ago. Clear it, record that it was cleared and when, and then run the match monthly. The monthly run takes twenty minutes and it is the evidence that the process works, which is a different thing from the process existing in a document.

Dismissals and immediate departures

The ordinary leaver gives notice and the checklist has time to run. The difficult case is the person who leaves the building today: a dismissal, a walkout, a serious incident.

That case needs a short, separate path that can be executed in minutes by whoever is there — deactivate the credential now, delete later through the normal route. Without it, the deactivation waits for the paperwork, and the paperwork for an abrupt departure takes days. One phone number and one named role is the whole arrangement.

The leaver who is still on the system next year

The match between active credentials and current employees is the test, and the first time it is run the surplus is the accumulated leavers of several years.

It is worth presenting that number rather than quietly fixing it, because it is the clearest possible argument for the single owner this collection keeps recommending. Three departments each doing their part correctly produced a list of several dozen live credentials belonging to people who no longer work there, and no individual did anything wrong.