The power of the checklist, Hodgson says, is that it makes a single person responsible for a whole series of security-related termination "transactions." "It goes beyond making sure that the employee hands in items such as his identity card and building pass, and that system access rights are rescinded, but also covers physical assets such as office keys, vehicles, cell phones and laptop computers," he says.

The lesson is clear. Managers may groan at the prospect of yet another administrative process being foisted on them, but today's procedures for separating organizations and employees are just too slipshod. BT's detailed checklist may strike some as overly prescriptive - but that's likely to be before they've suffered a significant breach by a former employee, not after.