A colleague of mine had some very privileged access to sensitive information, that was kept in remote machines with no internet access whose files could not be copied to local machines.
He quit the company for a new job, and there was some trouble in the transition when he left.
One point that seemed obvious to me, but other people in the company seem not to agree was:
I believe the severing of his accesses should not have been discussed with him.
Part of this was because some of his accesses were made through methods that were not agreed upon (pretty sure he was never authorized deploy them). And it may not have been clear to everyone that this happened. The area's director was informed and took no action in the past, he claimed now not to have understood the situation before.
But also, I feel like talking to a person on how you cut his privileges is somewhat lack of professionalism, like telling to his face "I don't trust you, so I'm concerned you might want to do something bad". Or otherwise you may be giving a final chance for the person to collect some collateral: "Hey, just letting you know that tomorrow you won't be able to access that classified info, so steal it now if you forgot to do so before!".
Are there known practices or guidelines for this situation? Is the correct approach to discuss with the person or not?
I've mentioned that he had unauthorized accesses to a shared machine with sensitive info, which was supposed to be accessible only from computers at the company's VPN. I'm not so sure myself how this came to be, but while one authorized connection to the machine was being severed (and the leaving person was the one who set it up), it was found out that there were at least three unauthorized firewall exceptions. It was also seen at some point that he could remotely access the machine from anywhere and copy sensitive files, which should be impossible even for machines in the company. Hence there was at least this malpractice in his record, even if it does not (necessarily) cause a breach of trust. Also, we do have IT people who are generally responsible for this sort of stuff and have their procedures, but this employee was not with the IT team.