Supplier offboarding

Ending a contract is not the same as removing a supplier.

Their accounts still work, their API keys are still valid, their VPN access is still configured, their integration still runs and their copy of your data still exists. Offboarding is a checklist nobody owns, which is why access belonging to suppliers you stopped using years ago is such a consistent audit finding.