When a staff member leaves, their access should be removed through the agreed offboarding process and identity controls. Historical audit information should remain attributable rather than deleting evidence of prior actions.