Hook five: the return
Ending a social media management arrangement
To end an arrangement with an outside manager, remove their access and change any login they knew on the day the work stops, then collect the files and creative the agreement says are yours. The Australian Cyber Security Centre’s handbook says access for external providers should be removed when it is no longer needed, and login details changed when people leave.
General information. This is general information, not legal or technical advice for your own situation. The Australian Cyber Security Centre, business.gov.au and IP Australia are the places to check.
Before the last day: read the termination clause
business.gov.au suggests a termination clause that covers the situations it applies to, how much notice is needed and how to give it, what money is payable if the contract ends, and what happens to other obligations, such as confidentiality or intellectual property. If the agreement has one, it sets the date the keys come back and what comes back with them. If it has none, the agreement guide shows what one usually holds.
If the arrangement is ending over a problem with the work, business.gov.au says hirers should give contractors a notice to remedy, so the contractor has a chance to put the work right before the hirer pursues a remedy for breach of contract. It also says you should try to resolve a dispute before taking legal action.
On the day: take the keys back
- Remove the manager’s own access. The handbook says to remove access promptly when staff leave, and to review access permissions especially when people change roles or leave. For an external provider it says the same: remove access when it is no longer required.
- Change every password they knew. business.gov.au’s advice for social media is to change your passwords when a staff member leaves the business. The handbook adds: “Update or change key logins when you have staff turnover.” Start with the shared logins in your register.
- Check the recovery details and second factor. A new password can be undone if the recovery email, or the phone that receives the code, still belongs to the manager. The ACSC counts recovery details changed without permission among its warning signs, so confirm both point to the business.
- Remove connected tools you no longer use. For cloud services the handbook says to review administrator access regularly and remove unused accounts or third-party integrations. A scheduling or reporting tool the manager connected to your accounts is the same kind of link to look for.
- Verify before you act on handover messages. The ACSC says not to action unusual or unexpected requests without verifying them, because cybercriminals can pretend to be a customer, colleague or supplier. A message asking for a code or a password “to finish the handover” deserves a call to a number you already hold.
- Update the register. The handbook asks for a record of shared accounts and who has access. Mark the date the manager’s access ended and the date each password changed.
The files that should come back
IP Australia’s list of what a written contract with a contractor should define includes “obligations to return copies of IP if or when work ends.” What the business can ask for depends on what its agreement says about ownership. IP Australia says that “in Australia, IP created by a contractor is the property of the contractor unless otherwise stated in the contract”.
| If the agreement… | What the sources say |
|---|---|
| assigned copyright to the business in signed writing | An assignment of copyright “does not have effect unless it is in writing signed by or on behalf of the assignor.” |
| gave the business a licence | A licence is permission to use, but not own, the IP. |
| said nothing about it | The contractor owns IP they create, unless the contract says otherwise. Video can differ: under section 98(3) of the Copyright Act, a person who pays for a film to be made under an agreement owns its copyright “in the absence of any agreement to the contrary”. Anything else moves only by assignment, which needs signed writing from the owner. |
Confidentiality is settled the same way. business.gov.au’s termination checklist asks what happens to other clauses and obligations, such as confidentiality, when the contract ends, so the answer should already be in the agreement.
In the weeks after: watch the door
The handbook suggests reviewing access logs regularly to spot unusual or unauthorised behaviour, and setting up alerts for suspicious activity such as repeated failed login attempts. The ACSC’s warning signs of account compromise include:
- logins at unusual times, in unfamiliar locations or with unknown devices;
- an unexpected password reset notification, or an attempted login from a strange location;
- being unable to get in although your login details are correct, or being logged out on all devices without doing it yourself;
- your account provider, friends, family or colleagues telling you about suspicious activity.
If one of those appears, the handbook’s advice is to change passwords suspected of being compromised. Two related hooks: giving access, for setting up the next manager well, and reviews, if the business is now answering customers itself.
If the business suspects that its own or a person’s identity details have been misused, eSafety names the Australian Cyber Security Centre as a place to report identity theft or fraud, and says IDCARE, the national identity support service for Australia and New Zealand, can help with the consequences, free to the community.
With the register updated and the passwords changed, the business holds every key again, and the next arrangement can start from a clean board.