What it asks for. Security duties that continue after someone leaves or changes role, such as confidentiality obligations, should be defined, enforced and communicated to the person and to other relevant parties. The aim is to protect the organisation's interests during and after the transition.
In practice. Leavers and movers go through a documented process owned jointly by HR, line managers and IT. Continuing obligations are written into contracts or NDAs and restated at exit, with a signed acknowledgement where appropriate. Access no longer needed is removed on the leaving or role change date, and equipment and information are returned and checked against an asset record. An auditor will expect exit checklists, signed acknowledgements and evidence that access was revoked on time.
Common gaps. Role changes are the usual blind spot: people move teams and keep access from their old job for years. Contractors and temporary staff often bypass the HR process entirely, and continuing obligations are rarely reminded at exit.