The Control Register: Auditing Digital Ownership Before a UK Supplier Exits

When a marketing agency, web developer or IT supplier leaves, most businesses focus on the closing invoice and the immediate service gap. The greater risk is often quieter: the domain is still registered in the supplier's name, the analytics property has no internal administrator, the advertising account is tied to a former contractor's email address, or the licence is held by the agency rather than the company. The work appears finished, but control has not actually changed hands.

For UK SME owners, digital handover should be treated as a governance event, not merely a technical migration. The question is not only whether the website still loads or the software still opens. It is whether the company can prove, without relying on a departing supplier's goodwill, that it owns, administers and can recover its digital estate.

Begin with a control register, not a password list

A password list is useful but incomplete. Passwords can be changed; ownership records cannot always be corrected quickly. Before any exit conversation, build a control register that records each digital asset and the person or organisation that holds legal, operational and financial control over it.

At minimum, the register should cover:

• domain names and registrar accounts;
• DNS hosting and zone records;
• website hosting, content management systems and deployment accounts;
• email domains, mailboxes and authentication records;
• analytics, search console and advertising accounts;
• payment gateways and connected financial integrations;
• software licences, subscriptions and renewals;
• source code repositories, API keys and integration credentials;
• backup systems, cloud storage and data export routes;
• security tools, certificates and monitoring services.

For each item, record the account owner, the billing contact, the administrator list, the recovery email address and the two-factor authentication method. A surprising number of disputes arise because the company can use an asset but cannot recover it.

Apply three tests of control

A practical audit distinguishes between three forms of control. All three matter, and a supplier may hold one without holding the others.

Legal control is who the registrar, platform or licensor recognises as the account holder or registrant. For a domain, this is not the same as the person who can edit DNS records. If the registrant organisation is the agency, the company may have operational access while lacking legal control.

Operational control is who can administer users, change settings, publish content, approve integrations or export data. Shared logins obscure this. Named administrator accounts, preferably on the company's own domain, make it visible.

Financial control is who holds the payment method and renewal responsibility. A supplier may pay for a service and recharge it, which is commercially convenient but can leave the company exposed if the relationship ends abruptly. Where the asset is business-critical, the company should generally hold the billing relationship or have a documented transfer route.

The audit should test each asset against all three. If the answers differ, that is a finding, not a footnote.

Where exits commonly fail

Most handover failures are predictable. A developer registers a domain in a personal account because it is quicker at launch. An agency creates an analytics profile under its own organisation and gives the client view-only access. An advertising account is funded by the client but administered through a former employee's profile. A software licence is purchased in the supplier's name and treated as a client cost.

Data export alone does not cure these problems. Exporting a contact list or downloading a website backup does not transfer the ability to renew the domain, recover the account or remove the supplier's access. The exit is complete only when control has moved and the old access has been removed or reduced to an agreed support role.

Sequence the handover before notice is given

The strongest protection is contractual, but practical sequencing also matters. A sensible handover plan starts before notice is served and continues after the final invoice is settled.

First, agree an exit schedule as an annex to the supplier contract. It should name the assets, the transfer method, the responsible individuals and the evidence to be provided. Second, create company-owned administrator accounts before access is removed. Third, transfer registrar, DNS and billing control, then move administrator roles and integrations. Fourth, export data in a usable format and confirm that the company can restore it. Fifth, transfer or reissue licences in the company's name. Sixth, remove former users, rotate credentials and revoke API keys. Finally, monitor for unexpected changes after the exit.

The order matters. Removing a supplier's access before the company has its own recovery route can create a different operational risk. The aim is a controlled transition, not a sudden lockout.

Keep an evidence pack

A handover is only as good as the record that proves it happened. Keep a dated evidence pack containing registrar and account ownership records, administrator lists before and after the transfer, data export confirmations, licence transfer or cancellation records, credential rotation logs and written confirmation that former access has been removed.

This pack should be retained with other governance records. It supports continuity if a dispute arises and helps a new supplier or internal manager understand the estate without reconstructing it from memory. For personal data, the pack should also record what was returned, what was deleted and what retention obligations apply under UK GDPR.

Write the exit into the contract

A digital handover clause should not be left to general cooperation language. The contract should require the supplier to maintain a current asset register, use company-owned accounts where practicable, disclose administrator access and cooperate with an exit plan. It should set out data return and deletion obligations, licence assignment or termination, and the evidence the supplier must provide.

Payment terms should be aligned with handover milestones rather than used as the only lever. A final invoice can be disputed, but a domain can expire. The contract should make control transfer a defined deliverable, not an afterthought.

For UK SME owners in 2026, the practical test is simple: if the supplier disappeared tomorrow, could the company recover every critical account, prove ownership and continue operating without relying on the departing party? If the answer is uncertain, the control register is the place to start.