What happens to passwords when someone leaves?

Two separate problems, and businesses usually handle the first and forget the second.

Their own accounts. Straightforward. We disable the account, revoke active sessions and tokens rather than only resetting the password, and remove access to cloud services. Minutes of work once we are told.

Shared credentials they knew. This is the hard part. The bank login, the vendor portal, the alarm code, the Wi-Fi password, the account at the supplier. Those do not change when their account is disabled, and in most businesses nobody can produce a complete list of what one person knew.

With a password manager, that list is exact. We can see which shared folders they had access to and change exactly those credentials, rather than either changing everything or hoping.

Without one, the honest advice is to change anything you can think of, accept that the list is incomplete, and use the experience as the reason to fix it before the next departure.

For a difficult exit, tell us before the conversation happens rather than after. We can be ready to cut access while it is taking place, which is a normal precaution and protects the departing person too.