What if our internal IT person has all the passwords and does not cooperate?

This comes up more than people expect, and not always with bad intent. Sometimes it is simple reluctance, sometimes it is someone who knows the documentation does not exist and is embarrassed, occasionally it is worse.

Either way we do not build a transition that depends on cooperation. Administrative access to systems your business owns can be recovered through the vendors and through ownership verification. Domains, Microsoft or Google tenants, licensing, and hosted services all have ownership recovery processes, and we run them regularly.

Where there is real concern about conduct rather than just attitude, sequencing matters. Credential rotation and access review happen before any conversation about their departure, not after, and we coordinate that quietly with you. That is a normal precaution in any transition, and it protects the employee too, because a clean cutover means nothing that happens afterward can be attributed to them.

Whatever the situation, the outcome is the same: your business ends up holding administrative ownership of its own systems, documented, which is where it should have been all along.