Flags/Workflows for Terminated Users

When you terminate an employee (e.g. archive the user), a competitor product creates a workflow to 'flag' passwords accessed by that user so we can go in and change them. We would like this ability to audit which passwords they've accessed, change them after termination and clear the flag when done.
Maybe create a button to generate such a report and/or workflow from any active or archived user's page, as well as an option to do it when you're archiving a user. And also the ability to grant users/groups access to the workflow, and make the report printable/exportable to csv.
Thank you