Change all admin passwords (servers, routers, switches, remore access, firewalls)
Remove all firewall rules for remote access for the IT manager.
If you are using security tokens, disassociate the IT manager's token(s) from all access. Remove TACACS access (if you use this).
Make sure to do these changes with the IT manager in a conference room or otherwise under physical control, so s/he can't observe the process. While reading a poassword as it's being typed on a keyboard is non-trivial (not hard, just not trivial), if this needs to be repeated, there's a higher risk of teh password being gleaned.
If possible, change locks. If keys can be replicated (and in short, they can), this will stop the IT manager from gaining physical access afterwards. Disable any passcard you cannot account for (not only card(s) you know have been issued to the IT manager).
If you have multiple incoming phone lines, check ALL of them, to make sure no unknown devices are attached to them.