A practical employee exit checklist for ending access, protecting records, and keeping the business running.
Key Takeaways:
- What should an employee offboarding checklist include?
- How quickly should access be revoked?
- What access can remain after an account is disabled?
The farewell message is sent. The laptop’s back. But who owns the automation still moving client data, and can the former employee still open the vendor portal?
An employee offboarding checklist needs to cover every access path and business responsibility tied to that person.
That takes coordination across HR, the manager, I.T., and operations. Done well, it protects company information while giving colleagues a clear, respectful handoff.
Need to check what your exit process misses? Call (855) 965-3231 or contact our team to discuss your offboarding controls.
What’s my action item? Pick one recent departure. Can you prove access ended and someone took over the work?
What Should an Employee Offboarding Checklist Include?
Build the checklist around eight essentials:
- Departure type, last working time, and approved access cutoff.
- Named decision-makers, task owners, and one accountable coordinator.
- Inventory of accounts, apps, sessions, credentials, devices, and physical access.
- Account disablement and active-session revocation.
- Equipment recovery and authorized device controls.
- Record retention and approved data transfers.
- New owners for customers, vendors, workflows, and automations.
- Completion evidence, unresolved exceptions, and follow-up.
Use it for resignations, terminations, retirements, and contractor exits. For internal transfers, remove access the new role doesn’t need.
What’s my action item? Give each task an owner, due time, completion status, and evidence field.
Agree on the Access Cutoff
Sofia Martinez, owner of Sparkly Maid Austin, keeps the timing decision with the business:
“The manager and I determine when their access needs to be disabled. This decision should not be handed off to IT. It’s a business-side decision.”
HR and leadership approve the cutoff; I.T. prepares to execute it. Involve legal counsel when needed.
Match the plan to the departure:
- Planned exit: Inventory access and arrange handovers before the cutoff.
- Immediate or high-risk exit: Coordinate digital and physical access removal with the separation meeting.
- Contractor exit: Include vendor, guest, and project accounts outside normal HR records.
- Internal transfer: Review old-role permissions before adding new ones.
What’s my action item? Record the cutoff, time zone, and person authorized to trigger it.
Give Each Team a Clear Responsibility
One coordinator should follow every unfinished item through to resolution.
- HR confirms the departure, triggers the workflow, and limits disclosure of sensitive details.
- The manager identifies access, records, customers, and unfinished work needing reassignment.
- I.T. or the managed I.T. provider removes technical access, secures devices, transfers approved data, and records results.
- Operations recovers equipment, badges, keys, and cards, including remote return logistics.
- Legal/compliance guides retention, privacy, monitoring, notifications, and any requirement to preserve records.
Clear instructions make a difficult transition easier for everyone. A closed I.T. ticket doesn’t settle an unreturned badge or an unassigned customer account.
What’s my action item? Name the person who’ll review exceptions and authorize final signoff.
Inventory Access Beyond Email
Single sign-on (SSO) lets one company identity access multiple apps. Separate logins need separate attention. Check:
- Email, shared mailboxes, calendars, cloud storage, and team sites.
- SSO groups, directory roles, local accounts, and administrator access.
- Cloud apps with their own logins, including employee-chosen tools.
- OAuth grants: permissions that let connected apps access company data.
- VPN, remote desktop, wireless, servers, databases, and development tools.
- Password vaults, shared credentials, recovery codes, and API keys used by software.
- Finance, payroll, banking, CRM, benefits, insurance, compliance, and vendor portals.
- Social media, websites, domains, advertising, and analytics accounts.
- Personal devices, removable media, and downloaded or synced company files.
- Keys, badges, alarm codes, payment cards, vehicles, and paper records.
Ask what the employee actually used. Account reports alone won’t reveal every tool a department adopted.
What’s my action item? Compare account reports with expenses, password vaults, vendor records, and the manager’s list.
Block Sign-In and Revoke Sessions
Disabling the main account is only one access control.
A session keeps someone signed in; a refresh token can obtain renewed access without another login. Microsoft explains that logout timing depends on the application.
An app may issue its own session token that the central identity system can’t directly revoke. Follow the app’s offboarding procedure too.
Have I.T.:
- Block sign-in at the approved cutoff.
- Revoke refresh tokens and sessions where supported; verify app-specific logout.
- Remove groups, roles, delegated permissions, VPN, and remote access.
- Remove the departing user’s authentication and recovery methods as appropriate, while keeping accounts blocked.
- Disable separate app and local accounts.
- Review connected-app permissions and revoke unnecessary grants.
- Review recent sign-in and administrator activity for unresolved concerns.
What’s my action item? Ask which apps require separate security access controls and how I.T. verifies revocation.
Rotate Shared Secrets and Reassign Ownership
Removing someone from a password vault won’t erase passwords they already know.
Review shared access:
- Rotate exposed shared passwords, alarm codes, recovery codes, and relevant API keys.
- Remove vault membership and delegated mailbox, calendar, file, and admin permissions.
- Assign new owners for domains, websites, cloud resources, social accounts, and integrations.
- Update service-account credentials and dependent systems together to avoid breaking workflows.
- Replace sole approvers, billing contacts, recovery contacts, and vendor administrators.
Anthony Guerriero, managing partner of Manhattan Miami Real Estate, discovered an overlooked automation after a departure:
“Someone had built an automation that was still running after they were gone, still touching client data, and nobody could tell me who owned it.”
What’s my action item? Identify sole-owner systems. Transfer or safely suspend them without delaying a required access cutoff.
Secure Devices and Company Data
Recovering equipment and controlling its data are separate tasks:
- Reconcile company laptops, phones, tablets, storage devices, and peripherals.
- Arrange returns; lock, locate, or wipe managed devices when authorized.
- Remove company data from managed personal-device apps where supported and authorized.
- Preserve required records before wiping devices or deleting accounts.
- Transfer approved mailbox and file access to authorized successors.
- Record returned, missing, damaged, locked, or wiped assets.
A remote wipe can remain pending while a device is offline. Follow retention requirements and document unresolved data exposure; don’t assume a submitted command proves completion.
What’s my action item? Match returned equipment and confirmed device actions against the inventory.
Connect these steps to your cybersecurity implementation plan so departures follow a repeatable process.
Keep Work Moving After Access Ends
Before deleting accounts, confirm who’ll handle:
- Customers, vendors, projects, approvals, and support requests.
- Business files and records.
- Mail, phone numbers, calendars, and incoming inquiries.
- Dashboards, scheduled reports, automations, and integrations.
- Critical knowledge and approved follow-up questions.
Give successors only the access they need, with review dates. Confirm retention and transfer requirements before reclaiming licenses; don’t keep a former employee’s login active for convenience.
What’s my action item? Have each successor test an essential task using their own authorized access.
Verify Completion and Preserve Evidence
Ivan Vislavskiy, CEO and co-founder of Comrade Digital Marketing Agency, recommends a second person check the results:
“Checking the list that you did yourself is not verification.”
Before signoff, record who did each task, when, and the supporting evidence. Check:
- Account, app, remote-access, device, and physical-entry status.
- Sign-in logs or administrator reports where available.
- Receipt of transferred data and responsibilities.
- Returned assets and confirmed lock or wipe results.
- Credential rotation, without putting secrets in the checklist.
- Open vendor actions or exceptions, with owners and deadlines.
Follow up after the cutoff for delayed removals, unexpected mail forwarding, license issues, or missed transfers. Improve the checklist whenever a departure reveals a gap.
What’s my action item? Ask someone other than the task executor to verify high-risk access removals.
Common Offboarding Gaps to Avoid
- Treating a disabled email account as a completed exit.
- Missing sessions, connected apps, or separate logins.
- Overlooking contractors, guests, or old-role permissions.
- Leaving shared passwords or recovery methods unchanged.
- Deleting records or accounts before retention and transfer checks.
- Recovering one device while leaving synced data elsewhere.
- Leaving systems without an active business owner.
- Assuming I.T. knows every tool a department uses.
- Signing off while access-removal exceptions remain unresolved.
What’s my action item? Add a verification step for the gap most likely in your business.
Frequently Asked Questions
1. How quickly should access be revoked?
At the approved last authorized access time. Prepare in advance; coordinate immediate exits with the separation meeting.
2. What access can remain after an account is disabled?
Existing sessions, separate app logins, shared credentials, local accounts, and physical entry may remain. Downloaded files need separate data controls.
3. Should a former employee’s account be disabled or deleted?
Block access first. Preserve required records and transfer ownership before deletion, following platform requirements and company retention policy.
4. Who owns employee offboarding?
HR starts it, business owners define needs, and I.T. executes technical steps. One coordinator verifies completion across teams.
Make the Exit Verifiable
A professional departure protects the business and respects the person leaving.
It’s complete when access has ended, records and responsibilities are accounted for, and evidence supports the signoff. Keep unresolved exceptions visible until they’re resolved.
What’s my action item? Audit one past departure and fix any gap you can’t explain with evidence.
Audit Your Offboarding Process
At Attentus Technologies, taking ownership means following through on the details. Our managed I.T. services help coordinate the technical work behind secure employee departures.
Audit your offboarding process with our team to identify access and ownership gaps before the next exit.