An offboarding access checklist is one page listing everything a departing person has, worked through in a fixed order, with a named person confirming each line and a date written next to it. Start with the primary identity account, then the applications that do not use it, then shared credentials, then physical items. Close it out with a completion date and the initials of whoever finished it, and file it with the person’s onboarding sheet.
This article is general information about process and recordkeeping. It is not legal, employment, compliance or security advice. Anything that touches employment terms, final pay, notice periods, a disciplinary process, or what may be monitored on an issued device belongs with an employment attorney and your organization’s HR advisors. Which obligations apply to you varies by organization, industry and jurisdiction.
What goes on an offboarding access checklist
The list is a mirror of what was granted. If you kept an onboarding sheet, the departure sheet writes itself: every line that was granted is a line to revoke or collect. If you did not, you are rebuilding the list from memory, which is the main argument for keeping the onboarding record in the first place.
Four blocks, in this order:
- Identity. The primary work account, its second factor, and every group or role membership attached to it.
- Applications outside that identity. Anything with its own separate login, including tools bought by a single team and anything connected through a personal account.
- Shared and standing credentials. Anything the person knew that is not tied to their name: shared mailboxes, a shared service login, a door code, an alarm code.
- Physical items. Laptop, phone, badge, keys, removable storage, printed material, and anything with an asset tag against their name.
The block people forget is the third. Individual accounts get revoked because they are visible in one place. A shared code the person simply knew is invisible, which is why it has to be a written line on the sheet rather than something you hope to remember.
Work the offboarding access checklist in a fixed order
Order matters because the first step makes the rest easier and because working the same sequence every time is what stops lines getting skipped.
- Disable the primary identity account and end active sessions. Disable rather than delete. A disabled account keeps the audit trail, keeps file ownership intact, and can be re-enabled if a handover question comes up.
- Remove group and role memberships. Record which groups they were in before you remove them, because that list is what you need if work has to be reassigned.
- Revoke the separately-logged-in applications, one named line each. Work from the onboarding sheet and from your application inventory, not from recall.
- Change shared credentials and codes the person knew. Each one gets its own line with the date it was changed.
- Collect physical items and check each asset tag against the record rather than counting items.
- Reassign ownership of files, mailboxes and scheduled jobs to a named person, so nothing is orphaned behind a disabled account.
- Handle the mailbox and calendar according to whatever your organization has already decided for departures. Set the decision once in writing rather than improvising per person.
- Close the sheet with a completion date and initials.
Disabling first is the single highest-value habit on the list. Everything after step one can take days without the list being in a worrying state.
Who confirms each line
One named confirmer per line, recorded as a role rather than a person. The useful split is between the person who performs the action and the person who confirms it is done, and on a small team those can be the same individual as long as the sheet says who it was.
| Line type | Who performs it | Who confirms | Recorded on the sheet |
|---|---|---|---|
| Primary account disabled, sessions ended | Whoever administers identity | The person’s manager | Date, time, performer initials |
| Group and role memberships removed | Identity administrator | Manager | Groups removed, date |
| Separate application access | The owner of that application | Manager | Application name, date |
| Shared credentials and codes | Whoever holds that credential | Manager | Credential changed, date |
| Equipment and badge returned | Whoever holds the inventory | Manager | Asset tag, condition, date |
| File and mailbox reassignment | Identity administrator | Receiving owner | New owner name, date |
Give the whole sheet a single owner. Distributed responsibility with no owner is how a departure sits half-finished for a month. The owner does not have to do the work; they have to be the person whose job it is to see every line dated.
The cases that do not fit the standard list
Most departures are routine and the standard sheet covers them. Three cases need a decision made in advance rather than in the moment.
Someone who had elevated permissions
If the person held administrative rights, add two lines: confirm the administrative accounts are disabled individually, since those are often separate from the primary account, and change any shared administrative credential they held. Note both with dates.
Someone moving internally rather than leaving
A mover is not a leaver, and treating them as one causes real disruption. The right handling is a separate short sheet: grant the new role’s default set, then remove the old role’s memberships, and record both. The common failure is doing the first half and never the second, which is how permissions accumulate across a career.
A departure that is not routine
Where the circumstances of the departure are sensitive, the sequence and timing are not a process question. Agree the approach with an employment attorney and your HR advisors before you act, and keep the record factual and limited to what was revoked and when.
The dated record that closes it out
The closing record is the whole point of the exercise. It should let someone six months later answer three questions without asking anyone: what did this person have, when was each item removed, and who confirmed it.
Keep it to one page:
- Name, role, last working day.
- One line per item, with the action taken, the date, the performer and the confirmer.
- Asset tags collected, with condition noted.
- Any line deliberately left open, with the reason and the date it is expected to close.
- A completion date and the initials of the sheet owner.
That fourth bullet matters more than it looks. There is almost always one line that cannot be closed on the day, usually a piece of equipment in transit. An open line with a reason and a target date is a managed record. An open line with nothing next to it is just an unfinished sheet.
File the closed sheet alongside the onboarding sheet for the same person, so the pair reads as a complete history. When you later reconcile an application’s user list and find an account you do not recognize, the paired sheets are what tell you whether it was missed or never existed.
Keeping the offboarding access checklist honest
Review the checklist twice a year and after any departure that exposed a line the sheet did not have. Add the missing line immediately rather than noting it for later, because the next departure is the only test that matters.
One lightweight reconciliation makes the whole thing self-correcting: once a quarter, pull the user list from your two or three most significant applications and compare it against current staff. Anything that does not match is either a sheet that was not finished or a line that was never on the sheet. Either way you learn something and fix it in the same sitting.
The benefit of all of this is a clean, retrievable record and a predictable process, not a guarantee. Predictable is enough, and it is achievable with one page and a fixed order. For a printable version of this sheet and the matching arrival list, see the Free Resources page on this site.