1
Planning
Is one person clearly responsible for coordinating each employee offboarding?
A nominated owner should coordinate management, HR, payroll, IT, access removal, device recovery and final confirmation.
EMPLOYEE OFFBOARDING CHECKLIST
Is every former employee fully removed from your systems?
Review your employee offboarding process across accounts, applications, devices, business data, physical access and operational handover.
Accounts
Devices
Business data
Security
0 of 23 answered0%
2
Planning
Does IT receive sufficient notice before the employee's final day?
Advance notice allows account access, devices, business data and responsibilities to be reviewed before departure.
3
Planning
Is the employee's exact final working time confirmed?
Access removal should be aligned with the approved departure time, particularly for sensitive or involuntary departures.
4
Accounts
Is the employee's primary business account disabled at the correct time?
Microsoft 365, Google Workspace and other primary accounts should be disabled promptly when employment ends.
5
Accounts
Are active sign-in sessions and authentication tokens revoked?
Disabling an account alone may not immediately end existing sessions on browsers, phones or applications.
6
Accounts
Are the employee's MFA methods and registered devices removed?
Personal phones, authenticator applications, security keys and recovery methods should be removed from business accounts.
7
Accounts
Are administrator roles and privileged access removed immediately?
Global administrator, local administrator and other elevated permissions should be removed before or at departure.
8
Applications
Are all third-party business application accounts identified and disabled?
This may include CRM, accounting, payroll, project management, marketing, cloud storage and industry platforms.
9
Applications
Are VPN, remote desktop and remote-support permissions removed?
Former employees should no longer be able to connect remotely to business systems or devices.
10
Applications
Are shared passwords changed where the employee previously had access?
Shared supplier portals, social media accounts, service accounts and legacy systems may require password rotation.
11
Devices
Are company laptops, phones, tablets and accessories returned?
The business should confirm all issued equipment has been recovered and recorded.
12
Devices
Can company devices be remotely locked or wiped if they are not returned?
Managed devices should support remote action when equipment is lost, delayed or not returned.
13
Devices
Is business data removed from personal or BYOD devices where appropriate?
Business email, files, applications and managed work profiles should be removed without affecting unrelated personal data.
14
Data
Is the employee's mailbox handled according to an approved process?
The business should decide whether to retain, delegate, archive, forward or convert the mailbox based on operational and legal needs.
15
Data
Is ownership of important files and documents transferred?
OneDrive, Google Drive, SharePoint and other business files should be transferred to an appropriate manager or owner.
16
Data
Are important business records retained according to company requirements?
Customer information, project records, approvals and other business data may need to be retained after the employee leaves.
17
Access
Is the employee removed from groups, shared mailboxes, Teams and shared folders?
Distribution groups, security groups, SharePoint sites, Teams channels and shared drives should be reviewed.
18
Access
Are external guest accounts and cross-tenant permissions reviewed?
The employee may have access to client, supplier or partner systems that must also be removed.
19
Access
Are building access, keys, passes and alarm codes removed or recovered?
Physical access should be included in the same offboarding process as digital access.
20
Business Continuity
Is a business handover completed before the employee leaves?
Open tasks, customer responsibilities, supplier contacts, passwords and operational knowledge should be transferred.
21
Business Continuity
Are customers, suppliers and internal teams informed where necessary?
Relevant people should know who will take over responsibilities and where future communication should be directed.
22
Review
Does a manager or authorised person confirm that offboarding is complete?
The process should include a final review confirming access removal, device return, data transfer and operational handover.
23
Review
Is the completed offboarding recorded in a checklist or service-management system?
The business should retain evidence of actions completed, dates, responsible people and any outstanding items.
Please answer all questions to calculate your offboarding score.