Offboarding Access Deprovisioning Coordination Checklist

This template covers the coordination steps needed to remove an employee’s access at offboarding, including identity accounts, SaaS logins, VPN, email, shared drives, badges, and company devices. It is designed to track both the request and the verification step so nothing is assumed complete. It also helps document who owns each action, which is important when HR, IT, Security, and Facilities all have separate tasks.

Use it for planned resignations, involuntary terminations, retirements, and end-of-contract separations where access must end on a specific date and time. It is especially useful when multiple systems must be disabled in sequence or when physical assets must be returned before the employee leaves. It is not a general onboarding or role-change checklist, because those cases usually require access changes rather than full deprovisioning.

HR usually initiates the checklist, but IT, Security, Facilities, and the employee’s manager often own the actual checklist items. The best setup assigns a DRI for each action so the checklist does not depend on one person remembering every handoff. If your organization uses a service desk or identity team for deprovisioning, they can own the technical steps while HR coordinates timing.

This is a recurrence-based operational checklist that is run whenever an employee separates from the company. It is not a daily or weekly recurring task unless your organization processes separations in batches and wants a standard workflow for each case. The key is to trigger it on the separation date or the approved last working day so access removal aligns with policy.

Yes, it supports common access-control and record-retention expectations by creating a clear trail of who revoked access, when it happened, and what was verified. That matters for security reviews, audit readiness, and separation controls tied to internal policy or external frameworks. It does not replace legal advice, but it does help teams prove that deprovisioning was coordinated instead of handled ad hoc.

The biggest mistake is treating account closure as a single IT task instead of a coordinated sequence that includes badges, devices, shared credentials, and third-party apps. Another common issue is missing the verification step, which leaves teams assuming access was removed when it was only requested. Teams also run into trouble when they do not define the separation timestamp clearly, especially for remote employees or involuntary exits.

Yes, you can tailor the checklist for contractors, interns, executives, remote staff, or employees with privileged access. For example, executives may need extra steps for assistants, travel cards, or delegated inboxes, while contractors may only need a narrower set of system removals. Keep the items independently verifiable so each role-specific step still has a clear yes, no, or N/A outcome.

Email and chat are easy to miss because they do not enforce ownership, timing, or verification. A checklist creates a repeatable workflow with clear task types, priorities, and blocking dependencies so access removal is not buried in a thread. It also gives you a record of completion, which is much harder to reconstruct from informal messages later.