Offboarding Access Deprovisioning Coordination Checklist

It covers the coordination steps needed to remove an employee's access at separation, including identity systems, email, SaaS apps, VPN, badges, shared credentials, and company devices. It is meant to track who owns each action, when it must happen, and whether verification is complete. Use it as the control point for the offboarding process, not as the HR termination notice itself.

Run it before the separation date to prepare access changes, then complete the critical revocation steps on the employee's last day or at the agreed cutoff time. For involuntary separations, the checklist should be treated as time-sensitive and blocking until the highest-risk access is removed. For planned departures, it can also be used to stage device return and mailbox handoff in advance.

HR usually initiates the offboarding task, but IT or security should own the access revocation work, and facilities or office management may own badge and asset collection. The checklist works best when each checklist item has a clear DRI and a verification step. If your process spans multiple teams, assign one coordinator to confirm nothing is left open.

Yes, because it creates a documented trail showing that access removal was requested, completed, and verified. That matters for internal controls, privacy obligations, and audit readiness when you need to prove timely deprovisioning. It also helps reduce the risk of lingering access after employment ends, which is a common control failure.

The biggest mistake is treating offboarding as a single IT ticket instead of a coordinated checklist with separate owners and verification. Another common issue is forgetting non-obvious access such as shared drives, password managers, badge systems, or third-party vendor portals. Teams also sometimes close the task before confirming the account is actually disabled and the device return is logged.

Yes. You can add or remove checklist items for contractors, executives, remote workers, field staff, or employees with privileged access. For example, executives may need extra device recovery steps, while contractors may only need SaaS and badge removal. Keep the checklist item wording atomic so each step can be answered yes, no, or N/A.

Ad-hoc coordination is easy to miss because requests get buried, owners are unclear, and no one can see what is still blocking completion. This checklist gives you a repeatable sequence, explicit ownership, and a final verification step so access removal is not assumed. It is especially useful when multiple systems and teams must act on the same separation date.

Yes, it can be paired with HRIS triggers, IT service desk tickets, badge management, device inventory, and identity provider workflows. Many teams use it as the human coordination layer while automations handle the actual account disablement. That combination helps keep the process visible without relying on memory or scattered messages.