Employee IT Offboarding Checklist: Protect Your Business When Staff Leave

An employee returns their laptop and leaves the company. Their email account remains active, their personal phone still receives company messages, and their VPN access has not been removed.

These gaps can easily go unnoticed during a busy handover.

Employee IT offboarding is the process of removing access, securing company information and transferring digital responsibilities when someone leaves. For SMEs, a clear checklist helps protect business data while keeping daily operations running.

1. Confirm the Departure and Access Cut-Off Time

HR, the employee’s manager and IT should agree on the employee’s last working day and the exact time access should end.

Prepare the handover before that deadline. For an immediate departure, coordinate access removal with management so important systems are secured at the appropriate time.

Record who is responsible for each task and who will take over the employee’s work.

2. List Every Account and Access Method

Disabling company email is only one part of offboarding.

Check whether the employee has access to:

• Company email and Microsoft 365 or Google Workspace.
• Office computers, servers, shared folders and NAS storage.
• Accounting, payroll, CRM and other business applications.
• VPN and remote desktop services.
• Remote support tools with unattended access.
• Password managers and shared credentials.
• Company websites, domains, hosting and social media accounts.

Include applications that use separate passwords rather than the company’s main login.

3. Disable Sign-In and Revoke Existing Access

At the agreed time, disable the employee’s accounts and use each platform’s controls to revoke active sessions.

Review registered authentication methods, recovery contacts, app passwords and connected applications. Remove access that could remain available through a saved session or another device.

Changing a password alone should not be treated as a complete offboarding process.

For shared accounts the employee could access, change the relevant credentials and update authorised users through an approved secure method.

4. Preserve and Transfer Important Business Data

Before deleting accounts or wiping devices, identify the business information that must be retained.

This may include customer correspondence, quotations, project documents, accounting files and work stored on the employee’s computer.

Assign an authorised person to receive the information and verify that they can open it. Where possible, move shared business documents into company-managed storage instead of leaving them under one employee’s account.

Check applicable retention requirements and any investigation or preservation needs before deleting information.

5. Arrange Email Continuity

Customers and suppliers may continue writing to the employee after they leave.

Decide whether an approved colleague needs delegated access, a shared mailbox, a temporary internal forwarding arrangement or an automatic reply directing customers to a new contact.

Use administrator-managed access rather than sharing the former employee’s password.

Set a review date for temporary arrangements. Check the platform’s retention and licensing requirements before removing a licence or deleting the account.

6. Recover Company Equipment

Use an asset list to collect laptops, desktops, phones, external drives, security keys and other issued equipment.

Record the return date, device condition and any missing items.

Before reassigning a device, IT should confirm that required business data has been preserved, remove the previous user’s access and prepare the device for its next user.

For personal devices used for work, use an authorised process to remove company accounts and managed business data. Any remote removal should respect company policy and the agreed scope.

7. Review Shared Links and Digital Ownership

Some access is easy to overlook.

Check file-sharing links, shared password vaults, team memberships, delegated mailbox permissions and remote access settings.

Transfer responsibility for websites, domains, subscriptions and other company services. Make sure a departing employee’s personal phone number or email address is not the only recovery method for a critical company account.

If the employee held administrator privileges, review those separately.

8. Verify Completion and Close the Record

Offboarding is complete when the changes have been checked.

Confirm that access has been removed, equipment is accounted for and the replacement employee can reach the information needed for work.

Record any outstanding items, the person responsible and the follow-up deadline.

Quick Employee IT Offboarding Checklist

• ☐ Confirm the departure date and access cut-off time.
• ☐ Identify accounts, permissions and remote access.
• ☐ Disable sign-in and revoke active sessions.
• ☐ Review authentication, recovery and application access.
• ☐ Change shared credentials the employee could access.
• ☐ Preserve and transfer required business information.
• ☐ Arrange email continuity.
• ☐ Recover and prepare company equipment.
• ☐ Review sharing links and transfer digital ownership.
• ☐ Verify completion and document outstanding actions.

Make Offboarding Part of Your Business Routine

A consistent offboarding process helps prevent forgotten access, missing documents and interruptions when staff leave.

Contact MY IT PLT for employee IT offboarding, company account management and business IT support.