This employee offboarding checklist is for IT managers, HR heads and business owners at firms of roughly 250 to 2,000 people in India or the GCC. It shows whether the team did the security tasks around each joiner, mover and leaver event. It has 15 checks: nine for leavers, three for movers and three for joiners. Each shows the evidence to keep and an if-test that ends in yes or no. Nothing needs software, so a firm that handles each event by hand can run it today. HR’s own exit tasks, such as paperwork and final pay, stay with HR and sit outside this page. The page offers no file; copy the tables into your own sheet and add owner, date and mark columns. For background on the account side, see identity and access management.
Last reviewed 2026-11-01 by Manish Sharma.
Key Takeaway Test each task on your last three events of that kind, not on one tidy case.
How to Mark This Employee Offboarding Checklist, and What It Covers
This employee offboarding checklist tests whether each joiner, mover or leaver event set off each security task. The judgment rests on what the firm kept. Signisys set the marks, the sample size and each if-test; no standard prescribes them.
The NCSC’s 10 Steps to Cyber Security guidance on identity and access management is UK guidance dated 11 May 2021. It asks for a “joiners, movers and leavers” policy. The CISA and NSA best-practices guide for administrators is US guidance, advisory, with no date in the copy read.
Evidence is what the firm kept, such as a dated notice, a list, a note or a record. A task you believe was done but cannot show scores 1 at best, and a task with nothing kept scores 0.
Sample. Judge each check on its three most recent events, such as three leavers. Write the names down so the next run uses others. If fewer than three events exist, test every one.
Marking With This Employee Offboarding Checklist: Marks, N/A and Totals
Marks. Give 2 when the team did the task in each sampled event and the kept records show it. A 1 fits when you believe the team did it but some proof is missing, or one sampled event missed the test. Give 0 when two or more missed, nobody ran the test, or the firm kept nothing.
N/A and totals. If a check’s event has not happened lately, mark it N/A and drop the top total by 2. Leavers reach 18, movers and joiners 6 each, 30 in all, with no target.
Example (illustrative, not a client). For check 6, a leaver’s closing list says the laptop came back, yet the asset record still shows it issued. One of three sampled leavers missed the test, so check 6 scores 1.
Employee Offboarding Checklist, Leavers Part 1: Notice, Sign-Ins and Shared Passwords
Leavers make up nine of the 15 checks in this employee offboarding checklist, and each later one depends on IT having heard.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 1. IT heard about the leaver before the last day. | IT’s copy of the notice, with the date it arrived and the leaving date. | If, for each sampled leaver, the notice is dated before the last day, or a written reason says why not. | Our check. NCSC asks for access to be revoked when no longer needed and sets no timing, so the firm picks how early. |
| 2. Sign-ins beyond the main account were looked for and handled. | A closing list with a line for each place checked: remote access, outside online services joined with the work email address, and temporary accounts. | If each sampled leaver’s list is built from the firm’s own list of services, not from memory, and shows a result for each place. | NCSC says policy should reach wherever work identities can be used, such as online services joined with a work email address, and that temporary accounts should be removed or suspended once they are no longer required. The list and the test are ours. |
| 3. Shared passwords and keys the leaver could read were changed. | A list, per leaver, of the shared passwords, keys and service logins their role could read, with change dates. | If, for each sampled leaver, each item shows a change dated after the last day, or the list says the person read none. | Our check. |
Leavers Part 2: Files, Owned Items and Equipment
This part of the employee offboarding checklist moves from access to things: work the person held, and kit they carried.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 4. A named person took over the mailbox and files before anything was deleted. | A handover note naming the new holder, with its date and the deletion date, if any. | If, for each sampled leaver, the holder’s name is dated on or before any deletion and the holder can open the files. | Our check. |
| 5. Everything the leaver owned has a new owner. | A list of owned items, such as approvals, scheduled jobs, shared folders, admin roles on outside services and customer or supplier contacts, with a new owner against each line. | If, for each sampled leaver, each line names a new owner and the list was drawn up with the manager. | Our check. |
| 6. Equipment is back, and the asset record agrees. | A return receipt and the asset record for each laptop, phone, security key, badge and storage device issued. | If each item issued to each sampled leaver shows as returned, with a date, in the asset record, or as lost with a written note. | Our check. |
Check 5 passes only when the manager helps draw up the list. Ask the manager before IT starts it.
Employee Offboarding Checklist, Leavers Part 3: Data on Devices and the Closing Record
The employee offboarding checklist ends its leaver items with three more: what stays on devices, whether anyone looked after the last day, and whether the team finished the whole checklist.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 7. Work data was removed from devices, including any the firm does not own. | A dated wipe or removal note for each device, or a manager’s statement that the person kept no work data on a personal device. | If, for each sampled leaver, each device has a dated note, or a statement signed off by the manager, where the firm has a way to remove the data, such as mobile device management. | Our check. |
| 8. Someone looked for sign-in activity after the last day and wrote down what they found. | A dated note saying which logs or screens were searched and the result; “nothing found” counts. | If each sampled leaver has a note dated after the last day that names the logs or screens searched. | Our check. |
| 9. The closing list was finished and ticked off by a second person. | The closing list for each leaver, with done, N/A or a reason against each task, and two names with dates. | If each sampled leaver’s list has no blank line and carries a second name that is not the person who did the work. | Our check. |
Movers: What Should Change When Someone Changes Team
The CISA and NSA guide says, in its passage on identity governance systems, that without adequate management of Move events “long-term users tend to accumulate privileges as their roles change”. A move is easy to miss: nobody is leaving. These checks in the employee offboarding checklist test the trigger and the hand-back. The identity checklist linked in the last section tests whether account rights actually shrank.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 10. IT heard about the move before the new role began. | IT’s copy of the notice, with its date and the first day in the new role. | If, for each sampled move, the notice is dated on or before that first day. | NCSC asks for access to be “changed for movers” under a joiners, movers and leavers policy; the date test is ours. |
| 11. A written hand-back list was made for the old team’s items, beyond the accounts. | A list of what the person held in the old team, such as shared mailboxes, groups, shared passwords, cards and kit, with an action and a date for each. | If each sampled move has such a list with an action and a date on each line. | Our check. |
| 12. Where the mover read shared passwords or owned items, checks 3 and 5 were run too. | The check 3 and check 5 records for that mover, or a note saying they held none. | If, for each sampled move, those records exist and are dated, or the note says none applied. | Our check. |
Joiners: Starting the Record That Offboarding Will Need
A leaver check is only as good as the list it starts from, and in this employee offboarding checklist that list begins on a joiner’s first day. These three checks make sure there is something to compare against later.
| Check | Evidence to keep | Pass test | Basis |
|---|---|---|---|
| 13. IT heard about the start before the first day, with the role and manager. | IT’s copy of the notice, with its date and the start date. | If, for each sampled starter, the notice is dated before the first day and names the role and manager. | Our check. |
| 14. Each device issued is recorded against the person’s name, with a date. | The asset record lines for that starter. | If each device handed to each sampled starter appears in the asset record with a name and an issue date. | Our check. |
| 15. A record of the person’s accounts, shared passwords and kit was opened on the first day. | That record, with each later addition dated. | If, for each sampled starter, the record lists accounts, the shared passwords they were given and the kit issued, and each later addition carries a date. | Our check. |
Key Takeaway Start with check 1: every later leaver check depends on IT having heard.
What to Do With Your Employee Offboarding Checklist Marks
The totals from this employee offboarding checklist are not a verdict, and no target applies. If check 1 scored 0 or 1, fix it first, as the later leaver tests depend on IT having heard. Next work through the group holding the most 0s, and fix its 0s before any 1s. A 1 given for missing proof can rise only when the next sampled events leave proof. Do not write up a record after the event to lift a mark. Against each 0, name who will make the change and when to test again.
This list covers events. Whether each account really closed is a different test, and the account-level audit in the broader access checklist holds it. Separate guides cover why a missed task matters and how to build the HR trigger that starts these tasks. If you later want software to run them, read how to choose software for joiner, mover and leaver changes.
Test again on a date you set, and file the new marks next to these.
Key Takeaway A strong joiner total does not make up for a weak leaver total.
What a Full Score for Leavers, Movers and Joiners Does Not Prove
A total of 30 shows only that the sampled events passed Signisys’ tests on the day of the run.
It does not show that no access remains. Three events are a sample, and the tests look only at places the lists name.
The total makes no claim about notice periods, final settlement, employment law or any standard. No source read for this page sets a deadline. NCSC’s page is UK guidance, and the CISA and NSA guide is US guidance. Both are ideas to use, not rules for firms in India or the GCC. Ask your own advisers what applies to you.
You can sample contractors and part-time staff as leavers, movers or joiners if they held access. The checks do not change. The use-case page sets out how Signisys approaches the Joiner and Leaver Review.
This checklist leaves out HR’s exit tasks, why each gap is risky, trigger automation and tool choice for employee offboarding. Our view: a second reading helps when the 0s sit in more than one group. It also helps when nobody can say who owns a shared password. The same holds when a customer asks for proof in a form you do not hold.
Signisys provides identity and access management, and agrees the scope for each engagement. This is a Signisys offer, not neutral advice. Our Solution: Identity and Access Management (IAM). Our Service: Cybersecurity Services.
FAQ: Using This Employee Offboarding Checklist
How does this employee offboarding checklist treat a task that nobody wrote down?
When HR and IT split the tasks, who gives the marks?
Does a clean leaver list mean no access remains?
What should be written beside each mark?
How soon after the last day should each task be finished?
Security Insights, Delivered.
Practical, vendor-neutral analysis of threats, tools, and architecture decisions.