Offboarding checklist to catch risk before the last day

The calendar invite lands in your inbox. It is vaguely titled. The employee sits down, hands you their two-week notice, and smiles. You congratulate them, wish them well, and quietly begin calculating exactly what is about to fail.

The risk started before the invite did. Data exfiltration by departing employees begins climbing as many as 200 days before a formal resignation, and spikes 720% in the 24 hours before a layoff notification, per Cyberhaven's 2024 Insider Risk Report. Most insider intellectual property theft clusters near the end: 70% happens within 30 days of a resignation announcement, according to Carnegie Mellon University's CERT Insider Threat program. And the cleanup is slow when it goes wrong — insider incidents take an average of 67 days to contain, and those that take more than 90 days cost organizations an average of $21.9 million, per Ponemon Institute's 2026 Global Cost of Insider Risks report.

That is the anatomy of a botched departure. The access lingers. The knowledge walks out. The legal clock starts anyway.

You do not need a theoretical philosophy on parting ways. You need a sequence. Five phases. In order. On time.

Phase 1: Confirm the departure and set the plan

This phase establishes who is leaving, when the departure takes effect, and what has to happen before that clock runs out. Do it the same day the departure is confirmed.

Most offboarding failures start here, not in IT. The manager hears about the resignation, says they'll "figure out coverage," and moves on to the next meeting. HR assumes the manager has the handoff covered. IT waits for a ticket. Nobody owns the sequence.

You need one owner. One plan. One version of the truth.

Start with the basics: last working day, reason for departure, whether the exit is voluntary or involuntary, and whether legal, payroll, or security needs to be involved before anyone says another word. Voluntary and involuntary exits do not run on the same clock. A voluntary exit can support phased access reduction over a notice period. An involuntary exit cannot. That one requires lockout to happen with the termination meeting. Minutes, not days.

Control the narrative early. Rumors move faster than official company emails. Work with the departing employee to agree on a communication plan: immediate team first, stakeholders second, the broader organization third. Draft the internal announcement together.

Then map the work that will break first. Not "responsibilities." The actual things. The client renewal in progress. The monthly close checklist. The vendor password nobody else has. The quarterly billing reconciliation — it's a notebook on his laptop. Last quarter it caught a $14k overcharge you'd have eaten.

This is also where you decide whether gardening leave applies. Gardening leave means the employee remains employed and paid during notice, but is removed from active duties and system access. Useful when the person holds sensitive intellectual property, confidential client data, or core financial system access. You want them helpful. You need the business safe. Make a clear, documented decision within the first hour of notice.

Do not overcomplicate this phase. You are not building a perfect transition plan. You are naming the risks while there is still time to do something about them.

Phase 2: Capture the work before the person disappears

This phase covers knowledge transfer: what must be documented, shown, or handed over before the last day. Start immediately. Waiting until the final week is how you get a folder full of filenames and no idea what any of them mean.

What actually gets lost in a handover? Not the doc. The tacit knowledge — the unwritten know-how stored in habits, judgment, and memory. The doc gets written. The knowledge doesn't.

This is why bad handovers look fine on paper. There is a checklist. There are links. There is even a neat folder called "transition." Then two weeks later someone asks, "Why does this report keep breaking on Thursdays?" and the answer left with the employee.

Implement reverse shadowing. Do not let the departing employee quietly type out a manual in isolation. Have the replacement — or an interim owner — perform the task while the departing employee watches and corrects. When the departing employee does the work, muscle memory masks the complexity. When they have to verbally guide someone else through the clicks, the undocumented steps surface. "Oh, wait, skip that screen, you have to export to CSV first or the formatting breaks." That single sentence is the institutional knowledge you are trying to save.

Record the complex workflows. Do not rely on written text for complex digital tasks. Have the departing employee turn on a screen recorder and narrate their weekly, monthly, and quarterly tasks. A ten-minute video of them navigating a messy CRM integration is more valuable than a four-page static document that will be obsolete in three months.

Map the relationships. Ask the departing employee to list the top five people they rely on to get their job done, internal and external. Who do they call when the primary server is down? Which client point-of-contact actually signs the renewal? Transferring relationships requires warm handoffs. Schedule the introduction emails and transition calls by week one.

Document the things that fail expensively:

recurring tasks with dates and owners
approvals and decision rights
vendor and customer relationships
systems, files, and local workarounds
deadlines that will hit in the first 30 days after departure

Keep it concrete. "Prep payroll backup" is vague. "Run payroll preview by 2 p.m. Tuesday, compare to the benefits deduction sheet, then message Elena if the retirement file is short" is useful.

The point is not to preserve everything. It is to preserve the work that will break first, cost the most, or take the longest to reconstruct.

Run the exit interview as intelligence gathering, not ceremony. HR or a neutral third party should conduct it — not the direct manager. Candor drops when the person being reviewed is sitting there. Skip the aspirational career-journey questions and ask operational ones:

What is the most frustrating bottleneck in your daily workflow?
Which software tool is actively slowing you down?
What process did you quietly bypass because it was broken?
If you had to rewrite your job description today, what would you change?

The exit interview rarely changes company policy, but it might save a client account next week. Keep the tone professional, neutral, and strictly confidential. Then use the answers while you still can.

Phase 3: Lock down access, recover assets, and leave an audit trail

This phase closes access, captures evidence, and recovers company property. For involuntary exits, it happens at the termination meeting. For voluntary exits, interactive access still ends at the agreed departure time, with machine credentials cleaned up within 48 hours.

Most companies miss the deadline. Only 44% of companies revoke all access within 24 hours of departure, and a OneLogin survey of 500 US IT decision-makers found that half of former employees' accounts remain active for more than a day, with 32% of organizations taking over a week to fully deprovision. The gap compounds over time: a 2025 Wing Security study found 63% of businesses have former employees who still have access to corporate data through SaaS applications that were never deprovisioned.

Start with the identity provider. Disable the user in Okta, Google Workspace, or Microsoft Entra ID. Then revoke active sessions. Blocking sign-in does not kill active sessions — if you do not explicitly revoke them, refresh tokens can keep the session alive.

Work the three-tier SaaS revocation model.

Tier 1 is SSO-connected apps. Verify deactivation actually propagated.

Tier 2 is local accounts that do not depend on SSO. Think AWS IAM, Cloudflare, Stripe, and any admin console someone created directly.

Tier 3 is shadow IT — software adopted outside formal procurement or IT review. Find it through expense reports, browser bookmarks, finance systems, and SSO logs. "Revoke SSO" does not touch an app you never knew existed. While you're in there, harvest the paid licenses. Leaving a former employee on a $50/month software seat for a year is a pointless bleed on your operations budget.

Then deal with the 48-hour machine-credential window. Interactive access should be gone immediately. Non-human credentials need a short audit pass, and they need it fast. Check Personal Access Tokens in GitHub, GitLab, and Jira. Check SSH public keys in authorized_keys files. Check long-lived AWS IAM access keys, which ignore federated identity. Check webhook signing secrets for integrations the departing employee owned, including tools like HubSpot or Segment.

Recover the physical assets. Laptop and phone are obvious. External hard drives, security keys, corporate credit cards, and specialized peripherals are easily forgotten. Provide a prepaid shipping box if the employee is remote and require tracking numbers — do not release final expense reimbursements until the hardware is in transit. If the exit is involuntary or the person held privileged access, forensic imaging of devices is standard practice before reuse or wipe.

Transfer ownership before deleting anything. Shared drives, dashboards, and automated reporting systems need a new owner. If you simply delete the account, you might inadvertently delete three years of shared departmental data.

Do not delete the email account on day one. Convert it to a shared mailbox or forward it to the supervisor. Add an auto-reply naming the new contact. Cancel future recurring calendar invites the departing employee organized. Keep that continuity window for 30 to 90 days. Otherwise the customer replies to an address that now vanishes into the dark.

What auditors will ask for

An offboarding checklist is audit evidence, not just process.

SOC 2 CC6.2 and CC6.3 require logical access to be restricted and revoked at employment end, and auditors typically expect documented revocation within 24 hours. ISO 27001 Annex A 6.5 requires formal responsibility for access revocation and asset return at termination. NIST SP 800-171 requires immediate account closure on departure.

The evidence is mundane. That is the point. Keep timestamped revocation logs. Keep license removal confirmations. Keep MDM wipe records or forensic imaging records. Keep the completed checklist with named assignees and completion timestamps. If you cannot show it, you did not do it.

Voluntary vs. involuntary offboarding protocol

Protocol areaVoluntary departureInvoluntary departureRevocation timingPhased privilege reduction may begin during notice; interactive access ends at departure timeFull session revocation happens with the termination meetingAccess strategyReduce to least privilege during notice where appropriateImmediate lockout across IdP, local accounts, and active sessionsKnowledge transferFull handover, reverse-shadowing, and documented transition over days or weeksTriage business-critical knowledge onlyDevice recoveryRecover on last day or by scheduled returnRecover immediatelyForensic captureCase by caseStandard practice for privileged roles and involuntary exits

Phase 4: Close the legal and HR obligations on the actual deadline

This phase covers pay, notices, agreements, and the employment record. Deadlines are statutory. You do not get extra time because the manager was traveling.

This is where vague advice becomes expensive. State law dictates exactly when final wages are due, and the differences are not minor.

In California, final pay is due immediately for involuntary terminations and within 72 hours for voluntary resignations. Waiting-time penalties accrue at one day of wages per day late, up to 30 days, under the California Labor Code — a $1,000 payroll error can become a $10,000 liability if it sits there. In Massachusetts, final pay is due on the day of termination, and willful violations authorize triple damages under the Massachusetts Wage Act. In Colorado, payment is due by the next business day for involuntary separations, including payout of all accrued, unused vacation, under the Colorado Wage Act. In Illinois, final pay for voluntary departures is due by the next regular payday under the Illinois Wage Payment and Collection Act.

Benefits have clocks too. Health insurance does not neatly end at 5:00 PM on a Friday. Terminate active benefits with your carriers, and provide the COBRA election notice within 44 days of the qualifying event. The departing employee needs clear, written documentation of when medical, dental, and vision coverage ceases and how they can legally continue it.

Separation and release agreements must comply with the Older Workers Benefit Protection Act: a 21-day consideration period for individual separations and 45 days for group terminations. If the departure is part of a layoff large enough to qualify, the WARN Act requires 60 days' advance notice.

Secure the signed documents. Review any NDAs, non-compete clauses, or confidentiality agreements the employee signed during onboarding. Provide them with copies. Remind them, in writing, of their continuing obligations regarding company data and client solicitation.

None of this is optional paperwork. It is liability with a calendar attached. Make sure the employee record reflects the actual reason for separation, last day worked, and rehire eligibility — and make sure payroll, benefits, legal, and the manager all have the same dates. Offboarding errors love mismatched dates.

Phase 5: Stabilize the team and the work after the exit

This phase starts the day the employee leaves and runs through the first few weeks after. The goal is simple: keep the work from failing in public.

A departure does not become clean because the laptop came back and the accounts are off. The real test is day 14. Did the recurring work continue. Did the customer get an answer. Did the replacement inherit a usable system or a scavenger hunt.

This is where you check whether the handover actually worked. Review the first deadlines that land after departure. Confirm owners accepted them. Check the inbox forwarding. Check the vendor contacts. Check the approvals the former employee used to sit inside. If a process now depends on "just ask Sarah, she knows," then the transfer did not happen.

You should also look for the quiet damage. The employee who absorbed extra work without saying so. The manager who is now the human bridge between three broken processes. The replacement who got a pile of notes but not the context to use them.

Close the chapter properly. Then do the postmortem while the details are still fresh. What nearly got dropped. Which access point was missed. Which task existed only in someone's head. Fix the system before the next person leaves.

Common offboarding mistakes to avoid

You will face uncomfortable realities during an offboarding process. Anticipate them.

What if the leaver refuses to engage? Sometimes an employee resigns because they are entirely burnt out. They check out mentally on day one of their notice period. You cannot force enthusiasm, and a checklist will not manufacture motivation. If the employee refuses to document their work, isolate their impact. Pull the manager in to document the workflows from the outside. Revoke access to critical systems early to prevent careless errors, and accept that you will have to rebuild some of the knowledge from scratch.

What if the manager abdicates responsibility? Managers often assume HR is handling the entire exit. HR handles the compliance; the manager handles the work. If the manager refuses to participate in the knowledge transfer, escalate. The manager is the one who will suffer when the workflow breaks on day 15. Force them to review and sign off on the handover documentation.

Failing to tell the clients. Nothing damages an employer brand or a vendor relationship faster than a client emailing their account manager and getting a bounce-back. If the employee was client-facing, the organization controls the communication. Do not let the departing employee send unvetted goodbye emails to your key accounts. Draft the message together, and ensure the new account owner is copied on the send.

FAQ

How quickly must access be revoked when an employee leaves?

Immediately for interactive access. For involuntary exits, that means simultaneous with the termination meeting. SOC 2 auditors typically expect documented revocation within 24 hours, and machine credentials such as API keys, SSH keys, and tokens should be closed within 48 hours.

When is a final paycheck due?

It depends on the state, and the deadline is often sooner than people assume. California requires immediate final pay for involuntary terminations, Massachusetts requires day-of payment, Colorado requires next-business-day payment for involuntary separations, and Illinois allows the next regular payday for voluntary departures. Late payment can trigger daily waiting-time penalties.

Who should conduct the exit interview?

HR or a neutral third party. Not the direct manager. People are less candid when the person being reviewed is in the room.

Should you delete a former employee's email account?

No. Convert it to a shared mailbox or forward it to the supervisor, and add an auto-responder naming the new contact. Maintain that setup for 30 to 90 days for business continuity.

What's the difference between offboarding a voluntary and involuntary departure?

Timing and sequence. Voluntary exits allow phased access reduction and weeks of knowledge transfer. Involuntary exits require simultaneous lockout, triaged capture of business-critical knowledge only, and forensic imaging as standard practice for privileged roles.

The definitive employee offboarding checklist summary

Use this when someone gives notice. Use it when someone is terminated. Use it especially when you think you'll remember the steps without writing them down. You won't.

Phase 1: Confirm the departure and assign ownership

confirm last working day, departure type, and reason
assign one offboarding owner the same day
notify HR, IT, payroll, and the direct manager
decide whether legal review, security review, or gardening leave applies
agree the communication plan: team first, stakeholders second, organization third
identify the first work items that will break if nobody takes them over

Phase 2: Transfer knowledge before the last day

list recurring tasks, deadlines, and named owners
capture systems, files, contacts, approvals, and local workarounds
run reverse-shadowing on business-critical tasks
record screen shares of complex digital processes
map key relationships and schedule warm handoffs by week one
conduct the exit interview with HR or a neutral third party, not the direct manager

Phase 3: Revoke access and recover assets

disable the user in the IdP at departure time
revoke active sessions immediately so refresh tokens die too
deprovision Tier 1 SSO apps within 24 hours
deprovision Tier 2 local accounts within 24 hours
surface and close Tier 3 shadow IT within 48 hours
audit and remove machine credentials within 48 hours: API tokens, SSH keys, AWS IAM keys, webhook secrets
recover laptop, badge, keys, hardware tokens, corporate cards, and other company assets
transfer ownership of shared drives, dashboards, and automations before deleting accounts
preserve evidence: revocation logs, license removals, MDM wipe or forensic imaging records
convert email to a shared mailbox or forward it, add an auto-reply, and maintain for 30 to 90 days

Phase 4: Meet legal and HR deadlines

issue final pay on the statutory deadline for the employee's state
confirm payout rules for accrued, unused vacation where required
send the COBRA election notice within 44 days
apply OWBPA timing rules for separation or release agreements: 21 days for individuals, 45 days for group terminations
check WARN Act notice requirements for layoffs of qualifying size
provide copies of NDAs and confidentiality agreements, and confirm continuing obligations in writing
finalize the personnel record, benefits status, and return-of-property documentation

Phase 5: Stabilize the work after the exit

verify the first post-departure deadlines were met
confirm new owners accepted customer, vendor, and internal responsibilities
review inbox forwarding, approvals, and recurring workflows on day 14
identify what was missed and patch it before the next departure
run a short postmortem and update the checklist

Common mistakes stay boringly consistent. Access left open. Knowledge transfer started too late. Payroll dates mismatched. The manager assumes HR has it. HR assumes IT has it. Nobody checks what actually survived the handover.

That is why the checklist matters. Not because offboarding is complicated. Because the failure pattern is predictable. And predictable failures are the ones you can prevent.

Someone on your team will leave this quarter. The choice is not whether you will transition their workload, but whether you will control how that transition happens. No surprises on day 14.