When companies onboard new employees, there’s usually a clear checklist of tasks to complete within those first few days. The new employee’s accounts get created, devices are issued, and access is granted to dozens of tools.
Offboarding rarely gets the same attention as employee onboarding. When someone leaves a company, their digital footprint often remains scattered across apps, devices, and login credentials. It’s actually surprisingly easy for former employees to retain access long after their departure if you don’t have a structured IT offboarding checklist, creating both security and operational risk for growing companies.
This guide explains what to do when an employee leaves, from revoking system access to securing company data. The goal is simple: make offboarding predictable, secure, and repeatable so every departure is handled the same way.
Key Takeaways
- An IT offboarding checklist ensures departing employees lose access to systems, devices, and company data quickly and consistently
- Weak offboarding processes can leave active accounts, shared credentials, and security gaps that expose businesses to breaches
- Core steps include revoking access, recovering devices, securing files, and reviewing SaaS licences
- A well-documented onboarding process makes offboarding far easier because it shows exactly what access the employee had
Why Your IT Offboarding Checklist Matters More Than You Think
Offboarding mistakes are more common than many businesses realize.
Weak employee offboarding is a real security risk. A survey shows, 83% of former employees said they were still able to access accounts from a previous employer after leaving the company. The reason is simple: employees leave, but their access often remains active.
Small businesses are especially vulnerable because IT responsibilities are frequently shared across HR, operations, or whoever “handles tech.” Without a clear process, access removal can easily fall through the cracks.
An IT offboarding checklist ensures that every departure triggers the same security steps. Instead of relying on memory or informal coordination, teams follow a documented process that protects systems and data.
What happens when IT offboarding goes wrong?
Lingering access points are often called “zombie accounts.” They quietly increase the risk of unauthorized access, data theft, or accidental data exposure.
In some cases, the consequences extend beyond security. Businesses operating under GDPR or other data protection frameworks must demonstrate control over who has access to company data. Poor offboarding practices can create compliance issues that surface during audits or client security reviews.
Over time, these small gaps accumulate and without a consistent offboarding process, businesses lose visibility into who still has access to what.
The IT Offboarding Checklist: What to Do When an Employee Leaves
A strong offboarding process doesn’t have to be complicated, it simply needs to be consistent and clearly documented. Below is a practical IT employee offboarding checklist that most businesses can adapt to their environment.
Step 1 — Revoke access immediately
The first step in any offboarding IT checklist is disabling system access, so accounts connected to company systems should be deactivated as soon as the employee leaves, and in some cases, before the departure is announced internally.
This typically includes:
- Email accounts
- Single sign-on systems
- Cloud applications
- VPN access
- Collaboration tools
- Internal databases
Speed matters here. The longer access remains active, the greater the potential risk. Termination scenarios make this step especially important. Access should be revoked at the moment the employee departs to prevent unauthorized activity.
Step 2 — Recover company devices and equipment
Next, recover any company-issued hardware, which includes laptops, phones, security badges, tablets, external drives, and authentication devices.
Remote employees require a slightly different approach. Shipping labels, return deadlines, and asset tracking should be part of the offboarding process so equipment does not disappear into someone’s home office.
Device recovery is not only about cost. Hardware often contains company data or stored credentials that could allow future access if not properly secured.
Step 3 — Change shared passwords and credentials
Team inboxes, marketing platforms, analytics tools, and social media accounts are often accessed by multiple employees using the same credentials. If a departing employee had access to those accounts, passwords should be updated immediately.
Failing to update shared credentials is one of the most common employee offboarding security gaps. Over time, businesses can reduce this risk by implementing password managers and role-based access controls, which make access management more structured.
Step 4 — Transfer or archive data and files
Departing employees often leave behind valuable information such as emails, documents, and project files. Before deleting accounts, businesses should ensure that important data is preserved.
Typical actions include:
- Transferring file ownership
- Archiving email accounts
- Exporting project files
- Documenting key client relationships
The goal is to retain business knowledge while avoiding unnecessary retention of personal information.
Step 5 — Review and cancel SaaS licences
Software licences are frequently overlooked during offboarding. Departing employees may still have active subscriptions across tools such as CRM platforms, project management software, analytics tools, and collaboration apps.
Unused licences create two problems: they increase costs and maintain unnecessary access points. Offboarding is a good time to review licences and clean up your software environment. Businesses dealing with growing tool sprawl often start by taking time to audit their tech stack and understand where access and spending have accumulated.
Step 6 — Conduct an exit security review
The final step in the offboarding checklist is verification. Before closing the process, confirm that:
- All accounts are disabled
- Shared credentials are updated
- Licences are reassigned or cancelled
- Devices are recovered
- Data ownership is transferred
Some organizations also review access logs to confirm there was no unusual activity before departure. Documenting these steps creates a clear record that the offboarding process was completed correctly.
IT Offboarding Checklist and GDPR — What You Need to Know
Employee departures also have data protection implications.
Under GDPR, businesses must ensure that access to personal data is limited to authorized individuals. When an employee leaves, any access they had to customer or employee data must be removed promptly.
Organizations should also review data retention policies. Some records may need to be retained for legal or HR reasons, while other personal data should be deleted once it is no longer required. A structured offboarding process helps demonstrate that appropriate access controls and data management practices are in place.
IT Onboarding and Offboarding Checklist — How the Two Connect
Strong offboarding begins with strong onboarding. If access rights, devices, and accounts were documented when employees joined, removing them later becomes much easier. Without that record, teams often end up guessing which systems someone may still have access to. That’s why onboarding processes matter operationally. Onboarding sets the structure that offboarding eventually depends on.
IT Offboarding Checklist Template — A Quick Reference
For teams that want a simple reference, here is a condensed offboarding checklist template:
Access
- Disable user accounts
- Remove SSO and VPN access
- Deactivate email login
Devices
- Collect laptops, phones, and hardware
- Disable device management access
Credentials
- Change shared passwords
- Update team accounts
Data
- Transfer file ownership
- Archive emails and documents
Software
- Review and cancel SaaS licences
Security review
- Confirm access removal
- Document offboarding actions
Saving a checklist like this ensures offboarding happens the same way every time.
How a Managed IT Partner Makes Employee Offboarding Easier
For businesses without dedicated IT teams, offboarding can easily become inconsistent. A managed IT partner helps standardize the process and instead of relying on memory, offboarding becomes a documented workflow tied to user accounts, device management systems, and access controls. Accounts are disabled quickly, licences are reviewed, and the process is recorded, resulting in a more secure and predictable IT environment.
If your team is reviewing how employee access, devices, and data are managed across the full employee lifecycle, it can help to speak with an IT partner who handles these processes every day. If you’d like to explore what that could look like, you can book a consultation.
