# Offboarding verification checklist

Use the authorized departure timing and information-preservation instructions. Requested, completed, and verified are separate states.

## Case

**Case reference / coordinator:** ____________________

**Departure type (planned, immediate, contractor end, role change) and who authorized it:** ____________________

**Authorized effective time / timezone:** ____________________

**Preservation and transfer instructions reference (retention hold, mailbox and file transfer, litigation or regulatory hold):** ____________________

**Inputs used to build the access list (identity provider applications, vendor administrator lists, password manager shares, device inventory, the person's own list):** ____________________

## Access paths

| Access path / resource | Requested | Completed / time | Independently verified / evidence | New owner | Exception / follow-up |
| --- | --- | --- | --- | --- | --- |
| Central identity, including recovery methods and registered authenticators |  |  |  |  |  |
| Application accounts, including those not behind single sign-on |  |  |  |  |  |
| Application sessions and refresh tokens |  |  |  |  |  |
| Personal API keys, tokens, and OAuth grants |  |  |  |  |  |
| Guest memberships in other organizations' tenants and workspaces |  |  |  |  |  |
| Devices (firm-owned returned and wiped; personal devices unenrolled) |  |  |  |  |  |
| Shared credentials and password manager vault items |  |  |  |  |  |
| Delegated resources (mailboxes, calendars, shared drives, social accounts) |  |  |  |  |  |
| Mail forwarding rules, auto-replies, and delegates set by the person |  |  |  |  |  |
| Integrations, scheduled work, and automations running under the person's identity |  |  |  |  |  |
| Administrative roles in vendor portals, cloud consoles, banking, and payment tools |  |  |  |  |  |
| Owned documents / workspaces / groups |  |  |  |  |  |
| Physical access (badges, keys, alarm codes) |  |  |  |  |  |
| Recovery contact on firm accounts (phone, alternate email) |  |  |  |  |  |

## Sequence

**Order of actions and the reason (for example, sessions before password, devices before identity for immediate departures), and which actions must wait for the effective time:** ____________________

**Actions that must wait for preservation to finish (for example, license removal, authenticator cleanup, mailbox conversion, device wipe):** ____________________

- [ ] Accounts are disabled rather than deleted until preservation and the follow-up check are complete; group memberships and roles are recorded so a mistaken removal can be reversed.
- [ ] Verification is performed by someone other than the person who made the change; self-attestation does not count.

## Additional steps when the person held privileged or sole access

- [ ] A second administrator exists for every system the person administered before their access is removed.
- [ ] Emergency access credentials the person could have known are reissued and tested.
- [ ] Outside providers are told in writing who may now authorize requests.
- [ ] Billing, registrar, domain, and certificate contacts naming the person are changed.
- [ ] Credentials the person could have seen are rotated in stages, with monitoring between stages.
- [ ] Any regulatory or contractual role the person held is reassigned and the counterparty informed.

## Closure review

- [ ] Application-specific revocation behavior is accounted for.
- [ ] Required business workflows have an active owner.
- [ ] Pending jobs and offline devices are recorded explicitly.
- [ ] Known limits involving downloaded or unmanaged copies are documented.
- [ ] Sign-in and token activity for the departed identity is checked after the effective time and again after an agreed interval; none succeeded.
- [ ] The person's mailbox and files are preserved per the instruction and the preservation is verified, not assumed; licenses are released and mailbox conversions completed only after that.
- [ ] External parties who dealt with the person (portfolio companies, investors, vendors) have a new contact where the business requires it.
- [ ] Unresolved items, unreturned devices, and ownerless resources found later have an owner and next check.

**Escalation threshold (access still active after the agreed window is treated as a control failure, not a delay):** ____________________

**Closure decision / residual exceptions / approver:** ____________________

## Common failure modes

- Central identity is disabled but application sessions, personal tokens, and automations keep working.
- Guest access in other organizations is forgotten because the firm does not control it.
- Preservation and revocation are done by different people who do not compare notes.

Keep personal employment circumstances outside routine technical evidence.

This checklist covers access and information handover. It does not cover the human resources, payroll, or legal steps of a departure.