A departing engineer still has admin access to your production database. A sales rep's laptop sits in a box for three weeks before IT wipes it. An automation they built keeps running, posting to a Slack channel nobody monitors. These are not edge cases. They are what happens when offboarding lives in HR's to-do list instead of your security and continuity plan.
This guide gives you an employee offboarding sop that treats every departure as a controlled handoff. It covers who does what, when, and how to prove it. You get checklists you can assign by system type, a handoff flow that works across IT, finance and the team losing the person, and an audit trail template that satisfies auditors without extra work. Use it to run your first offboarding drill and keep the process current as your tools change.
Offboarding is a security and continuity checklist, not an HR form
Most teams treat offboarding as an HR paperwork exercise. That mindset is what leaves former employees with active logins, running automations and unclaimed assets months after their last day.
Offboarding is a security and continuity handoff. It moves access, responsibilities and physical items from a departing person to the organization, in a controlled, auditable way. The goal is not closure of an employment record. The goal is zero residual access and zero orphaned work.
A pure HR form collects signatures and returns a laptop. A security handoff answers three questions for every system, asset and workflow the person touched:
- Who now owns this?
- Who now has access to it?
- Is there a record that this changed?
When offboarding is treated as an operations task, it plugs into the same machinery used for any other access or ownership change. It uses the same ticketing system, the same identity provider, the same asset register, the same runbook templates. That consistency is what makes it reliable under pressure, such as during a sudden departure.
This reframing also sets the tone for the rest of this SOP. Every checklist that follows is written as a concrete transfer of control, not a form to file. The account deprovisioning list becomes a set of ownership handoffs. The asset return form becomes a chain of custody record. The audit trail becomes proof that each transfer happened, in order, on time.
Think of offboarding as a controlled decommissioning process, the same discipline you would apply when retiring a server or migrating a tool. The departing employee is the last holder of credentials and context, not the owner of the exit process.
For teams building this kind of disciplined handoff across the tech stack, see How to Migrate Operations Tools Without Downtime: A Step-by-Step Playbook and SOP Templates: 10 Templates Every Operations Team Needs.
The offboarding handoff: roles, timing and trigger events
Start with a single trigger event, then route the case through fixed hands. The manager submits the offboarding request in the HRIS, which immediately creates a ticket in the ops ticketing system and starts the clock. From there, ownership splits by domain and stays that way until final sign-off.
Use a RACI matrix to stop overlap. The manager notifies and confirms the date. IT owns account deprovisioning and device wipe. Security owns tokens, keys and audit review. Finance owns license recovery and final pay. Facilities owns badge return and workspace cleanup. The departing employee owns asset handoff and acknowledgment signing.
| Domain | Owner | Action | Due |
|---|---|---|---|
| Notice | Manager | Submit HRIS request | Day 0 |
| Accounts | IT | Disable logins | Day 0 |
| Devices | IT | Collect and wipe | Day 0-1 |
| Tokens | Security | Revoke keys | Day 0 |
| Licenses | Finance | Reclaim seats | Day 1 |
| Badge | Facilities | Deactivate and collect | Day 1 |
| Audit | Security | Review trail | Day 3 |
Timing depends on the trigger. Voluntary resignation gives a two-week window. Termination or role elimination starts immediate lockdown. Transfer to another team pauses deprovisioning and reroutes to role-based access updates instead.
The handoff ends when security signs the audit trail. That sign-off closes the ticket and marks the employee record as fully offboarded in every system. Keep the matrix in your SOP template, and review ownership during every tool migration or tech stack audit.
Account deprovisioning checklist by system type
Deprovision from the inside out. Start at the identity provider (IdP), then cascade through SaaS, cloud, database and shared-mailbox layers. One action at the IdP blocks login everywhere, if the connection exists. Check the box for each tier, and flag any system that is not wired to the IdP for manual follow-up.
Identity provider and SSO
- Disable the user record in the IdP first.
- Reset or delete any active SSO session tokens.
- Remove the user from all groups and role assignments.
- Rotate shared passwords or certificates the user could view.
- Confirm federation is enforced for downstream apps before marking complete.
SaaS applications
| Category | Action | Notes |
|---|---|---|
| CRM and ERP | Suspend license, transfer record ownership | Reassign open opportunities, cases or orders |
| Communication | Remove from org-wide groups, delete personal rooms | Export shared docs the user owns |
| Project and planning | Transfer project and task ownership | Archive personal boards if needed |
| Finance and expense | Freeze approval rights, reassign reports | Export linked receipts or invoices |
| HRIS | Set status to terminated | Trigger downstream deprovisioning if workflow exists |
Cloud platforms
- Revoke console access keys and CLI credentials.
- Detach or delete IAM policies attached only to the user.
- Remove the user from instance profiles and Lambda execution roles.
- Delete or rotate any API keys the user created.
- Scan for running resources tagged with the user's name and shut them down.
- Audit access keys older than one day for emergency rotation.
Databases
- Revoke direct database logins and schema-level permissions.
- Rotate service account passwords the user may have stored.
- Drop any personal schemas or temporary tables owned by the user.
- Confirm no scheduled jobs or stored procedures run under the user login.
- Remove the user from database-level groups and roles.
Shared mailboxes and collaboration
- Remove full and send-as permissions on shared mailboxes.
- Transfer ownership of shared calendars and distribution lists.
- Delete or reassign personal sites, wikis and shared drives the user owns.
- Disable any forwarding rules pointing to external addresses.
Flag systems that require manual action. Anything not connected to the IdP should be listed with an owner and a due date. Treat the list as a living part of your SOP Templates: 10 Templates Every Operations Team Needs, reviewed during each How to Audit Your Operations Tech Stack in One Week.
Reclaiming devices, licenses and physical assets
Asset reclamation fails when teams treat hardware, physical access, and software licenses as separate end-of-month cleanup tasks. Treat them as a single balance sheet line item that must clear on the employee's final day.
When physical return is delayed, remote wipe capabilities prevent data exposure. IT should issue an automated wipe command through your mobile device management (MDM) software immediately upon termination, even if the physical laptop is still in transit via a prepaid shipping box.
Use this baseline matrix to direct physical and virtual asset recovery:
| Asset Category | Action Required | Responsible Owner | Cutoff Timeline |
|---|---|---|---|
| Laptops and Workstations | Lock remotely via MDM, issue wipe command, send tracked shipping kit | IT Operations | Lock on final hour; wipe on receipt or after 48 hours |
| Company Mobile Devices | Enterprise wipe (remove business partition and profiles) | IT Operations | Final business day |
| Office Badges and Keys | Physical collection, deactivate badge ID in building security portal | Office Operations / HR | Final working hour on site |
| Corporate Credit Cards | Cancel physical and virtual cards via card portal, clear pending expenses | Finance Operations | 5:00 PM on final day |
| Assigned SaaS Seats | Downgrade or unassign paid user licenses, reallocate to pool | Systems Administrator | Within 24 hours of departure |
| Cloud Infrastructure Resources | Audit personal dev sandboxes, test buckets, and unattached compute | Cloud Engineering | Within 48 hours of departure |
Software licensing requires direct coordination with finance. Reclaiming an assigned seat inside enterprise applications stops unnecessary subscription expansion, especially during true-up windows. Teams looking to eliminate subscription drift should consult our guide on How to Audit Your Operations Tech Stack in One Week to capture unassigned seats across departments.
For hardware, establish a strict rule: if a remote asset is not checked into a courier network within five business days post-departure, flag the serial number as lost or stolen in your asset register. Coordinate with finance and legal before considering payroll deductions or device write-offs, as state regulations on final pay deductions vary significantly.
Revoking API tokens, service accounts and app passwords
Disabling an employee's single sign-on (SSO) profile does not invalidate personal access tokens, developer keys, or application passwords that bypass standard identity providers. If a departure involves technical staff or operations leads who build internal tooling, revoking non-human credentials is a separate, urgent security step.
Unchecked credentials create two distinct failure modes. Either an active key remains valid indefinitely after a worker departs, or revoking a shared key halts business-critical data pipelines with zero warning.
Use this sequence to discover and cycle credentials safely during the offboarding window:
Audit developer environments and repositories. Review GitHub, GitLab, or internal code hosts for personal access tokens (PATs) and SSH keys tied to the user's corporate profile. Check repository and organization secret stores to confirm the individual did not embed personal credentials into deployment scripts or CI/CD pipelines.
Enumerate application passwords and connected OAuth grants. In Google Workspace, Microsoft 365, and major collaboration hubs, inspect the third-party apps granted access by the user. Revoke all user-generated app passwords, which employees often create to connect local mail clients or custom scripts past multi-factor authentication (MFA).
Inventory shared service accounts. Cross-reference the departing employee's name against internal documentation to see which shared system identities they accessed. If your organization lacks a centralized secret manager, treat any service account the employee knew as compromised. When planning updates to core architecture, learning how to audit your operations tech stack in one week can surface hidden integrations before staff changes occur.
| Credential Type | Common Locations | Action Required | Risk Level |
|---|---|---|---|
| Personal Access Tokens (PATs) | Git hosts, project trackers, BI tools | Revoke immediately via admin console | High: bypasses SSO and MFA |
| App-specific passwords | Email suites, directory services | Delete user app password entries | High: enables direct protocol access |
| SSH keys | Production servers, code repos | Remove from authorized_keys files | Critical: grants server-level access |
| Shared service credentials | Cloud consoles, payment processors | Rotate key and update downstream tools | Medium to Critical: potential service disruption |
Rotate shared credentials systematically rather than terminating them blindly. Set up the replacement secret, inject it into the production script or integration, verify that runs complete successfully, and only then purge the old credential. For automated pipelines, maintaining a strict inventory prevents operational downtime when cycling these access layers.
Handling orphan automations and workflow ownership transfer
The fastest way to break a production workflow is to revoke an employee's single sign-on access before transferring ownership of their automations. Modern operations teams rely on no-code tools and iPaaS platforms where individual users frequently build business-critical integrations under their own credentials. When that user account is deactivated, silent failures cascade across your data pipeline.
To prevent orphaned automations, treat automated workflows as formal company assets during the employee offboarding SOP. Run this transfer audit at least five business days before the user's final day.
The Automation Audit Process
Review platforms where shadow workflows commonly hide:
- iPaaS platforms: Check personal and shared workspaces across platforms like Make, n8n, and Zapier. If your team is evaluating how these tools handle centralized administration, see our comparison on Zapier vs. Make vs. n8n: How Operations Teams Should Choose an Automation Platform.
- Database scripts and webhooks: Look for scheduled Airtable automations, Google Apps Scripts bound to personal sheets, and custom webhooks triggering internal systems.
- Internal bots and RPA: Identify desktop RPA routines, Slack bots, and scheduled cron jobs running on local machines or user-provisioned cloud instances.
Transfer-or-Delete Decision Matrix
Not every automation should be saved. Evaluate each discovered workflow against this criteria:
| Scenario | Primary Signal | Action Required |
|---|---|---|
| Critical Utility | Feeds a production database, bills a customer, or routes sales leads. | Migrate immediately to a dedicated service account. Assign a new operational owner. |
| Team Convenience | Posts team reminders or reformats non-essential internal alerts. | Transfer ownership to a team peer using their standard business account. |
| Redundant or Inactive | Has not run successfully in over 30 days or duplicates standard system features. | Document the trigger logic, export a JSON or blueprint backup, then permanently delete. |
| Unknown Purpose | Triggers frequently but lacks documentation or clear business stakeholders. | Disable the trigger for 48 business hours. If no team reports an issue, archive and delete. |
Handoff Execution Checklist
Once you establish which automations to keep, execute this handoff sequence:
- Re-authenticate all connection nodes: Swap out personal OAuth tokens with shared credentials from a team password vault or dedicated service identity.
- Move to shared workspaces: Remove workflows from the user's private folders and place them into shared team folders.
- Update notification endpoints: Re-route execution error emails from the departing employee's inbox to a team distribution list or shared Slack channel.
- Trigger a manual run: Test the complete workflow end-to-end under the new credentials before the departing user logs off for the final time. Ensure that outputs land in the intended destination without authentication errors.
Audit trail template and documentation requirements
Start with the answer: Every offboarding needs a single, time-stamped record that proves who did what and when. Use the template below as your minimum viable audit trail.
What to log
- Who triggered the exit (manager, HR, or employee resignation).
- Date and time of last day or termination notice.
- Systems disabled (name, date/time, actor).
- Assets collected (device serial, license key, date returned).
- Tokens and credentials revoked (API keys, service accounts).
- Automations reassigned (workflow name, new owner).
- Final sign-offs (IT, HR, manager, security).
Audit trail template
| Event | System / Asset | Action Taken | Actor | Date/Time | Status |
|---|---|---|---|---|---|
| Last day confirmed | HRIS | Exit date set | HR | 2024-06-14 09:30 | Done |
| Email access disabled | Google Workspace | Account suspended | IT Admin | 2024-06-14 10:05 | Done |
| Laptop returned | Device #C3P0 | Collected, serial logged | IT Asset | 2024-06-15 14:00 | Done |
| GitHub token revoked | GitHub | API key deleted | DevOps | 2024-06-14 11:10 | Done |
| Zoom license reclaimed | Zoom | License freed | IT Admin | 2024-06-15 09:20 | Pending |
| Automation reassigned | Zapier | Workflow moved to new owner | Ops Lead | 2024-06-16 10:00 | Done |
| Final review | All | Sign-off | Manager | 2024-06-16 11:00 | Pending |
Retention and sign-off rules
- IT and security logs are retained for at least 90 days, or longer if required by your SOP governance policy.
- HR and legal records follow your company's document retention schedule, typically one year for departed employees.
- Who signs off: IT (systems disabled), HR (employment ended), manager (team transition), and security (compliance check).
- Storage: Keep the audit trail in your system of record or a dedicated compliance folder, not in email threads.
Use this template as part of your broader SOP template library and review it quarterly for accuracy.
Common offboarding mistakes that create security gaps
Most offboarding security gaps come from four repeatable mistakes, not from skipping the obvious steps. A departure checklist can look complete while still leaving doors open. The risk is usually in what the checklist does not cover.
Skipping token and API key revocation Disabling a user account does not always kill personal access tokens, API keys, or app passwords. An ex-employee can still call internal systems or export data through an automation platform. Prevention: Add a token sweep to the offboarding ticket. Require the IT or automation lead to search identity and app logs for tokens issued to the departing email, then revoke them individually.
Forgetting shared inboxes and distribution lists A person may leave while still listed as an owner or member of a shared inbox, alert channel, or distribution list. Replies and password resets can keep landing in a mailbox no one monitors. Prevention: Treat shared access as its own asset. Run a group membership report on the last day and remove the user from every shared mailbox, channel, and list before the account is disabled.
Running your first offboarding drill and keeping it current
The only way to verify an offboarding SOP works before a high-risk departure is to run a tabletop simulation using a test identity.
To execute a mock offboarding drill, create a dummy employee account across your identity provider, primary communication tools, and key business applications. Have a department lead assign this identity several active assets: a test shared folder, a sample automation, and membership in two access groups. Then, trigger the deprovisioning workflow unannounced to the operations team handling the ticket.
Measure three core metrics during the exercise:
- Time to first lock: The minutes elapsed between the offboarding trigger and the primary identity provider suspension.
- Coverage rate: The percentage of target applications successfully revoked within the defined service level agreement without manual intervention.
- Orphan rate: The count of active scheduled workflows, shared credentials, or calendar events still running under the test identity 24 hours later.
Document every missed system, failed token revocation, or delayed handoff identified during the drill. Treat every gap as a defect in the process, not an individual operator failure.
To prevent your checklist from drifting out of date as teams adopt new software, embed offboarding checks directly into your regular operating cadence. Tie review cycles to standard SOP Governance: Ownership, Versioning and Review Cycles so changes in your tech stack trigger automatic checklist updates.
Run a quarterly cross-functional review with IT, HR, and operations leads. During this review:
- Reconcile your active single sign-on catalog against the finance department's corporate card receipts to spot shadow IT.
- Review all offboarding tickets completed in the previous quarter for exceptions or manual overrides.
- Update the standard checklist whenever a department introduces or replaces a core tool using the procedures from How to Audit Your Operations Tech Stack in One Week.
Key takeaways
- Treat offboarding as a controlled handoff of access, assets, and workflows rather than an HR paperwork exercise.
- Disable the identity provider record first, then manually deprovision any system not connected to single sign-on.
- Revoke personal access tokens, API keys, and app passwords separately because disabling SSO does not always invalidate them.
- Transfer or delete automations before the employee's final day to prevent silent failures in production workflows.
- Collect physical assets and reclaim software licenses on the final day, and flag unreturned devices as lost after five business days.
- Keep a time-stamped audit trail with sign-offs from IT, HR, the manager, and security.
- Run a quarterly review and an offboarding drill with a test identity to keep the process current.
Pick one upcoming departure or a test identity and run the full checklist this month. Record every missed system or delayed step as a defect to fix. Use that record to update your SOP before the next real exit.
A note on sources
This is a framework article. It is built on common operating practice and does not cite outside statistics or studies. The templates and examples here are starting points, so test them against your own data and adapt them before you rely on them. If you spot something that looks wrong, tell us.