IT offboarding checklist (free CSV)
The most common audit finding in mid-size Indian companies is an account that stayed live after someone left, and it is almost always a communication failure rather than a technical one. This is the checklist that fixes it.
No email address, no sign-up. It opens in Excel, Google Sheets or LibreOffice.
Why offboarding fails
Nobody forgets to disable the email account of someone whose farewell they attended. What gets missed is the contractor whose last day moved, the person who resigned while their manager was on leave, and the eleven SaaS tools IT never knew existed because a team bought them on a card.
So the checklist has two jobs. It has to cover the systems nobody remembers, and it has to have one owner per line with a deadline — a shared responsibility is the same as none. The timing column matters more than it looks: some steps must happen before the person is told, some at the moment of exit, some in the following week.
The order that works
- HR confirms the last working day in writing, and IT is told the same day — not the day before the exit.
- Before the last day: list every system the person has access to, including things bought outside IT. Ask their manager, not just your directory.
- Handover first, while they are still cooperative and still know things: documents, ownership of tickets, shared mailbox membership, on-call rotations, vendor contacts.
- On the last day, at the agreed hour: disable the identity account. That single step removes single-sign-on access to most of the list.
- Immediately after: revoke anything that does not use SSO — local admin, VPN certificates, database users, API keys, code repositories, cloud consoles.
- Recover devices and record the return, against your asset list, so the item does not silently disappear.
- Convert or forward the mailbox per policy, and set an auto-reply naming who to contact instead. Do not simply delete it.
- Within a week: remove them from shared drives, groups, chat channels, the website, the phone tree, and every customer-facing listing.
- Within a month: verify. Re-run an access report and confirm nothing is still live. This step is the one everybody skips and the one auditors ask about.
Run it as a ticket, not a document
A checklist in a document is a checklist somebody has to remember to open. The same list as a parent ticket with one task per line — assigned to IT, HR, finance and the manager — is visible, timestamped and auditable, and each team sees only their own task while HR sees whether the whole thing is on track.
If you take one thing from this file, take that. The CSV below is a starting list; the value is in it being a workflow with owners rather than a page in a wiki.
What is in the file
| Column | Required | Notes |
|---|---|---|
step |
Yes | What has to happen. One action per row. |
owner |
Yes | IT, HR, Finance or Manager. Exactly one. |
timing |
Yes | before-exit, on-last-day, within-week or within-month. |
system |
No | Which system or asset this applies to. |
evidence |
No | What proves it was done — a screenshot, a ticket number, a signature. |
notes |
No | Anything specific to this leaver. |
Questions
How quickly should access be revoked?
The identity account on the last working day, at an hour agreed with HR. Anything that does not go through single sign-on within the same day — that is where the gaps live, and where an auditor will look first.
What about the mailbox?
Forward or convert it per your retention policy and set an auto-reply naming a colleague. Deleting it destroys correspondence you may be legally required to keep, and leaving it live is an open door.
Do we really need the verification step a month later?
Yes, and it is the one everybody skips. Re-running an access report is fifteen minutes and it is the only step that catches what the first nine missed.
This template is also the import format
Fill it in, and it loads straight into a workspace with column mapping, a row-by-row error preview and a rollback if you do not like the result.