Onboarding and offboarding checklist

Why a checklist matters

Onboarding and offboarding happen often enough to matter but not so often that anyone remembers every step. Without a checklist, new hires wait days for accounts and equipment, while former employees may keep access to email, cloud apps or shared folders for months. Both situations cost money, and the second can create a privacy breach under PIPA if personal information is accessed after someone leaves.

A written checklist, shared between HR, managers and your IT provider, makes the process repeatable. It also creates a record showing that access was granted and removed appropriately, which is useful for audits, insurance questionnaires and any investigation after an incident involving a former staff member. It removes guesswork for everyone.

Before the first day

Ask managers to submit a request at least a week before the start date, listing the role, required applications, shared mailboxes and any special equipment. Base access on the role rather than copying another employee's permissions, which tends to spread excessive access across the organization over time. A standard request form makes this much easier for busy managers.

Prepare equipment in advance so it is ready and tested when the new person arrives. The items below cover the most common needs for an office or hybrid employee. A new employee who spends the first morning waiting for a password or a laptop forms an early impression of the organization, and that wait is entirely avoidable with a little planning and a consistent checklist.

• Create the user account and assign licences
• Enrol multi-factor authentication on day one
• Prepare a laptop with encryption and security tools installed
• Add the user to the correct groups, not individual permissions
• Set up phone, voicemail and building access
• Schedule security awareness training in the first week

The first week

On the first day, walk the new employee through signing in, setting up multi-factor authentication and finding shared files. Have them read and acknowledge your acceptable use and privacy policies. Explain how to contact the help desk and how to report a suspicious email or a lost device, since these are the situations where speed matters most.

At the end of the first week, have the manager confirm that the employee has everything they need and nothing they do not. Correcting access early is easier than discovering a problem months later during an audit or after an employee has changed roles. Ask the employee for feedback on the process too.

Offboarding steps

Offboarding should begin as soon as HR or a manager knows the departure date. For planned departures, schedule account changes for the end of the last day. For terminations, coordinate with your IT provider so access is removed at the moment the conversation happens. Do not simply reset the password, because active sessions on phones and browsers can continue to work.

Decide in advance what happens to the departing employee's mailbox and files. Common approaches include converting the mailbox to a shared mailbox for a manager, setting an automatic reply and moving files to a team location. Recover all company devices, wipe them before reuse and remove the person from any vendor portals or banking platforms.

• Block sign-in and revoke active sessions
• Remove MFA methods and registered devices
• Transfer mailbox and file ownership
• Change shared passwords the person knew
• Remove licences once data is preserved

Keep the process alive

Review your checklists every six months and after any significant system change. Add new applications as they are adopted, especially cloud tools that do not use your main sign-in system, since those are the accounts most often forgotten when someone leaves. Keep a list of every application and who owns it, so each one has someone responsible for removing access.

Once a quarter, compare your active user accounts against your current staff list. This simple check catches accounts that were missed during offboarding, as well as contractors and temporary staff who no longer need access. It is one of the most effective low-cost security habits a small organization can adopt.