IT offboarding: checklist and best practices for a secure employee exit
Table of Content
Name of the heading
Sign up for our Newsletter
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed vitae purus ipsum
Introduction
IT offboarding is the process of systematically revoking an employee's access, retrieving company hardware, and deactivating software licences when they leave an organisation. Done correctly, it takes under 24 hours and leaves no loose ends. Done poorly, it creates security vulnerabilities, compliance gaps, and hardware that simply disappears. According to IBM Security (2023), 20% of data breaches involve credentials from former employees — making IT offboarding one of the highest-impact processes an IT team manages.
Key takeaways
- Speed matters for security: Every hour of active credentials after a departure is an open attack surface. Access revocation should be triggered the moment offboarding begins.
- Hardware recovery requires a process: Without a tracked retrieval workflow, up to 30% of devices go unrecovered when employees leave (Blancco, 2022).
- Audit trails are non-negotiable: GDPR, SOC 2, ISO 27001, and NIS2 all require documented proof of access revocation and asset return. Manual records don't hold up under audit.
Why IT offboarding fails — and the real cost
Most IT offboarding failures aren't caused by negligence — they're caused by the absence of a structured process. The most common failure points: delayed access revocation (IT isn't notified until days after departure), no hardware tracking (devices disappear because they were never properly logged), licence waste (SaaS subscriptions running for months after someone leaves — Zylo's 2023 data shows 44% of licences in mid-market companies are unused), and no audit trail (when compliance asks for proof, the answer is a spreadsheet nobody trusts).
What a complete IT offboarding process covers
A complete IT offboarding process covers four areas in parallel: access, assets, licences, and documentation.
1. Access revocation
The moment offboarding begins, trigger automatically: email and collaboration access (Google Workspace, Microsoft 365, Slack, Teams), VPN, SSO-connected apps, admin permissions, and physical access. Target: zero active credentials within 24 hours. For admin roles: within the hour.
2. Hardware and device retrieval
Retrieval must begin before the last day, not on it. For remote employees: send a prepaid return label at least one week before departure. For office staff: schedule a handover as part of the workflow. Every device logged during onboarding should be on the retrieval list.
3. Licence and subscription deactivation
Deactivate and reassign or cancel: named SaaS licences, Microsoft or Google Workspace seats, security tools, and anything provisioned during onboarding via role templates. Each deactivated licence either returns to your available pool or generates a direct cost saving.
4. Documentation and audit trail
Who triggered offboarding, when access was revoked, when hardware was returned, who confirmed completion — this is the data that satisfies compliance audits and protects the company in a dispute.
IT offboarding checklist
- Trigger: HR marks employee as Offboarding → IT workflow starts automatically
- Day 0: Revoke email, Slack, Teams, and collaboration access
- Day 0: Revoke VPN and remote access
- Day 0: Disable SSO and connected applications
- Day 0: Flag all assigned hardware for retrieval
- Day 0: Mark licences for deactivation
- Before last day: Send return instructions to remote employees
- Last day: Hardware handover confirmed
- Post-departure: Confirm all devices received
- Post-departure: Deactivate or reassign licences
- Post-departure: Finalise and close audit log
Manual vs automated IT offboarding
Manual offboarding is only as reliable as the person running it that day. Automated offboarding runs the same way every time. Companies offboarding 50 employees per year save roughly 125–250 IT hours annually by automating the process. Hardware recovery rates jump from ~70% (manual) to 95%+ (automated with tracked workflows). Time to access revocation drops from hours or days to minutes.
How equipme handles IT offboarding end-to-end
equipme automates the full offboarding lifecycle from the moment an employee's HR status changes to the final confirmation that all resources have been returned.
- HR system sync: Departure marked in your HR system (60+ integrations) → equipme updates status to Offboarding automatically.
- Automated workflow: Devices flagged for retrieval, licences marked for deactivation, managers see all outstanding resources immediately.
- Offboarding dashboard: Real-time view of every active offboarding — retrieved, outstanding, overdue. Create views like "All offboarding this month."
- Device retrieval tracking: Every asset tracked until returned and confirmed. Return logistics can connect to external providers directly from equipme.
- Complete audit log: Every action timestamped and logged automatically. Audit-ready instantly — no chasing records across systems.
IT offboarding best practices
The companies that execute offboarding without incident treat it as a workflow, not a conversation. Notify IT the moment a departure is confirmed — not on the last day. Build the offboarding checklist from your onboarding records so every assigned asset is automatically on the retrieval list. Treat remote offboarding as a separate workflow with prepaid shipping, clear instructions, and a tracked deadline. Set a 14-day hardware return deadline: escalate to manager at 7 days, to HR at 14, initiate formal recovery at 30. Don't forget shared team accounts and group inboxes — these are frequently missed in manual processes.
Conclusion
IT offboarding done well is invisible — the employee leaves, access disappears, hardware comes back, and the audit log closes itself. That outcome requires a process connected to your HR system, your asset records, and your licence management — not a checklist someone fills in manually. The security and compliance case for automating offboarding is clear. The operational case is equally strong: fewer hours per departure, fewer unreturned devices, fewer licence costs running after people have left.
All your resources in one platform
Book a demo and we'll walk you through how the platform handles your specific needs -no matter your industry, size, or setup.
IT offboarding is the process of revoking an employee's system access, retrieving company hardware, deactivating software licences, and documenting each step when someone leaves. It is the technical counterpart to HR offboarding and is critical for security and compliance.
Best practice is within 24 hours of a departure being confirmed. For employees with admin or privileged access, revocation should happen within the hour. Systems connected to an automated HR trigger can achieve this without manual intervention.
All company-owned hardware assigned to the employee: laptop, desktop, mobile phone, monitors, peripherals, and security tokens. Everything logged during onboarding should be on the retrieval list.
GDPR requires documented proof that data access has been revoked. SOC 2 and ISO 27001 require evidence of access controls and audit trails for departing employees. NIS2 adds requirements for critical infrastructure organisations. An automated offboarding workflow with a complete audit log satisfies all of these.
Set escalation steps: manager reminder at 7 days, HR escalation at 14, formal recovery or write-off at 30 days. In equipme, outstanding resources are visible in the offboarding dashboard and reminders can be automated.