Here's what happened last month at a company we work with: A developer who'd left three weeks earlier still had active API keys in production. Nobody caught it until he accidentally triggered an alert trying to help his replacement troubleshoot something. That's when they realized their offboarding process was basically Swiss cheese.
Your offboarding probably looks like this: disable email, get the laptop back, remove them from Slack. Done, right? Wrong. The actual security holes and money leaks are hiding in places you're not even checking. API tokens that never expire, monitors collecting dust in home offices, passwords locked in someone's head, that $3,000 monitor sitting in a former employee's closet.
After helping hundreds of companies handle offboarding across six continents, here's what we've learned: the ones with actual checklists recover way more equipment and catch way more security gaps. We're talking thousands per employee in recovered assets, plus all the security incidents they avoid by not leaving access points open for months. One client recovered an average of $4,200 more per departing employee just by tracking what they issued in the first place.
Look, I know another checklist sounds like exactly what you don't need right now. But the 18 items below represent the specific gaps that cost you money, create security vulnerabilities, and force your team to reinvent institutional knowledge every time someone gives notice. Most companies handle the obvious stuff and completely miss everything else. Treat what follows as the IT offboarding checklist you actually needed.
Security & Access Termination
Asset Recovery & Tracking
Knowledge Transfer & Documentation
Compliance & Legal Protection
If you're only going to fix three things, make them these: API tokens and developer credentials (they NEVER get revoked), that pile of equipment sitting in people's homes (you're hemorrhaging money), and getting passwords out of people's heads before they leave (you'll regret not doing this in about six weeks).
The typical offboarding process handles email and laptop recovery but completely misses the access sprawl that creates real security risks. API tokens, third-party OAuth integrations, and developer tools stay active for months after people leave because nobody thinks to check them.
Asset recovery extends way beyond getting the laptop back. Peripherals, accessories, and proper documentation of device condition protect your budget. Most companies lose $4,000+ per departing employee in unrecovered assets simply because they don't track what was issued in the first place. That $50 mouse here, that $100 webcam there, it adds up fast.
Knowledge doesn't have to walk out the door. Password vaults, archived communications, and structured exit interviews preserve what matters, but only if you systematically extract it before access disappears. Otherwise, you'll be trying to figure out why nobody can log into your domain registrar six months later.
Compliance failures during offboarding can bite you months later during an audit. Signed agreements, revoked signing authority, and verified data deletion create the paper trail that protects your organization when questions arise.
A structured IT offboarding checklist isn't busywork. It's the difference between controlled transitions and scrambling to figure out why a former employee can still access your production database three weeks after their last day.
Here's where offboarding really falls apart: all those authentication systems nobody thinks to check. HR disables the email and Slack automatically, sure. But what about the fifteen other ways someone can access your systems? Developer tools, service integrations, that VPN they set up eight months ago. All still active because they're not in your HR software.
Each item here is a potential backdoor that could stay open for months or years if you don't actively hunt it down. You need to think like someone trying to access your systems and close every possible entry point, not just the ones that show up in your dashboard. Every item in this section belongs on your IT offboarding checklist.
SSO should make this easy. Click disable in Okta, Azure AD, or Google Workspace, everything cascades down, done.
Except it doesn't always work that way.
Some apps cache authentication tokens for days. Others let people set up direct logins that bypass SSO entirely. So you disable someone's account and they can still log in for 72 hours. Ask me how I know.
You've got to verify termination across your identity provider, then manually check that the revocation actually took effect. Last year, a SaaS company discovered that cached tokens allowed a former employee to access sensitive systems for three full days after their account was supposedly disabled. The finance team only caught it because someone noticed unusual activity in the logs.
Your offboarding checklist should include a 48-hour follow-up to confirm that access truly disappeared everywhere, not just in your central dashboard. Check your application logs, verify that the user can't authenticate, document the confirmation. This catches the edge cases where your SSO integration isn't as comprehensive as you thought.
VPN access is the skeleton key to your internal network. Period.
And it usually survives weeks past someone's departure because VPN credentials live in a separate system from your primary identity provider, and IT teams forget to sync the two during offboarding. Remote work made this worse. Everyone has VPN access now, not just engineers and admins. That means way more credentials to track and way more potential oversight when someone leaves.
Check your VPN logs for the departing employee's username, then disable it in both your VPN software and any associated certificate authorities. If you're using client certificates for authentication, revoke those too. A fintech company we worked with discovered former employees still connecting to internal resources nine months after leaving. Nine. Months. Want to know what's scarier? That's not even unusual.
This isn't paranoia. It's closing an obvious hole that stays open simply because VPN management happens in a different system than your main offboarding checklist.
| Access Type | Common Oversight | Risk Level | Recommended Action Timeline |
|---|---|---|---|
| SSO/Identity Provider | Cached tokens remain active | High | Verify after 48 hours |
| VPN Credentials | Separate system not synced | Critical | Disable immediately + certificate revocation |
| API Keys | Never expire, broad permissions | Critical | Audit and terminate within 24 hours |
| Cloud Storage | External collaborator access persists | High | Manual removal from all shared resources |
| OAuth Integrations | Third-party apps retain authorization | Medium | Review and revoke all connected apps |
Developers and technical employees accumulate API keys and personal access tokens throughout their tenure. These credentials often have broad permissions and never expire, creating permanent backdoors if you don't actively hunt them down.
The worst case I've personally dealt with? A developer who left in March still had AWS access keys with admin permissions in November. Nobody caught it until the quarterly security audit. Those keys could have done anything to the production environment for eight months.
GitHub personal access tokens, AWS access keys, service account credentials, OAuth tokens. All need individual termination. The problem is that these live outside your central identity system, scattered across platforms and services your team uses daily.
Your IT employee offboarding checklist needs a specific section for technical roles that requires searching GitHub, GitLab, AWS IAM, Google Cloud, and any other platforms where developers create credentials. Don't assume they'll voluntarily hand over a complete list. They probably don't remember half of what they created six months ago.
Here's the tricky part: some of those credentials might be service accounts that automated processes depend on. I've seen production systems break because someone terminated all of a developer's access, including shared credentials that nightly jobs needed. Document what you find before you delete it, and coordinate with team leads to identify which credentials are personal versus shared.
Shared Google Drives, Dropbox folders, OneDrive libraries, Box collaborations. They create a web of access that persists after you disable someone's primary account. Someone might lose their company email but still have edit access to dozens of shared folders because you added them as an external collaborator months ago.
You need to audit every cloud storage platform your company uses and manually remove the departing employee from shared resources. This matters most for finance folders, client files, and strategic planning documents that contain sensitive information.
Sound familiar? A marketing manager at a client company shared a folder with her personal Gmail account for convenience. Made sense at the time. She left the company in April, and in September someone realized she could still view and download the entire 2024 marketing strategy because nobody checked the sharing settings on that one critical folder.
Check for external sharing links too. If someone created an "anyone with the link can view" share, that link works forever unless you explicitly disable it. Your offboarding process should include a sharing audit across all major cloud storage platforms, not just revoking the primary account.
Employees connect third-party apps to company systems constantly. Zapier workflows, IFTTT automations, browser extensions, mobile apps, productivity tools. All requesting OAuth permissions that outlive the employee who set them up.
These integrations can sync company data to personal accounts, trigger automated actions, or provide read access to systems you thought were locked down. That productivity app they installed eight months ago might still be quietly syncing customer data to their personal Notion workspace right now.
Check your OAuth application logs in Google Workspace, Microsoft 365, and any other platforms that allow third-party connections. Revoke any authorizations tied to the departing employee's account. This step requires digging into settings that most people never look at, but it catches the random integrations that create data leakage.
Here's what drives me crazy: some third-party apps request broad permissions when they only need narrow access. When you're auditing these during offboarding, you'll often discover integrations that shouldn't exist in the first place. Document what you find and use it to improve your app approval process going forward. Add that audit to your IT offboarding checklist so it happens every time.
Getting the laptop back is the easy part. The hard part is recovering everything else, making sure devices are properly wiped, and maintaining accurate records that prevent your asset inventory from becoming fiction.
Most offboarding checklist templates focus on the happy path where employees cheerfully return equipment in perfect condition. Reality involves lost chargers, forgotten monitors, devices shipped to wrong addresses, and equipment that shows up three months later in unknown condition. Beyond the basic laptop recovery, a thorough offboarding checklist template should address the complete IT asset recovery process including peripherals, accessories, and proper documentation of device condition.
This is the boring but expensive stuff that nobody wants to deal with. It also quietly decides whether your IT offboarding checklist saves money or just documents losses.
You can't recover what you don't know exists.
Before an employee's last day, compile a complete list of every piece of hardware assigned to them. This goes beyond the laptop and includes monitors, keyboards, mice, webcams, headsets, dongles, adapters, and that second monitor they requested six months ago.
Check your asset management system, review purchase orders, cross-reference with IT support tickets where employees requested equipment. Be honest: can you name every piece of equipment issued to the person who left last month? Most companies discover they have no record of half the items an employee possesses because informal requests bypassed the tracking system.
Someone sent a Slack message asking for a new keyboard, and IT shipped it without updating the asset database. Now that employee is leaving, and you have no documentation that you ever issued them that $150 mechanical keyboard. It's sitting in their home office and you can't even ask for it back because you can't prove you gave it to them.
Creating this inventory before the exit conversation prevents the awkward situation where you're asking for equipment you can't prove you issued. It also gives you a complete picture of what should come back, which makes the next steps significantly easier.
Logistics matter more than most IT teams realize. Remote employees won't automatically know how to return equipment, and assuming they'll figure it out leads to devices sitting in closets for months.
Your offboarding template should include specific instructions: prepaid shipping labels, pickup scheduling links, packing requirements, deadlines. For international employees, customs documentation and shipping restrictions add complexity that you need to address upfront.
I've watched companies lose thousands of dollars in equipment because they sent a vague "please return your laptop" email without instructions. The employee didn't know where to send it, what to include, or how to pack it safely. The laptop sat in their apartment for six months until they finally emailed asking what to do with it.
Be explicit about packaging. Original box preferred, but here's what to do if you don't have it. Include chargers, cables, and accessories. Ship to this specific address, not the office if you're fully remote. Provide a deadline that accounts for international shipping times.
Remote employees need clear logistics for equipment return, and your offboarding template should provide specific instructions similar to how companies streamline laptop returns and offboarding with prepaid shipping labels and detailed packing requirements.
Waiting for physical return before wiping devices creates unnecessary security risk. Use your MDM (mobile device management) or remote wipe capabilities to erase company data as soon as the employee's last day ends.
This protects sensitive information during shipping and makes sure that even if a device gets lost in transit, company data doesn't end up in random hands. Document the wipe in your IT offboarding checklist template with timestamps and confirmation screenshots.
For employees who used personal devices for work (BYOD scenarios), you need a more nuanced approach that removes company data without touching personal files. Make sure your MDM is configured to support containerized wiping before you need it, not when someone's already leaving.
Some companies skip the remote wipe because they're worried about wiping a device that hasn't been properly backed up. That's why backup verification should happen before the last day, not after. Once you've confirmed that all necessary data is preserved in company systems, there's no reason to delay the wipe.
Peripherals are where asset recovery falls apart completely. Employees remember to return the laptop but forget about the USB-C hub, the wireless mouse, the standing desk converter, and the three different charging cables scattered around their home office.
These items add up fast. A $50 mouse here, a $100 webcam there, and suddenly you're losing $500 per employee in unreturned peripherals. When you're managing dozens of offboarding processes annually, those small losses compound into real budget impact.
Your exit process should include a detailed packing list that employees check off as they pack. Some companies send a prepopulated checklist with photos of each item to jog memory. Others require employees to send photos of packed boxes before shipping.
This feels excessive until you calculate how much you're losing in unreturned peripherals every quarter. The standing desk converter thing drives me crazy. Companies spend $400 on ergonomic equipment, then never track it. I've seen standing desk converters show up on Facebook Marketplace still with company asset tags on them.
| Asset Category | Commonly Forgotten Items | Average Replacement Cost | Recovery Strategy |
|---|---|---|---|
| Primary Hardware | Laptop, tablet, phone | $1,200 to $2,500 | Tracked in asset management system |
| Peripherals | Mouse, keyboard, webcam, headset | $150 to $400 | Photo checklist with visual confirmation |
| Adapters & Cables | USB-C hubs, dongles, chargers, HDMI cables | $75 to $200 | Itemized packing list with quantities |
| Ergonomic Equipment | Standing desk converter, monitor arm, footrest | $200 to $600 | Separate tracking for high-value items |
| Specialized Tools | Dev kits, testing devices, industry-specific hardware | $300 to $3,000 | Serial number verification required |
Equipment doesn't always come back in the condition it left. Documenting asset condition during offboarding protects you financially and helps with accurate depreciation tracking.
When devices return, inspect them for damage, missing components, and excessive wear. Take photos, note serial numbers, record condition in your asset management system. This documentation matters for insurance claims, tax depreciation, and deciding whether to refurbish for redeployment or retire the asset.
It also creates accountability. If an employee returns a laptop with a cracked screen and missing keys, you have evidence to potentially recover replacement costs. For companies managing distributed teams, this step often gets skipped because nobody wants to be the company that nitpicks condition.
But accurate records prevent your asset database from becoming fantasy fiction. You need to know what you have, what condition it's in, and whether it's worth redeploying or selling for parts. Proper documentation during the offboarding process includes recording asset condition and depreciation, which helps with accurate understanding of asset depreciation for financial planning and tax purposes.
After helping companies recover and redeploy thousands of devices across 150+ countries, the pattern is clear: organizations with detailed asset tracking during offboarding save an average of $4,200 per employee compared to those who wing it. That gap is the strongest argument for a documented IT offboarding checklist.
Information walks out the door every time someone leaves, and most companies don't realize what they've lost until three months later when nobody can remember how that critical system works.
We're not talking about the formal documentation that already exists (though that needs updating too). The real value is in the informal knowledge: the workarounds, the "why we do it this way" context that lives only in someone's head. An effective employee offboarding checklist treats knowledge transfer as seriously as access revocation, because the long-term cost of lost knowledge often exceeds the security risk of lingering access.
The offboarding process should allocate specific time for knowledge extraction, not just hope it happens organically during someone's final two weeks. Build that time into the IT offboarding checklist itself.
Shared accounts and service credentials often live exclusively in an employee's personal password manager. Marketing might have social media logins, finance might have vendor portal access, operations might have shipping account credentials that nobody else can access.
Before the last day, require departing employees to export or share any work-related credentials from their password manager. This is awkward to ask for and easy to forget, which is why it needs to be a formal checklist item with actual enforcement.
Some companies require all shared credentials to live in a team password manager (1Password Teams, LastPass Enterprise, Bitwarden) specifically to avoid this problem. If you don't have that infrastructure, at least get a credential dump before access disappears.
The alternative? Discovering six months later that nobody can log into the company's domain registrar because the credentials died with someone's personal 1Password vault. This happened to a client in March. They had to go through a week-long identity verification process with the registrar to regain access. Not fun when you're trying to renew domains that are about to expire.
Email contains institutional memory, client communication history, and decision-making context that you'll need later. Convert the departing employee's mailbox to a shared mailbox or export it to an archive before deletion.
This preserves access for their manager and team members who might need to reference past conversations. The same principle applies to Slack, Teams, or whatever communication platform you use. Make sure important channels and direct messages are archived and searchable.
Some industries have legal requirements for communication retention, but even if you don't, losing six months of client correspondence because you immediately deleted someone's email is a painful mistake. Trust me on this.
The offboarding process should include a 30 to 60 day grace period where the mailbox remains accessible before final archival. This gives team members time to search for information they didn't know they'd need until the employee was already gone.
Projects in progress need clear handoffs, not just reassignment in your project management tool. Schedule a formal knowledge transfer session where the departing employee walks through active projects, explains context, identifies blockers, and shares relevant files. Record this session if possible.
Then make sure all project files migrate to shared locations rather than remaining in personal folders. Check local drives, personal cloud storage, and desktop folders for work that never made it to the shared repository.
Engineers have code that never got pushed to the repo. Designers have working files that never hit the shared drive. Everyone has that one critical spreadsheet saved locally that becomes a crisis when it's suddenly inaccessible.
Your IT employee offboarding checklist needs time allocated for this file archaeology. Give the departing employee specific instructions on where to look and what to transfer, because a vague "make sure your files are in the right place" request won't catch everything.
Exit interviews usually focus on HR concerns: why are you leaving, how was your experience, would you recommend us to others. IT should conduct a separate technical exit interview with different goals.
What systems does this person uniquely understand? What undocumented processes do they run? What workarounds exist that nobody else knows about? What's broken but tolerated because they knew how to work around it?
This conversation surfaces the invisible work that will become very visible once they're gone. Record it, transcribe it, distribute it to relevant team members. You're not trying to recreate their entire knowledge base, just capture the critical information that will cause problems if lost.
Companies that skip this step discover gaps three months later when a system breaks and nobody knows how to fix it. The person who understood that legacy integration is gone, and now you're reverse-engineering their work under pressure while everyone asks why this wasn't documented. (Because documentation is boring, that's why. But now you're paying for it.)
Departing employees should update documentation as one of their final tasks. This includes process guides, runbooks, system architecture diagrams, and any internal wiki pages they own.
You're trying to remove single points of failure where one person's knowledge is the only record of how something works. Give them a specific list of documents to review and update, not a vague "make sure your docs are current" request.
Some companies make documentation updates a requirement for final paycheck release (where legally permissible) to make sure it happens. This feels harsh but reflects how critical knowledge preservation actually is.
When you're managing offboarding employees across multiple time zones and roles, standardizing this step prevents knowledge loss from becoming a recurring crisis. Documentation debt compounds over time, and offboarding is your last chance to collect what someone knows before it's gone forever.
The legal and compliance aspects of IT offboarding protect your company from risks that might not materialize for months or years. This is where you create the paper trail that proves you took reasonable steps to protect company interests, customer data, and intellectual property.
Most employee offboarding checklist templates treat compliance as an afterthought, but these items are what keep you out of court or regulatory trouble when something goes wrong. Legal and compliance aspects of your employee offboarding checklist should address secure offboarding automation to make sure you execute critical compliance steps consistently across all departures.
We're talking about the unglamorous work of collecting signatures, verifying deletions, and documenting everything in case you need to prove your due diligence later. These belong in the compliance section of your IT offboarding checklist.
Employees should have signed confidentiality and non-disclosure agreements during onboarding, but offboarding is when you remind them those obligations continue. Some companies require a separation agreement that reiterates confidentiality terms and acknowledges that the employee has returned all company property and deleted all company data from personal devices.
This creates a clear record that the employee understood their ongoing obligations. It also gives you legal standing if they later violate those terms.
Look, I get it. Asking for signed confidentiality agreements on someone's last day feels petty and paranoid. Until you need it. Work with your legal team to determine what documents you need, then make collecting signed copies a mandatory step in your offboarding checklist template. Don't let people leave without this paper trail, even if it delays their final day by a few hours.
The signed agreement serves as evidence that you took reasonable steps to protect confidential information. Without it, you're relying on verbal conversations and implied understanding, which doesn't hold up well in legal proceedings.
Employees with signing authority on contracts, financial documents, or legal agreements need that authority explicitly revoked. This includes DocuSign access, banking authorization, vendor contracts, and any other system where their signature commits your company to obligations.
Notify relevant vendors, banks, and partners that this person no longer has authority to act on your behalf. Update your internal records and remove their signature blocks from templates.
This step prevents situations where a former employee could theoretically sign contracts or authorize payments weeks after departure. It's rare, but the risk is significant enough that your exit process should include a formal authority revocation checklist for anyone who had signing power.
Financial institutions especially need explicit notification when authorized signers leave. A simple email or phone call isn't enough. Most banks require written documentation on company letterhead to update authorized signers on accounts. Yeah, it's tedious. Do it anyway.
If employees used personal devices for work (BYOD), you need confirmation that company data has been deleted. This is legally tricky because you can't force someone to hand over their personal phone for inspection, but you can require written attestation that they've removed company data.
Some MDM solutions allow you to remotely wipe corporate containers without touching personal data, which solves this problem cleanly. If you don't have that capability, get a signed statement confirming deletion.
This matters for GDPR, CCPA, and other privacy regulations that require you to know where customer data lives and make sure it's properly disposed of. For companies handling sensitive data, this verification step is what proves you took reasonable measures to protect information after an employee's departure.
When managing employee offboarding for BYOD scenarios, verification of data deletion from personal devices requires careful handling similar to best practices outlined in IT asset tracking for BYOD environments.
Companies managing global teams face additional complexity here, since data protection laws vary by country and some jurisdictions have stricter requirements for proving data deletion. If you're coordinating offboarding across multiple regions, understanding these nuances becomes critical.
I've watched companies lose six-figure equipment, suffer security breaches, and waste months reconstructing knowledge, all because offboarding was an afterthought. You don't need to be perfect at this. You just need to be methodical.
The 18 items we've covered represent the overlooked pieces that most offboarding checklists miss. You probably already handle email and laptop recovery. What you might be missing are the API keys still active in production, the $3,000 monitor sitting in a former employee's closet, the password to that critical vendor account, or the signed agreement that proves you reminded them about their confidentiality obligations.
Beyond the checklist itself, understanding the complete employee offboarding process helps you build workflows that scale as your organization grows.
The companies that get offboarding right treat it as a process, not an ad-hoc scramble when someone gives notice. They build offboarding checklists that account for different role types (technical employees need different steps than sales reps), maintain accurate asset inventories before they need them, and create documentation habits that make knowledge transfer possible.
Start by auditing your current offboarding process against these 18 items. Which ones are you already doing well? Which ones are completely missing? Then build them into your process incrementally, testing and refining as you go. Score yourself honestly, then turn the gaps into a written IT offboarding checklist.
If someone's leaving in three days and you're just starting this, focus on items 1, 3, 6, 11, and 16. Everything else can wait a week. But if you've got time to be thorough, this entire checklist takes about six to eight hours per employee. Often this is supported by remote equipment management software that automates tracking and recovery.
Your IT offboarding checklist should evolve as your company grows, your tools change, and new risks emerge. What worked when you had 20 employees won't scale to 200. What made sense when everyone was in an office needs adjustment for distributed teams, which is why many organizations turn to comprehensive IT asset management best practices to maintain consistency across locations.
Keep refining the process, and you'll build the kind of offboarding system that protects your company instead of just checking boxes. For companies managing global operations, our research in the State of IT Lifecycle Management shows that methodical offboarding is one of the highest-ROI improvements you can make to your IT operations.
When Upwork needed to scale their offboarding process across a distributed workforce, they discovered that automation and clear checklists reduced offboarding time by 60% while improving asset recovery rates. That's the kind of impact you can achieve when you treat offboarding as something that actually matters rather than an administrative afterthought.