Employee Offboarding IT Checklist for Small Businesses

When an employee leaves, the IT goal is straightforward: remove their access at the agreed time, keep business information available to authorized people, and record what still needs attention. Deleting an email account is only one part of that work.

Use this checklist with your manager, HR contact, and IT provider before the departure. It works as a planning tool whether the person works in a Fort Worth office, a Weatherford location, or remotely elsewhere in the U.S. The exact account controls depend on the services you use.

1. Name the owner and agree on the timing

Assign a business decision-maker and an IT person responsible for execution. Record the departure time and time zone, who approves access removal, and who will receive files, incoming requests, and equipment. Share sensitive departure details only with the people who need them.

Separate business decisions from technical tasks. A manager decides who should handle an unfinished customer project; IT implements the approved access. If legal preservation, employment requirements, or a disputed departure may affect the plan, get the appropriate advice before deleting information.

2. Inventory access beyond business email

Start with the employee's role and normal work, then check the account inventory. Include business email, file storage, collaboration tools, remote access, accounting, customer records, scheduling, password managers, and specialist applications. Ask about accounts created outside the usual onboarding process.

• Which accounts use the person's individual login?
• Which shared passwords, recovery methods, or physical access credentials did they have?
• Do they administer a website, domain, cloud service, or vendor portal?
• Are business subscriptions or automated processes tied to their identity?

The CIS access control guidance covers user, administrator, and service accounts. That distinction is useful here: a departure checklist should look beyond the everyday login to privileged access and business dependencies.

3. Decide what to preserve and who needs it

Identify business files, shared work, customer conversations, calendars, and pending approvals that need a successor. Choose an authorized destination and owner. Avoid copying an entire mailbox to a personal account or giving a successor the former employee's password.

Access restriction and data handover are separate tasks. For example, Microsoft's former-employee guidance treats blocking sign-in, preserving information, granting authorized access, and account removal as distinct steps. Your provider should check the current procedure and retention implications for each platform before removing accounts or licenses.

Do not assume that a file visible in a desktop folder is stored in the shared location the business expects. Confirm where the working copy lives and that the new owner can open it. Agree on any temporary mailbox access or routing, its purpose, and a review date.

4. Remove access using each service's current process

At the approved time, have IT carry out the plan across the inventory. That may involve disabling sign-in, revoking active sessions, removing remote access, and changing shared credentials the employee knew. Check the service's documented controls rather than assuming one password change ends every session in every application.

NIST's small-business guidance recommends removing access when employees leave or their needs change. For the business owner, the practical question is whether that removal happened everywhere the person could work.

Review recovery contacts, authentication methods, administrator roles, and delegated access. If a business process depends on the departing person's account, assign an approved replacement and test the process. Record any access that cannot yet be removed, why it remains, and who will resolve it.

5. Close out equipment and remote work

List company laptops, phones, security keys, storage devices, badges, and other issued equipment. Record the return method, responsible person, and expected date. For remote staff, settle shipping arrangements before the last day when possible.

Confirm business data preservation and approved handling before erasing or reassigning a device. Personally owned devices need a separate, authorized approach based on your policies and available management controls. If equipment cannot be recovered promptly, document the outstanding item and ask IT what access can still be restricted.

6. Verify the handover and keep a short record

Have IT confirm the completed access changes using the evidence each service provides. Have the successor verify that the needed files and workflows are usable. A checked box for “email disabled” does not establish that a customer portal, shared password, or website administrator account was addressed.

Keep a simple record with the account or asset, approved action, completion time, person responsible, and any remaining exception. Give unresolved items an owner and next review date. Include material exceptions in your monthly IT report.

A small example of a missed dependency

Imagine an operations coordinator who handles email, scheduling, invoicing, and the company website. This is an illustrative example: closing their email could leave a website renewal notice and an invoice approval waiting with nobody responsible. A role-based checklist would assign both responsibilities, transfer the necessary access, and check that the next notice or approval reaches the right person.

Make departures part of your regular IT process

Keep the checklist beside your employee onboarding plan and update it when the business adds a service. Ask your managed IT provider which departure tasks are included, what notice it needs, and who owns applications managed by another vendor.

If those responsibilities are unclear, start with IronLink IT's free Business IT Review: a 20-minute conversation and a one-page summary of three priorities. No logins, scans, or system access are required; it is not an audit.