IT onboarding and offboarding: a checklist for staff changes

Every new hire means accounts to create, licenses to assign and equipment to prepare — and every departure means the exact reverse process, which is the one that often gets forgotten. A solid IT onboarding and offboarding process is not extra paperwork; it protects your company, both from wasted time at the start and from security risk at the end. The two moments rarely get the same attention — a bad start is obvious right away, a neglected exit only shows up months later.

Why a clear process matters

Without a checklist, every new hire depends on someone's memory. A forgotten account costs the new employee a lost day, and a forgotten access right at departure leaves an open door into your systems, sometimes for months. A company with 20 employees and normal staff turnover easily reaches 15-20 arrivals and departures a year — enough for a repeatable process to matter, rather than improvising each time.

Onboarding checklist for a new employee

• Account and email — created before day one, with a temporary password and a forced change on first login.
• Software licenses — assigned to match the role (Office, specific apps), not "whatever is left over".
• Equipment ready to go — a laptop or workstation already configured, updated and with antivirus installed.
• Access to folders and apps — limited to what the role actually needs, not broad access "to keep things simple".
• Basic security training — how to spot a phishing email, what to do with a password, who to call for help.
• Signed acceptable-use policy — a short, clear document stating what is allowed on company equipment.

A properly prepared first day also shortens the time it takes a new hire to become productive — no hours lost figuring out who to ask about a missing password or access right.

Offboarding checklist for a departing employee

• Accounts disabled the same day — not "tomorrow" or "this week", but on the day they leave.
• Email forwarded — to a manager or colleague, so ongoing work is not lost.
• Equipment recovered — laptop, phone, access tokens, badges.
• VPN access and active sessions revoked — including any session left open on a personal phone, if remote access was ever granted.
• Relevant files transferred — to a manager or colleague before the account is deleted.
• Licenses released — so you stop paying for a seat nobody uses.

Order matters here: recovering equipment and cutting off remote access should happen before, or right at, the exit conversation — not a few days after it.

Why neglected offboarding is a real security risk

An active account that belongs to a former employee is exactly the kind of vulnerability that stays invisible until it is exploited. It can be misused by someone who left on bad terms, but it is just as easily compromised through an ordinary attack — an old password, unused by anyone, but still valid. In practice, many small-company security breaches start exactly here: an account that should have been disabled months earlier. The risk grows further when the former employee had access to shared accounts or financial folders.

Who owns it — HR and IT together

Onboarding and offboarding fail most often at the boundary between departments: HR knows the start or end date, but IT finds out late. The fix is a simple shared flow — HR notifies IT a few days before a start date and, critically, on the same day a departure is decided, not after the employee has already walked out. In a small company, this can be as simple as one email sent to a fixed list of people.

What a well-built process looks like

It does not need expensive software. A simple digital checklist attached to every hire and departure in HR's system, with a box ticked for each step, removes almost every "we forgot that license" mistake. Companies working with an outsourced IT provider usually build this into the maintenance contract as a standard step, not an exception. An annual review of active accounts against the current staff list catches anything that slipped through along the way.

How to start

If onboarding and offboarding currently happen ad hoc, a helpdesk service backed by IT outsourcing can take over the whole process, with a clear procedure for every arrival and departure. A security audit will show whether old accounts are still active. Contact us to set up a clear process.