Employee offboarding & access revocation SOP template

Offboarding is onboarding’s security-critical mirror. Done casually, it leaves live credentials, orphaned accounts, and undocumented knowledge scattered behind every departure. This template makes the exit a checklist with owners and timestamps — and closes with a signature, because “we’re pretty sure we revoked everything” satisfies no auditor.

On notice of departure

Open the offboarding ticket

The moment a departure is confirmed (resignation accepted or termination decided), HR opens the offboarding ticket with: name, role, last working day, manager, and departure type. The type matters — a standard exit runs on the last day; a for-cause termination runs immediately and in a compressed order.

Inventory access and assets

IT pulls the full list: SSO-connected apps, direct (non-SSO) accounts, shared credentials the person knows, API keys they created, repositories and cloud consoles, physical assets (laptop, badge, keys, cards). The non-SSO list is where surprises live — build it from expense reports and vendor invoices, not memory.

Knowledge handover

Transfer ownership before the last day

Every system, document, and recurring duty owned by the leaver gets a named successor — not “the team”. Transfer ownership of: documents and folders, scheduled reports and cron jobs, vendor relationships, and any customer relationships. Update on-call rotations now, not after the first missed page.

The handover document

The leaver writes one page per major responsibility: current state, next deadlines, where things live, open threads. The successor reads it and asks their questions while the leaver is still here — that’s the entire point of the notice period.

Last day — revocation

Revoke in order

At the agreed hour: (1) SSO/identity provider first — this kills most access in one action; (2) direct accounts from the inventory, checked off one by one; (3) shared credentials the person knew get rotated, not just noted; (4) API keys and tokens they created get revoked or reissued under the successor; (5) badge and physical access. Email forwards to the manager for 30 days, then the mailbox archives.

Recover equipment

Laptop, monitors, badge, hardware keys — checked against the asset inventory, condition noted. Remote employees get a prepaid return label with the offboarding notice; the ticket stays open until tracking shows delivery.

Confirmation and sign-off

Verify, then sign

A second person (not the one who ran the checklist) spot-checks: attempt login to three sampled systems, confirm SSO is dead, confirm shared credentials rotated. Then both sign the offboarding record. The signature is the artifact that turns “we did it” into evidence — require it on every exit, no exceptions for friendly departures.

Retention

Keep the signed record with timestamps and the access inventory for your audit-retention window. When a compliance review asks “how do you know access was removed?”, this document is the answer.