A staff departure checklist for accounts, files and recovery access
Share
Published
A staff departure checklist should cover accounts, active sessions, shared files, connected apps, recovery methods and business records. Assign owners before the departure, remove access at the agreed time and verify both the access removal and the handover of necessary work.
Collecting a laptop does not close a former employee’s cloud accounts. Disabling their main sign-in may not close a separately managed social-media account, an API token or access granted to a personal address. Small teams often discover these gaps when the replacement cannot find a file or the former worker still receives a notification.
The departure process needs cooperation between the manager, HR or administration, IT and the person responsible for privacy. It should work for contractors and temporary staff as well as permanent employees.
Prepare the account and work inventory
Ask the manager to list the services the role uses: business email, file storage, website publishing, customer systems, advertising accounts, messaging tools and specialist software. Compare the list with administrator records. Include accounts that were created directly with a vendor rather than through the organisation’s central sign-in.
For each service, record the business owner, administrator, access-removal method and work that must be transferred. Check whether the departing person is the only administrator, billing contact or recovery contact. Arrange legitimate replacement ownership before removing the access that makes the handover possible.
The US government’s cybersecurity playbook hosted by CISA includes a defined departure process covering physical credentials and account access. That is useful operational guidance; its federal grant context does not make it a general Nigerian legal rule.
Separate access removal from record deletion
An organisation may need to retain particular business records after a person leaves. Decide this through the relevant retention, employment and legal procedures. Closing access does not require indiscriminate deletion of a mailbox or personnel file.
Likewise, business continuity does not justify giving every colleague unrestricted access to the former worker’s messages. Establish who may retrieve which records and why. Use supported delegation or export controls, preserve an audit trail and follow the organisation’s policies for personal material.
| Area | Departure action | Verification |
|---|---|---|
| Main identity account | Disable sign-in at the approved time | Administrator confirms account state |
| Sessions and tokens | Revoke sessions, app passwords and relevant personal tokens | Check the service’s revocation result |
| Shared work | Transfer authorised ownership and remove unnecessary access | New owner opens the required records |
| Recovery methods | Replace personal recovery routes for business-owned accounts | Approved administrator verifies the new route |
| Equipment and badges | Record return or an agreed recovery action | Named person confirms receipt |
Check the access that sits outside the main account
Review groups, shared folders and invitations sent to personal addresses. The shared-folder access checklist helps trace permissions through groups and parent folders. Check social-media page roles and domain, hosting or payment-service administration through the appropriate authorised administrators.
Where a shared secret was known to the departing person, plan a controlled rotation. Identify dependent automations first so the change does not disable a legitimate workflow without warning. Prefer individual accounts and scoped service credentials when the platform supports them.
On personal devices, use only the management controls and procedures that the organisation is authorised to apply. Do not treat departure as permission to erase someone’s personal phone. Record unresolved business-data return or deletion questions and assign them for follow-up.
A fictional agency handover
A freelance editor finishes a contract. Their company email is disabled, but they still have website access under a different username and a scheduled publishing tool connected to a personal account. Meanwhile, a shared folder containing approved images belongs to them.
The agency’s handover owner identifies the independent website account, transfers the permitted files, replaces the publishing connection with an approved organisational one and verifies scheduled work. Access is removed at the agreed time. The record lists the systems checked and one unresolved device-return task rather than simply marking the entire departure complete.
If an outside service itself is being retired, use the vendor exit plan. A person’s departure and a supplier’s closure are related events with different checks.
Review the result after the departure
Confirm that the replacement can perform necessary work without using the former worker’s identity. Review available access logs proportionately and investigate unexpected activity through the normal incident process. Make sure notifications and renewal messages now reach the right owner.
For records scheduled for deletion, consider what happens if an old backup is restored. Our deletion-aware backup restore guide covers that operational gap.
Common questions
Is changing the email password enough?
No. Other services may have independent accounts, active sessions, recovery routes or tokens. Use the service inventory and verify each required action.
Should we delete every record about the employee?
No blanket deletion rule applies. Determine retention and access through the organisation’s applicable legal and business requirements.
Who signs off the checklist?
A named departure owner should gather confirmation from the responsible administrators and manager. Keep unfinished tasks visible with an owner and due date.
Featured image: AI-generated conceptual illustration.
