A Staff Member Is Leaving: The IT Handover Checklist
Coordinate HR, access removal, business information and equipment recovery without relying on a last-minute password change.
Agree the timing with the responsible manager
A resignation does not always mean access should be removed immediately. The departure date, role, risk and employment arrangements matter. HR or the authorised manager should give IT a clear instruction about timing and approvals.
For an urgent or sensitive departure, use the agreed escalation process. Avoid asking a technician to infer the employment decision from an informal message.
Prepare an offboarding request
- Employee identity and the authorised manager.
- Departure date, exact access-change timing and any exceptions.
- Devices, keys, cards and other equipment to recover.
- Applications, shared accounts and supplier access used.
- Business information and workflows that need a new owner.
- Communication and mailbox requirements approved by the business.
Transfer the work, not the person's password
Identify documents, recurring tasks, approvals and customer relationships that need a new owner. Use supported access or ownership changes instead of sharing credentials. Check scheduled processes and integrations that may depend on the departing person's account.
Do not assume disabling Microsoft 365 also removes access to every other application. Review finance, payroll, social accounts, domains and specialist software separately.
Remove access through a verified process
IT should carry out the authorised actions and confirm what was completed. Depending on the platform, those actions may include blocking sign-in, handling sessions, removing roles, changing shared secrets and removing managed business data.
The exact sequence matters. Establish retention and handover requirements before deleting accounts or removing licences. Involve the appropriate adviser if information must be retained for legal or employment reasons.
Recover and prepare devices safely
Record returned equipment and condition. Agree how business information is preserved and how devices are prepared for the next user. Personal devices require the approved BYOD process; do not apply a blanket full-device wipe.
Close the loop
Ask the manager to confirm the handover. Record unresolved items, ownership and follow-up dates. A completed ticket should show verified actions rather than a single “account disabled” note.
For repeated departures and new starters, use a maintained workflow with approvals and evidence. Automation can help once the responsibilities are clear.
NOX offers managed IT support. If your existing applications cannot coordinate the process, our custom software team can help explore a suitable workflow.