“Employee Offboarding Checklist Template: Free Download, Sections and How to Use It”

What is an employee offboarding checklist template?

It is a structured document that lists every action required to end someone’s employment cleanly, with an owner and a due date attached to each action. It exists so that the process is repeatable: the same steps, in the same order, whether the person leaving is a warehouse coordinator or the head of finance.

The difference between a checklist and a list of good intentions is ownership. “Revoke access” is a wish. “Disable SSO account, owner IT, due day 0 at 09:15, evidence: screenshot of disabled status” is a control. The template is where you encode the second version once, so that eleven departures a year do not each become a small improvisation.

There is also a legal dimension. In the United States, HIPAA requires covered entities to have procedures for terminating access to electronic protected health information when a workforce member’s relationship ends, at 45 CFR 164.308(a)(3)(ii)(C). NIST SP 800-53 control AC-2(3) requires accounts to be disabled within an organisation-defined time period, which means the number is yours to set and defend. SOC 2 auditors ask for the same thing in evidence form: show me the ticket, the timestamp, and the approval.

What sections should the template contain?

Eight sections cover a normal departure, and a ninth exists only for executives and anyone with signing authority. Each section should be able to be completed by one named person without asking anyone else what it means.

Two sections are commonly missing and worth adding deliberately. First, a system inventory line per person, meaning a list of every application their identity can reach, pulled from your identity provider rather than from memory. Second, a documented decision for shared credentials, because the shared inbox password, the social media login, and the payment platform admin are usually not tied to a personal account and therefore quietly survive the departure.

Which access items must be revoked, and when?

Access revocation is the only part of offboarding where hours matter, and the order matters as much as the window. Revoke in this sequence: identity first, then communication, then money, then data, then physical.

Three timing principles make the table work. For involuntary exits, suspend first and explain second: the conversation happens, then the laptop closes, and the identity is disabled within minutes, not at the end of the day. For voluntary exits, agree the handover date and revoke at the end of it, so the person can hand over files on their final afternoon without retaining access that night. For contractors, set an expiry at creation, because nobody remembers a contract end date that was agreed eight months ago.

If you want one number to defend in an audit, write this sentence into the template: identity and email are disabled within 60 minutes of the effective time, and everything else within one business day. NIST leaves the window to you; your auditor will only check that you met the window you published.

What does the six-week timeline look like?

A departure has a shape, and the template should follow it rather than starting on the last day. The most common mistake is treating offboarding as a single-day event, which is how knowledge leaves with the person.

T-30 to T-14: plan and map. Identify every system the person can reach from the identity provider’s application list. Confirm the legal basis for the exit, the notice period, and who will absorb each live project. Book the exit interview. Nothing is revoked yet; this is the mapping stage, and it is where most of the risk is removed.

T-14 to T-7: transfer knowledge. The person writes a handover document listing live work, recurring obligations, external relationships, and anything only they know. Their manager reviews it and asks one question per item: who does this next month? Reassign projects in the tool, not in an email.

T-7 to T-1: prepare the mechanics. Draft the team announcement. Confirm the asset list. Prepare the mailbox conversion. Check for auto-forwarding rules, calendar delegates, and personal email addresses saved in client records. Assign the second approver for banking changes.

Day 0: execute. Disable identity, convert mailbox, rotate shared passwords, remove from groups, deactivate the badge, and collect devices. Take screenshots as evidence. Send the internal announcement at a fixed time, with a forwarding contact, so colleagues stop messaging the closed account.

Day 1 to Day 3: verify. Pull the identity provider’s report and check that every application shows the account as disabled or the data reassigned. This verification step is what turns a checklist into an auditable control.

Day 7 to Day 14: settle money. Final pay, expense reimbursement, PTO payout, benefits end date, and the return of any company-funded equipment deposit.

Day 30 to Day 90: close and delete. Archive what policy requires, delete what it does not, remove the mailbox, and hold the review that updates the template.

What does a filled-in example look like?

A template is only credible if you can see one row completed. Here is an excerpt from a real-shaped example for a programme coordinator leaving voluntarily.

The last row is the one people skip. Offboarding templates improve only if the review step produces an edit, and the edit is dated.

How do you run the last week without drama?

Run the last week from a single page, owned by one person, with a 15-minute stand-up each morning. Departed employees rarely cause problems; ambiguous ownership does.

Start with the announcement, because it controls the rumour. Decide who tells the team, when, and what is said about the reason. A short factual note beats a silence that fills with speculation. Then sequence the handover: files first, relationships second, recurring tasks third. The relationship handover is the one people forget, and it is the one clients notice within a week.

Keep the departing person useful rather than excluded. Most people want to leave well, and a clear task list gives them a way to do it. The exception is an exit for cause, where access and communication are cut first and the checklist runs in a compressed order.

Then do the boring verification. Someone other than the person who executed the revocation should confirm the identity provider report, the shared password rotation, and the mailbox conversion. Self-verification is not verification.

What does offboarding cost when a step is missed?

Missed steps cost money in three places: admin time, unused subscriptions, and incidents. All three are measurable, which is why the checklist earns its place.

Example one, admin time. A 60-person company with 12 departures a year spends about 3.5 hours per departure on offboarding tasks when the template is followed: 42 hours a year. At a loaded rate of $45 an hour, that is $1,890. Without a template the same work takes roughly 7 to 9 hours, because each departure involves hunting for the account list and asking three people what the password policy is. The difference is close to $2,000 a year, plus the risk.

Example two, forgotten seats. Four paid seats survive a departure because nobody removed the app account after disabling the identity. At $12 per seat per month, that is $576 a year for four people who no longer work there. Run the same arithmetic across a company with 40 annual departures and a $25 average seat price and the leak reaches $12,000 a year, hidden inside the software line of the budget.

Example three, exposure window. Suppose the current practice is to disable accounts at the end of the month, roughly 72 hours after the last working day on average. Moving to a 1-hour window removes 71 hours of exposure per departure. Across 12 departures that is 852 fewer hours a year in which a departed person’s credentials, or the credentials of anyone who phished them, still work. The cost of the change is a 20-minute process edit and a rota for who is on call on a Friday afternoon.

There is a fourth cost that is harder to put in a spreadsheet: the customer who emails the departed account and receives silence. One lost renewal usually outweighs every licence saving in this article.

What legal deadlines must the checklist carry?

Legal deadlines differ by country, so the template should hold the ones that apply to you and say so explicitly. In the United States, three are worth building in as fixed rows.

Benefits continuation. Under COBRA, the employer must notify the plan administrator within 30 days of the qualifying event, and the administrator must notify the qualified beneficiary within 14 days after that. The combined window is 44 days, which means the benefits row on your checklist cannot be closed on the last working day.

Final pay. Most US states regulate when final wages are due, and the rules differ sharply, with some requiring payment at the moment of termination and others allowing the next regular payday. The template should name the rule for each state where you employ people rather than assuming one national standard.

Access under sector rules. If you handle health data, HIPAA’s termination procedures at 45 CFR 164.308(a)(3)(ii)(C) apply, and if you handle payment card data, the PCI DSS requirement to revoke access for terminated users applies immediately rather than at month end.

For European organisations, the relevant deadlines usually come from employment law and the GDPR rather than from security frameworks: final pay and holiday settlement per national law, and deletion of personal data once the retention purpose ends. Build the retention period into the template as an explicit row with a date, because “we will delete it eventually” is how a five-year-old personnel file ends up in a live cloud drive.

Where do offboarding checklists fail?

They fail in four recognisable ways, and each has a structural fix rather than a training fix.

The checklist lives with one person. When the operations lead is on holiday, offboarding becomes improvised. Fix: make the template a shared document with a named backup, and put the trigger in the HR system rather than in someone’s memory.

The account list is written from memory. People forget the tools they used twice a quarter. Fix: pull the application list from the identity provider, not from a conversation.

Revocation is executed but not evidenced. Auditors do not accept “we always do it”. Fix: attach a screenshot or a ticket reference to each row, which takes 20 seconds and answers the question permanently.

The process ends at Day 1. Licences, mailbox archives, and data retention are still open. Fix: schedule the Day 30 review as a calendar event at the moment the departure is confirmed, not as an intention.

A fifth failure is cultural. If offboarding is framed as a security procedure aimed at a suspected traitor, managers avoid it because it feels hostile. Frame it as a handover service that protects the leaver’s reputation and the team’s continuity, and completion rates rise without anyone being reminded.

How does Doitify help run offboarding?

Doitify is our product, so read this as disclosure rather than review. Offboarding is a project with a date, a dozen owners, and evidence requirements, which is exactly what the tool is built for: projects, tasks, sub-tasks, checklists, owners, and due dates, with Kanban boards, Gantt charts, calendars, workload views, reports, automations, and documents in the same workspace.

In practice, teams use it three ways. A template project is duplicated for each departure, so the tasks and owners arrive pre-filled. Automations create the Day 0, Day 1, and Day 30 tasks the moment a departure is recorded, which removes the scheduling failure. And the evidence column holds the ticket link or screenshot, so the review at Day 30 has something to read.

The honest limitation: Doitify does not disable accounts. It coordinates the humans who do, and it holds the proof. If your identity provider already has a joiner-mover-leaver workflow, the template is the human layer around it, not a replacement.

Conclusion

An employee offboarding checklist template is not paperwork. It is the difference between a departure that takes three hours and one that takes nine, between four forgotten licences and none, and between a revoked account and a live credential nobody is watching. The template earns its keep through the timing column and the evidence column, not through the number of rows.

Download the structure above, fill it once with real names and real systems, and add two habits: disable identity within the hour, and review the template 30 days after every departure. The first habit closes the risk, and the second keeps the checklist honest.

If this post on employee offboarding checklist template was helpful, you might also enjoy Client Onboarding Project Template and Employee Onboarding Project Template.