Skip to content
EMPOBase
en

An offboarding checklist that protects data and assets

By the EMPOBase team · · 4 min read

Short answer

An offboarding checklist closes four things when someone leaves: their access to systems and data, the assets they hold, their open finance items, and the knowledge in their head. Name an owner and a date for each step, run the list from the notice date to the last day, remove access on the last day, and keep a record of what was done.

Key points

  • Start offboarding on the notice date, not on the last day.
  • Remove system access on the last day, and review shared accounts and files.
  • Collect assets, and clear advances and open claims before the final payment.
  • Capture handover notes so the work and relationships carry on.

Why does offboarding need a list?

People often leave in a hurry: the last week is busy, the manager is travelling, and nobody thinks about the shared drive. Three risks follow. A former employee can still open files and systems. Equipment and keys do not come back. And the knowledge of how things work leaves with them. A checklist keeps these in view.

What happens before the last day?

Begin on the notice date.

  1. Confirm the dates. Record the last working day, the notice period and any leave still owed. Check local law on final pay and leave payout.
  2. Plan the handover. The line manager lists open tasks, key contacts, files, passwords held in shared tools and anything with a deadline.
  3. Tell the right people. Inform finance, IT, logistics and any partners who need to know.
  4. Hold an exit conversation. Ask why the person is leaving and what you could improve. Record themes, not names, where you share them.

What do you collect on the last day?

ItemOwner
Laptop, phone, tokens, keys, ID badgeIT and logistics
Vehicle or other assets assigned to the personLogistics
Open advances, petty cash and expense claims clearedFinance
Signed handover noteLine manager
Final timesheet and leave balanceHR

Do not release final payment before advances and claims are cleared, within what your national law allows.

How do you protect data and access?

On the last working day:

  1. Disable the person’s accounts and remove them from shared drives, mailing lists and any donor or partner portals.
  2. Move files they own to a named colleague.
  3. Reset shared passwords the person knew.
  4. Redirect or archive their email under your data policy.
  5. Remove their name as an approver or signatory, and update delegation lists.

Do the removal on the day, not the week after. Our article on safeguarding basics explains why access to beneficiary information needs particular care.

What knowledge should you capture?

Ask the person to write down, in plain language:

  • What they were working on, and what is next.
  • Where the files are.
  • Who the key contacts are, inside and outside the organization.
  • What deadlines are coming.
  • What is not written anywhere else.

A short call with the successor is worth more than a long document.

What records should you keep?

Keep the completed checklist with dates, the handover note, the asset return record, the finance clearance, and the exit conversation summary. Store them with restricted access. Keep personal data only as long as the law and your donors require, and then delete it. Retention rules differ by country, so check yours.

Plan ahead by watching contract end dates, as described in our guide to tracking contract renewals.

Special cases

Some departures need extra care:

  • Staff with financial authority. Remove approval rights and bank signatory status on the last day, and have finance check that no request is left waiting for them.
  • Staff who held beneficiary or case data. Confirm that all copies on laptops, phones and personal devices have been moved or deleted under your data policy.
  • Dismissal or a dispute. Involve HR leadership early. Remove access before the conversation where practical, treat the person with respect, and take local legal advice.
  • Staff leaving a field site. Plan the handover of keys, vehicles and cash boxes with logistics before the person travels, because they may not return.
  • Staff who move to a partner. Remind them in writing of continuing confidentiality duties, within what your law and contract allow.

Close with a short message to the team about who now holds the person’s responsibilities. Partners and donors who dealt with the person should hear the same news from you, with a named new contact.

After a few departures, review the lists you completed. Which steps were late? Which items did nobody own? Where did knowledge go missing? Fix the template, and share the lesson with managers. A good offboarding routine is also kind to the person leaving, since it ends the working relationship cleanly and leaves a good impression of your organization.

Where EMPOBase fits

EMPOBase has an Offboarding workflow in the People & HR module. Offboarding events use the profile dates and employment status, so you review the resulting checklist, owners and dates. Sensitive employment dates need appropriate HR access. The checklist does not switch off external accounts for you, so IT still removes access by hand. See the platform page and the security page.

Questions people ask

Who owns offboarding?

HR owns the process and the record. The line manager owns the handover, IT owns access and equipment, and finance owns clearance of advances and claims.

What if someone leaves suddenly?

Run the same list at speed: remove access first, secure assets and data, then complete handover with the manager. Do not wait for the person to return.

How long should we keep records of former staff?

For the period your law and donor agreements require. Both differ by country, so check them and state the period in your policy.