When an employee joins, changes roles, or leaves, IT needs more than a name and a start or end date. It needs enough approved, actionable information to prepare or update accounts, assign or recover equipment, adjust permissions, and coordinate support.
A repeatable employee IT onboarding and offboarding checklist gives managers and IT a shared process. It also helps prevent requests from getting stuck because nobody knows who approved a change, when it takes effect, or who is responsible for completing it.
Start with the event and its owner
Use the same intake process for three kinds of changes: a new employee, a change in role or work location, and a departure. At the start of every request, capture:
- Event type: New hire, role or department change, location change, temporary assignment, or departure.
- Employee identity: Full name and the work contact or employee identifier your organization uses.
- Effective date and time: When the change should take effect, including the relevant time zone if the team is distributed.
- Requester and manager: The person submitting the request and the manager accountable for the employee’s work.
- Approval: Who has authorized the request and where that approval is recorded.
- IT task owner: The person or team responsible for carrying out and confirming each task.
Keep the request focused on operational details. IT generally does not need sensitive personal or employment information that does not affect access, equipment, or support. Use the organization’s approved channel for the request and its approvals.
What IT needs for a new employee
A useful new-hire IT request tells IT what the person will do, where and how they will work, and which resources they need to do the job. Collect these details before the start date whenever possible:
- Work and contact details: Name, department, job role, manager, work location, and preferred work contact method.
- Work arrangement: Office, remote, or another approved arrangement, plus any details IT needs to prepare equipment or provide access.
- Accounts and applications: Required email, business applications, collaboration tools, and systems. Identify the business purpose or role that justifies each request.
- Groups and data: Teams, distribution groups, shared folders, or other resources the employee needs. Name the owner who can approve access to each shared resource.
- Access level: Whether standard access is sufficient or a specific task requires elevated privileges. Include the reason and the approver for any elevated access.
- Devices and accessories: The requested computer or other equipment, accessories, and any existing company devices the employee will use.
- Setup and support timing: When equipment must be ready, how it should be delivered or collected, and whether the employee needs a setup appointment or help-desk support.
- Special requirements: Approved software, accessibility or workflow needs that affect the IT setup, and any organization-specific approval steps.
A request such as “give the new employee access to everything the team uses” is difficult to verify and may grant more access than needed. Ask the manager to name the actual applications, groups, and shared resources. For help thinking through access boundaries, see our guide to preventing unauthorized access to business data.
What to collect for role or location changes
Employees do not only join or leave. A transfer, promotion, temporary assignment, or move to another work location can make existing access inappropriate, while creating a need for new tools or support.
For a change request, record the employee, manager, effective date and time, previous role or location, and new role or location. Then ask the manager to identify:
- Applications, groups, and shared resources the employee still needs.
- Access to add, change, or remove, with an owner or approver for sensitive resources.
- Whether elevated permissions are still required, and the business reason if they are.
- Any device, office, network, or support changes needed for the new assignment.
- Who will take over work or resource ownership that the employee no longer manages.
Review both sides of the change. Adding access without checking what is no longer needed can leave an employee with permissions from an earlier role. Guidance on establishing a process to revoke access is available in the CIS Controls access-revocation recommendation.
What IT needs when an employee leaves
For a departure, the request should make clear when access changes are authorized to happen and who is coordinating them. Collect the effective date and time, the manager or authorized requester, the IT task owner, and a way to confirm completion.
Build a departure inventory tied to the employee, not a generic list of systems. Include:
- Accounts and applications: Email, business applications, remote access, cloud services, and any other accounts the employee used for work.
- Access methods: Groups, permissions, credentials, authentication methods, and physical access credentials that need review or removal.
- Assigned equipment: Company-owned computers, phones, accessories, storage devices, and equipment checked out to the employee. Record the return or recovery status.
- Shared resources: Mailboxes, calendars, folders, systems, or other resources the employee owns or administers, plus the person responsible for them afterward.
- Business responsibilities: Work, requests, or processes that need a new owner so they do not depend on an account being left active.
- Records and files: What must be retained, transferred, or handled under the organization’s approved procedures, and who authorizes that handling.
Coordinate account changes with the authorized manager or HR contact and the organization’s policies. Do not assume that deleting an account is the right way to handle its email or files. Decide who needs continued access, who takes ownership, and what should be retained before IT completes the relevant changes. The NIST security and privacy controls provide a broader reference for managing access and account lifecycles.
For an unplanned departure, the manager or designated HR contact should notify IT through the organization’s established urgent channel. The request should still identify the authorized requester, effective time, and person coordinating the response. IT can then follow approved procedures to address access and equipment, while escalating anything that suggests a security incident through the organization’s incident response process. See our guidance on planning a business cyber incident response.
Make the checklist easy to complete and verify
A lightweight form can work even when a business does not have separate HR and IT teams. Keep the intake fields consistent, name an owner for each task, and track whether it is requested, approved, completed, or blocked. Give employees and managers a clear way to report a missing device or access need without sending sensitive details through an unapproved channel.
At completion, IT should confirm the requested changes with the requester or manager and note any exceptions. For regulated or higher-risk organizations, use the organization’s documented approval and retention procedures, and add any required review steps rather than relying on a generic form.
Frequently asked questions
What information does IT need to set up a new employee?
IT needs the employee’s work identity, role, department, manager, location, start time, approved applications and resource access, equipment needs, and setup timing. Include an approver and a task owner so the request can be acted on.
Who should notify IT about a hire, transfer, or departure?
Use the organization’s defined requester, such as the manager or designated HR contact. The request should identify who approved it and who is accountable for confirming the IT work.
How should a business handle an employee changing roles?
Review access to remove as well as access to add. Capture the new role and effective time, confirm which existing resources are still needed, and assign owners for resources or work the employee is handing over.
Which accounts and permissions should be removed when someone leaves?
Use an inventory of the employee’s accounts, applications, groups, remote access, physical credentials, and other permissions. Confirm the timing and authorization, then follow the organization’s process to transfer files, email, and shared-resource ownership.
How can a business keep track of assigned devices?
Maintain an asset record that connects each company device and accessory to the employee, records handoff or return status, and identifies who follows up on anything unreturned. Keep the record current when equipment changes hands.
Make employee changes easier to manage
A well-run joiner, mover, and leaver process starts with clear dates, approvals, access needs, equipment records, and task ownership. If your business needs help organizing day-to-day IT requests and support, contact Stop Hackers Now to discuss your needs.