The IT Onboarding and Offboarding Checklist Every Business Needs

Two moments in an employee's journey quietly cause more IT headaches than almost anything else: the day they start, and the day they leave. Get the first wrong and a new hire spends their first week waiting on accounts and logins instead of doing the job you hired them for. Get the second wrong and a former employee can keep access to your systems for months, an open door most businesses never notice until it is too late.

The fix is not complicated. It is a simple, repeatable checklist for both. Here is what belongs on it.

Why this matters more than it looks

Onboarding sets the tone. A smooth first day tells a new hire the business is organised and takes them seriously. Offboarding, on the other hand, is about protection. When someone leaves, especially if the parting is not on the best terms, any account, app, or file they can still reach is a risk, to your data, your customers, and your reputation. Doing both properly is not bureaucracy; it is basic business hygiene.

The onboarding checklist (day one ready)

The goal is simple: a new hire sits down and everything just works. That means having this ready before they arrive, not scrambling on the morning:

• Email and accounts created. Their business email and logins for the tools they will actually use, set up ahead of time.
• The right access, and no more. Give access to what the role needs, not blanket access to everything, this keeps you safer from day one.
• A ready-to-go device. A computer set up, updated, and secured, with the software they need already installed.
• Multi-factor authentication turned on. Security should start on the first login, not be added later.
• A quick orientation. Where files live, how to get IT help, and the basic security dos and don'ts.

The offboarding checklist (the one people skip)

This is where businesses get caught out. When someone leaves, work through this promptly, ideally the same day:

• Disable their accounts. Email and every login should be switched off the moment they leave, not weeks later.
• Revoke access to every app and system. Including the ones that are easy to forget, cloud storage, project tools, remote access, and third-party services.
• Recover company devices. Collect laptops and phones, and make sure any business data on personal devices is removed.
• Change shared passwords. Any password they knew should be changed, shared logins are a common blind spot.
• Reassign their data and email. Forward or hand over their inbox and files so nothing important is lost.

The account nobody remembers

Here is the trap: it is rarely the main email account that gets missed. It is the forgotten ones, an old cloud storage login, a marketing tool, a remote-access app set up two years ago. Each one is a door left unlocked. This is exactly why a written list of every system a person can access is worth keeping, so offboarding is a matter of working down the list, not trying to remember.

Make it a process, not a memory

The businesses that get this right do not rely on someone remembering the steps. They have a simple, standard checklist that is followed every single time, and much of it can be automated so accounts are provisioned and shut off consistently. It takes the pressure off a busy day and removes the risk of something slipping through.

The bottom line

Onboarding and offboarding are small processes with a big impact. Done well, new hires are productive from hour one, and departures leave no loose ends and no security gaps. If you are not confident every account gets shut off when someone leaves, that is a gap worth closing now, and exactly the kind of thing a good IT partner sets up so you never have to think about it again.