Skip to main content
OpsRoadmaps

Checklists / leaver-access-removal

Leaver Access Removal Checklist

Verifying that someone who left actually lost access everywhere — the completion check behind the most common finding in any access review.

8 steps · 7 required · last reviewed (next review 2027-09-20) · updated 2026-09-20

Related focus areas:PeopleOps

Sign in to run this checklist

Run this for every leaver, and run it as verification rather than as a to-do list. The distinction matters: the widespread failure is not that offboarding steps are missing, it is that they are marked complete without anyone checking the system in question.

Run the same checklist as a sample audit each quarter against people who left months ago. What you find there tells you whether the per-leaver process is real.

  1. Identity provider account is disabled, and disabled rather than only removed from groups

    required

    Group removal leaves the account able to authenticate, which is enough for anything with its own authorization.

  2. Sessions and tokens already issued have been revoked

    required

    Disabling an account does not necessarily end a session that was established before it, including long-lived API tokens.

  3. Access to systems outside the identity provider has been checked individually

    required

    Every organisation has systems with local accounts, and those are the ones that survive offboarding.

  4. Shared credentials the person knew have been rotated

    required

    A shared secret is not revoked by removing a person; it is revoked by changing it.

  5. Personal devices no longer hold company data, and company devices are returned or wiped

    required

    Data at rest on an endpoint outlives every account control you applied.

  6. Third-party and vendor accounts held in the person's name are transferred or closed

    required

    Vendor portals, registrars and cloud accounts registered personally are a recurring continuity risk as well as an access one.

  7. Removal has been verified in each system rather than assumed from the checklist

    required

    This is the whole point: the step that fails is the verification, not the intention.

  8. A sample of earlier leavers is re-checked each quarter

    optional

    Per-leaver diligence decays quietly; only a sample audit reveals that it has.

Run it against your real gaps

A checklist is most useful when you know which controls you are actually missing. A free OpsRoadmaps assessment scores your controls with explainable findings and builds a roadmap from the results.

Assess my stack

Checklists document self-reported practice. Items were last reviewed 2026-09-20 — adapt them to your own environment.