Free Checklist · 2026 edition

The Employee Offboarding Checklist
that actually closes every loop.

Most offboarding checklists stop at "deactivate Okta." This one keeps going — into the standalone SaaS seats, the personal-card subscriptions, the OAuth grants, and the file ownership orphans that quietly cost you for years. Built by the team that audits this stuff for a living.

Auto-audit instead

Avg. SaaS seats per leaver

that survive offboarding

Annualized cost per ghost

$1,860

across leftover seats

Days to fully revoke

with manual checklists

With SeatMap.AI

< 2s

audit, then one-click revoke

T-7 days: Pre-offboarding (manager + HR)

Before last day · Owner: Manager + HR

Confirm last working day in writing
Email + HRIS update. This is the trigger for every other timer in this list.
Identify knowledge-transfer scope
Active projects, runbooks, vendor relationships. Schedule transfer sessions in the next 5 days, not the last 5 hours.
Notify IT, security, and finance
Single Slack channel or ticket. They each have a clock that starts now.
Document accounts only this person controls
Domain registrars, social media, vendor portals signed up under their personal email. These are the ones that bite later.
Plan the team announcement
Who tells the team, when, and what. Avoid the awkward Slack-disappearance discovery.

Last day: Access and assets

Day of departure · Owner: IT + Manager

Disable SSO / IdP account
Okta, Google Workspace, M365 — whichever is your front door. This kills 60–80% of access in one move.
Revoke standalone SaaS seats
Anything not behind SSO: Notion, Figma, Linear, GitHub, design tools, Stripe dashboards. Each one is a billable seat after today.
Rotate shared credentials
Any password in 1Password / Bitwarden vault that the departing user could see. If they touched it, rotate it.
Revoke OAuth grants and personal access tokens
GitHub PATs, AWS access keys, Slack apps installed under their account. These survive SSO deactivation.
Forward email and set autoresponder
Forward to manager, autoresponder names a replacement contact. 90-day forward, then archive.
Recover hardware
Laptop, YubiKey, monitors, badge. Document serial numbers as you receive them.
Remove from team calendars and recurring meetings
Decline-on-behalf or transfer ownership. Otherwise you'll see ghost invites for a year.

Day +1 to +7: Cleanup and reclaim

First week after · Owner: IT + Finance

Audit every SaaS app for residual access
SSO deactivation doesn't always cascade. Check every app individually — or run a SeatMap.AI audit and let it surface dormant seats automatically.
Cancel single-seat subscriptions they owned
Personal-card SaaS that was paid back via expense. These continue billing until cancelled.
Reassign or terminate their licenses
Don't just deactivate — reclaim. A deactivated seat in many SaaS tools is still a billable seat.
Transfer file ownership
Google Drive, Notion, Figma, GitHub repos, Linear projects. Orphaned content is the #1 cause of 'wait, where's the X doc?' six months later.
Review their email forwards and filters
Auto-forwards to personal email = data exfiltration risk. Audit before disabling the mailbox.
Update vendor contacts and on-call rotations
PagerDuty, status pages, vendor account managers. Names linger in places you forgot existed.

Day +30: Final closeout

One month after · Owner: HR + Finance

Final paycheck, expense reimbursement, equity
Per local jurisdiction. Document delivery; some states have hard deadlines.
Benefits termination + COBRA notice (US)
Health, dental, vision, 401k. Federally regulated timeline — don't slip.
Confirm all licenses fully revoked
Run an audit. The number you want is zero residual seats. SeatMap.AI shows this on one screen.
Archive HRIS record
Mark inactive, retain per policy. Don't delete — you'll need it for tax forms.
Conduct exit-survey debrief
Aggregate themes quarterly. Don't action individual answers immediately — that breaks confidentiality.
Document what went wrong in this offboarding
Two-line note in your ops doc. Compounds into a much better process by employee #50.

The honest pitch

This checklist is good. An automated audit is better.

Even with this list, the average company misses 6–10 SaaS seats per leaver — usually the standalone tools paid on personal cards or signed up with a Google login. SeatMap.AI runs the "Day +7 audit" step in 2 seconds, against every connected app, automatically. If you're offboarding more than 1 person a quarter, the math works out fast.

See the audit in 2 seconds How license reclamation works