A general checklist, not an automatic execution promise
This is general operational best practice. Adapt it to your employment, legal, security and records requirements with the relevant owners. Lojycal can support connected records and configured workflows, but each action must be assessed for provider support and permissions. A checklist item is not proof that an action was performed.
Separate urgent access containment from long-term data retention and asset recovery. Agree the authorised sequence in advance, especially for sensitive departures. Avoid premature deletion that could remove evidence, disrupt ownership or violate an applicable retention obligation.
Confirm the HR notification
Verify the person, authorised leaving date and any timing restrictions. Agree the process owner and approvals. Do not infer departure from a missing directory record.
- Owner · Approved time · Destination result · Exceptions · Sign-off
Suspend or deactivate identities
Follow the approved timing and identity-provider procedure. Identify additional identities and retain necessary employment or evidence records rather than deleting indiscriminately.
- Owner · Approved time · Destination result · Exceptions · Sign-off
Review sessions and application access
Revoke sessions where appropriate and supported. Check applications with independent credentials; disabling a central identity does not guarantee every application session is ended.
- Owner · Approved time · Destination result · Exceptions · Sign-off
Check privileged and shared access
Review administrative accounts, API tokens, recovery methods and shared credentials. Rotate affected secrets through approved processes without placing them in tickets or evidence exports.
- Owner · Approved time · Destination result · Exceptions · Sign-off
Recover devices and equipment
Assign an owner for collection, verify received identifiers and follow approved sanitisation and disposal procedures. A device management record is not proof that physical equipment was recovered.
- Owner · Approved time · Destination result · Exceptions · Sign-off
Review licences and third-party access
Confirm applications, supplier portals and third-party permissions. Reassign eligible licences only after access and ownership requirements are addressed. Contractual savings may not be immediate.
- Owner · Approved time · Destination result · Exceptions · Sign-off
Transfer ownership
Transfer application, document, supplier and approval ownership to named people. Confirm the new owners can operate the process and that no critical workflow depends on the departing identity.
- Owner · Approved time · Destination result · Exceptions · Sign-off
Verify evidence and sign-off
Record each action, its destination result, outstanding exceptions and accountable owner. Obtain appropriate sign-off after verification, not merely after a request was dispatched.
- Owner · Approved time · Destination result · Exceptions · Sign-off