Employee IT Offboarding and Access Removal Form Template
Leavers keep access far longer than anyone intends, especially in ERP, MES and shared accounts. This form makes removal a signed checklist that covers the systems people forget.
Fill in
Employee IT Offboarding Access Removal Form Template
Employee IT Offboarding Form
Employee: Carlos Mendez (E-20418) Department: Production Planning Manager: Janet Brooks Last working day: 2026-11-13 Reason: Resignation
ERP, MES and Application Access
Roles held: ERP planner role, purchasing approval up to 10,000, MES supervisor view
Remove or reassign open approvals, workflows and scheduled jobs owned by this user before disabling the account.
Shared Credentials
Supplier portal login, shared planning mailbox
Equipment
Laptop, docking station, phone, badge, token
Mailbox and Data
Forward to manager for 30 days
Removal Checklist
| Item | Completed by | Date | Notes |
|---|---|---|---|
| Directory account disabled | |||
| ERP user locked and roles removed | |||
| MES and shop floor logins removed | |||
| VPN and remote access removed | |||
| MFA tokens and certificates revoked | |||
| Badge and physical access disabled | |||
| Shared passwords rotated | |||
| Equipment received and wiped |
Approvals
Starting point, not legal advice. Retention, legal hold and employee data rules differ by country and contract; have HR and legal confirm your handling of mailboxes and personal data.
Find leaver accounts still active in your ERP
Optional: ask how a read-only comparison of HR leavers and ERP users could work on-prem.
Optional. The tool and every export work without this. No spam.
How to use the form
HR or the manager completes the top section as soon as the last day is known. IT then works through the removal checklist and records who did each step and when. Export the finished form to PDF for the personnel or audit file. For same-day terminations, disable the directory and remote access first, then complete the rest.
Systems that are often missed
Directory accounts are usually handled, but ERP users, shop floor logins, supplier portals, EDI accounts, shared mailboxes and tools bought by departments are not. In ERP, locking a user is different from deleting it, because history and audit trails reference the user. Reassign open approvals, scheduled reports and workflow steps before locking.
- Lock, do not delete, ERP users that appear in history
- Rotate shared passwords and API keys the person knew
- Remove vendor portal and VPN access
- Revoke certificates and hardware tokens
Controls and audit
Timely removal is a standard control under frameworks such as ISO 27001, SOC 2 and customer security questionnaires. Auditors usually sample leavers and compare termination dates with deactivation timestamps. Keep the signed form or ticket and be able to show elapsed time between the last day and removal. Pair this with periodic user access reviews to catch misses.
Common mistakes
Frequent gaps include contractors and temps without HR records, role changes treated as transfers with old access retained, and access removed only on the hardware side. Also remember equipment: a laptop returned but not wiped, or a phone with ERP mail still connected, is still exposure.
Frequently Asked Questions
When should access be removed?
Remove access at the end of the last working day, or immediately for involuntary terminations. Planned departures can have access reduced earlier if the person no longer needs it. Document the time of removal for audit.
Should ERP users be deleted?
Usually no. Lock or deactivate them so transaction history, approvals and audit trails keep a valid user reference. Remove roles, reassign workflows and keep the record according to your retention policy.
What about contractors and temps?
Use the same form, and set an end date at onboarding so access expires automatically. Contractors often sit outside HR systems, so the sponsoring manager must trigger offboarding.
How do I handle the mailbox?
Choose a handling option with HR and legal: forward to a manager for a limited period, convert to a shared mailbox, or archive then delete after retention. Legal hold overrides deletion. Document the choice on the form.
Netray can discuss how read-only checks across ERP user tables and directory exports could flag leavers who still have active access.
Related Tools
Plant Firewall Rule Review Worksheet
Review each firewall rule between office, plant and cell zones, flag stale entries and record keep, tighten or remove decisions.
Compliance & ContractsManufacturing IT Risk Register Worksheet
Track infrastructure, ERP and OT risks with a likelihood times impact score, residual score after treatment and a named owner.
ERP OperationsPlant IT Outage Incident Report Template
Document an ERP, network or server outage with timeline, production impact, root cause and corrective actions in a format management will read.
Costing & FinanceIT Vendor Contract Renewal Tracker Worksheet
Track support, license and hosting contracts with notice deadlines and a forecast of next year cost after expected price uplifts.
More Compliance & Contracts tools
See all- Used Machinery Bill of Sale Template
- Late Delivery Liquidated Damages Notice Template
- Customer Order Cancellation and Restocking Fee Notice Template
- Contract Termination for Convenience Notice Template
- Equipment Factory Acceptance Certificate Template
- Contract Redline Issue Log Worksheet
- Contract Renewal and Notice Deadline Tracker Worksheet
- Late Delivery Liquidated Damages Calculator
- Late Delivery Liquidated Damages Exposure Calculator