Offboarding Access Removal Audit

Check what happens to accounts when someone leaves.

Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made

The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.

[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it (what [VERIFY] means).

Audit our offboarding access removal. The offboarding checklist as it exists, plus the last three leavers and what was removed and when: [OFFBOARDING_DATA]. Systems in use, including those bought by teams: [SYSTEMS]. Who owns the process: [PROCESS_OWNER].

Compare the checklist with the systems list to find systems it misses, check how fast access is removed, how shared secrets are changed, how devices and data are returned, and how mailboxes and files are handled respectfully and lawfully.

Return a gap table with System, On checklist?, Removed when and Action, a revised checklist, and a measure of time to remove access. Employment and data rules are [VERIFY] for [JURISDICTION].

Also add a short pre-departure checklist for planned exits, covering handover of files and accounts, and a step to review forwarding rules and delegated access that could keep a former employee connected.

Stay within authorised testing: recommend safe verification steps in a staging environment, and decline to suggest probing third-party systems. Legal and contractual limits on testing are [VERIFY] for [JURISDICTION].

Fill in before use

Optional: type your details and the prompt above updates. Nothing is saved or sent.

Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.

Gap table (invented, last 3 leavers)
Systems on checklist: email, chat, laptop. Systems missing: accounting software, design tool, shared password vault, CRM, analytics.
Leaver A: email closed day 0; CRM active 41 days. Red.
Leaver B: password vault shared secrets unchanged. Amber.
Leaver C: forwarding rule to a personal address found after 9 days. Red.
Time to remove access: median 6 days.
Revised checklist: 11 systems with owner each; same-day target for critical systems.
Mailbox and files handled lawfully and respectfully; employment and data rules [VERIFY].

• audit