HR and IT Offboarding Collaboration: Who Does What and When

Employee offboarding fails when HR and IT don't coordinate effectively. HR collects the laptop but doesn't notify IT. IT disables the account before HR completes the exit interview. The manager needs mailbox access but doesn't know who to ask.

This guide establishes clear responsibilities and timing to prevent offboarding gaps.

The Offboarding Stakeholders

HR Responsibilities

• Employment termination decision and documentation
• Final paycheck calculation
• Benefits termination (COBRA notification)
• Exit interview scheduling
• Physical security (access badge)
• Equipment collection (physical handoff)
• NDA and non-compete reminders
• Reference policy communication

IT Responsibilities

• Account disablement (AD, Azure AD, M365)
• Access removal (applications, VPN, systems)
• Data backup and transfer
• Device wipe and redeployment
• License reclamation
• Security group removal
• Audit logging
• Manager access provisioning (mailbox, files)

Manager Responsibilities

• Termination decision and notification
• Knowledge transfer coordination
• Client communication plan
• File and email review needs
• Temporary access requirements
• New employee hiring initiation

The Coordination Problem

Common Failure Modes

Scenario 1: Access Disabled Too Early

• IT disables account immediately upon notification
• HR hasn't completed exit interview
• Employee can't access systems to complete knowledge transfer
• Manager can't retrieve files from employee before access ends

Result: Business disruption, incomplete knowledge transfer

Scenario 2: Access Disabled Too Late

• HR notifies IT "when you get a chance"
• IT processes request 2-3 days later
• Former employee retains access for days
• Data exfiltration window remains open

Result: Security risk, compliance violation

Scenario 3: Incomplete Notification

• HR sends email: "John Smith terminated"
• IT doesn't know: termination date, last day, reason (voluntary/involuntary)
• IT disables account but doesn't convert mailbox
• Manager can't access employee's email for client continuity

Result: Lost client communication, business impact

The RACI Matrix for Offboarding

Legend:

• R = Responsible (does the work)
• A = Accountable (decision maker)
• C = Consulted (provides input)
• I = Informed (kept in the loop)

Pre-Termination Phase

Activity	HR	IT	Manager
Termination decision	C	I	A/R
Schedule termination meeting	R/A	-	C
Prepare offboarding checklist	R/A	C	I
Notify IT (2 hours before)	R	I	-
Backup employee data	I	R/A	C

Termination Day Phase

Activity	HR	IT	Manager
Termination notification	R/A	I	C
Disable accounts (15 min after)	I	R/A	I
Collect access badge	R/A	I	I
Collect company devices	R	I	C
Reset passwords	-	R/A	-
Remove security groups	-	R/A	-
Convert mailbox to shared	I	R/A	C
Grant manager mailbox access	-	R/A	R (request)
Exit interview	R/A	-	C

Post-Termination Phase (1-30 Days)

Activity	HR	IT	Manager
Wipe devices	I	R/A	-
Remove licenses (30 days)	-	R/A	-
Transfer file ownership	-	R	A
Archive email (90 days)	C	R/A	C
Delete accounts (90-180 days)	A	R	I
Final paycheck processing	R/A	-	I
COBRA notification	R/A	-	-

The IT-HR Handoff Process

Stage 1: HR Notification to IT (2 Hours Before Termination)

HR sends:

• Employee full name
• Employee ID
• Username/email address
• Termination date and time
• Termination type (voluntary/involuntary/for cause)
• Manager name and email
• Special instructions (mailbox access needed, data preservation, etc.)
• Device serial numbers (if known)

IT acknowledges within 30 minutes:

• Confirms receipt
• Confirms scheduled disable time
• Identifies any blockers (employee has admin rights, on-call rotation, etc.)

Stage 2: Termination Execution (Day Of)

HR actions (in order):

1. Conduct termination meeting (15 minutes)
2. Immediately notify IT: "Termination meeting complete - proceed with account disable"
3. Collect access badge and keys
4. Escort to desk for personal item collection
5. Collect laptop, phone, any company devices
6. Sign device receipt form
7. Escort out of building
8. Notify IT: "Employee has left premises - devices collected"

IT actions (in order):

1. Receive "proceed" notification from HR
2. Disable Active Directory account
3. Disable Azure AD account
4. Revoke VPN access
5. Remove security group memberships
6. Reset password to random string
7. Convert Exchange mailbox to shared
8. Grant manager mailbox access
9. Hide from Global Address List
10. Set automatic reply
11. Notify HR: "All access disabled - completion time: [timestamp]"

Timeline: IT actions complete within 15-30 minutes of "proceed" notification

Stage 3: Device Processing (Same Day)

HR actions:

• Deliver collected devices to IT department
• Provide device inventory list
• Confirm serial numbers match asset database

IT actions:

• Receive devices from HR
• Verify serial numbers
• Update asset management system
• Initiate device wipe
• Store devices securely until wipe completes

Stage 4: Post-Termination Follow-up (1-7 Days)

HR sends IT:

• Exit interview summary (any IT-relevant feedback)
• Final accounting of unreturned equipment
• Confirmation employee won't be rehired

IT sends HR:

• Offboarding completion report
• Audit log of all actions taken
• Confirmation of data backed up/transferred
• List of any outstanding issues (devices not wiped, etc.)

Communication Templates

Template 1: HR to IT (Initial Notification)

Subject: Offboarding Request - [Employee Name] - [Termination Date]

Employee Information:
- Full Name: John Smith
- Employee ID: 12345
- Email: jsmith@company.com
- Username: jsmith
- Department: Engineering
- Manager: Jane Doe (jdoe@company.com)

Termination Details:
- Type: Involuntary
- Termination Date: 2026-02-02
- Scheduled Time: 10:00 AM EST
- Last Day: 2026-02-02

Special Instructions:
- Grant manager (jdoe@company.com) full access to mailbox
- Preserve all emails for 90 days (potential legal hold)
- OneDrive files need to be transferred to manager

Devices:
- Laptop: Dell Latitude 5420 (Serial: ABC123)
- Phone: iPhone 13 (Serial: XYZ789)
- Monitor: Dell 27" (Serial: MON456)

Please confirm receipt and scheduled disable time.

Thank you,
[HR Representative]

Template 2: IT to HR (Completion Notification)

Subject: Offboarding Complete - [Employee Name]

Offboarding Summary for John Smith (jsmith@company.com):

Actions Completed:
✓ Active Directory account disabled (10:17 AM)
✓ Azure AD account disabled (10:17 AM)
✓ VPN access revoked (10:18 AM)
✓ Security groups removed (12 groups)
✓ Password reset
✓ Mailbox converted to shared (10:20 AM)
✓ Manager access granted to jdoe@company.com
✓ Automatic reply configured
✓ Hidden from Global Address List

Data Backup Status:
✓ OneDrive files backed up (4.2 GB)
✓ OneDrive ownership transferred to manager
✓ Email mailbox preserved (shared)

Pending:
⏳ Devices not yet received from HR
⏳ Device wipe will proceed upon receipt

Audit Log: Available in IT ticketing system #123456

IT Contact: support@company.com

[IT Representative]

Key Success Factors

1. Pre-Built Notification Templates

• HR doesn't have to remember what info IT needs
• IT receives consistent, complete information
• Reduces back-and-forth questions

2. Defined Timing Windows

• 2 hours advance notice: Allows IT to prepare
• 15 minutes after meeting: Fast enough for security, allows exit process
• Same day device wipe: Minimizes risk window

3. Automated Handoffs

• HR submits offboarding request in HR system
• Ticket auto-created in IT ticketing system
• IT marks steps complete in ticket
• HR receives completion notification automatically

4. Clear Escalation Path

• IT blocked by technical issue: Escalate to IT manager
• HR can't collect devices: Escalate to security/legal
• Manager unresponsive on access needs: Escalate to director

Measuring Collaboration Effectiveness

Key Metrics

• Notification lead time: Target: 2+ hours before termination
• Time to account disable: Target: Within 30 minutes of "proceed" signal
• Device collection rate: Target: 100% same-day for office employees
• Completion documentation: Target: IT report to HR within 24 hours

Red Flags

• Same-day termination notices (no advance warning to IT)
• Accounts disabled hours after employee left premises
• Devices not collected or unreturned
• Manager access requests coming 2-3 days after termination
• No audit log of IT actions