IT checklist for a new starter and a leaver

Agree who approves the request

An engineer should not decide what confidential information a new colleague is entitled to see. A manager or other authorised person needs to approve the role, access and equipment. Use an agreed request route so a convincing email from an unfamiliar sender cannot create a new account without checks.

For a leaver, agree the effective time and who can authorise an urgent change. Employment decisions and retention requirements belong with the business and its advisers. IT work should follow those decisions, not accidentally announce a departure through a premature password change.

Prepare a new starter before the first day

List the required Microsoft licence, specialist applications, shared folders, calendars and phone access. Give the person their own account where supported. Apply sign-in protection and verify the recovery or enrolment process without sending passwords through an ordinary shared email thread.

Prepare a suitable managed device, confirm updates and security tools, and check the applications needed for the role. A device should be tested with the intended access rather than handed over because it turns on. Record who owns the equipment and how it will be supported.

Introduce safe working habits

Show the starter how to contact support, report a suspicious message and request an approved installation. Explain where business files should be saved and which sharing routes are allowed. A password manager can help keep work credentials out of personal spreadsheets and shared browsers.

If the person uses a personal phone, agree the management and privacy boundaries before enrolment. Mobile device controls vary by platform and mode. Staff should understand which company information can be removed and what remains personal.

Remove access without discarding records

A leaver checklist needs more than disabling one mailbox. Review Microsoft accounts, specialist applications, client portals, delegated access, shared credentials and mobile devices. Remove or transfer access through an authorised process and record what has been completed.

Preserve required business records before removing licences or deleting information. Decide who may read transferred material, whether an agreed automatic reply is needed and how incoming business communication will be handled. A mailbox forwarding rule alone does not address every account or confidentiality issue.

Recover devices and review shared information

Arrange return of company equipment and record its condition and custody. Where a device is missing, follow the agreed incident process. Selective company-data removal can be useful on enrolled devices, but it depends on the configured platform and should not be assumed possible on every personal phone.

Review passwords or tokens the person could use outside their main account. Where a shared login cannot be avoided, use controlled sharing and change access appropriately. Check documents shared with external addresses and supplier accounts linked to a personal email.

Close the request with a record

A short completion record should identify what was approved, which actions were taken and anything still requiring a business decision. Review the checklist when systems change so a newly introduced application is not missed at the next departure.

Cloud Smart support starts from £25 per user per month, plus VAT, on a 3 year term billed monthly. Shorter terms cost a little more. The written quote confirms covered work and any separately approved project tasks. Ask for the process to fit your systems rather than assuming a generic list is complete.

Free tools to help you prepare

• IT checklist for new starters and leavers