# Joiners, movers and leavers checklist

Use one copy per person. Keep the completed copy with your records.

> How to use this template: replace [system names] with the systems your organization actually uses, and name who is
> responsible for each step. Old accounts are a door nobody is watching, so the leaver section matters most.

Name: ______________________________   Role: ______________________________

Manager: ___________________________   Staff / volunteer / contractor: ____________

## Joiner

Start date: ______________

Before day one:
- [ ] Agree what access the role needs, and nothing more. Owner: ________
- [ ] Create their email account with multi-factor authentication required. Owner: ________
- [ ] Add them to [file storage], [client database], [finance system] at the right level. Owner: ________
- [ ] Prepare a device: updates on, disk encryption on, screen lock on. Record it in the inventory. Owner: ________
- [ ] Add them to the incident contact list and phone tree. Owner: ________

First day:
- [ ] They set up multi-factor authentication and a password manager. Owner: ________
- [ ] They read and sign the acceptable use policy. Owner: ________
- [ ] Show them how to report a suspicious message, a lost device or a mistake. Owner: ________
- [ ] Give keys, building passes or alarm codes, and record them. Owner: ________

First week:
- [ ] Check they can reach everything they need, and nothing they do not. Owner: ________

## Mover (change of role)

Date of change: ______________   New role: ______________________________

- [ ] List the access the new role needs. Owner: ________
- [ ] Remove access the old role needed but the new one does not. Owner: ________
- [ ] Add or remove administrator rights. Administrators use a separate admin account. Owner: ________
- [ ] Change shared passwords for anything they no longer need. Owner: ________
- [ ] Update the inventory, the incident plan and the contact list if their responsibilities changed. Owner: ________

## Leaver

Last day: ______________   Leaving on good terms? [ ] Yes [ ] No (if no, remove access before telling them, where lawful)

Before the last day:
- [ ] List every account, device, key and system they use, including services they signed up for themselves. Owner: ________
- [ ] Agree who takes over their files, email and responsibilities. Owner: ________
- [ ] Hand over anything only they know how to do, in writing. Owner: ________

On the last day:
- [ ] Disable their email and every other account. Owner: ________   Time done: ________
- [ ] Remove them from administrator groups, shared mailboxes and distribution lists. Owner: ________
- [ ] Sign them out of all sessions and remove their multi-factor devices. Owner: ________
- [ ] Change every shared password they knew (Wi-Fi, shared accounts, alarm codes). Owner: ________
- [ ] Collect devices, keys and passes. Owner: ________
- [ ] Remove them from bank mandates, payment approvals and authorised contacts with suppliers. Owner: ________

After they leave:
- [ ] Forward or archive their mailbox as agreed, then close it after [period]. Owner: ________
- [ ] Wipe and reassign or retire their device. Update the inventory. Owner: ________
- [ ] Update the incident plan and contact list. Owner: ________
- [ ] Transfer ownership of any services they signed up for, or close them. Owner: ________

Completed by: ______________________   Date: ______________

---
Template by Moraph for Good (https://moraph.org/commons/templates). Free to copy and adapt under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Attribution: "Moraph for Good".