Offboarding a Remote Assistant Securely: A Same-Day Checklist

Offboarding gets less attention than onboarding, but it matters as much for security. Lingering access after someone leaves — an active account, a shared password that wasn't changed, a delegation that wasn't removed — is a well-known risk. Whether an assistant leaves on great terms or poor ones, the process should be the same: thorough, prompt and documented.

This checklist covers secure offboarding for remote assistants, plus how to hand over work smoothly.

Plan before you need it

Offboarding is far easier if you've been keeping an access register — a list of every system, the assistant's access level and who granted it. If you don't have one, start now. See password manager setup for assistants and the least-privilege access checklist.

Phase 1: Handover (during notice period)

If there's a notice period, use it well:

• [ ] Ask the assistant to update all SOPs and the role overview.
• [ ] List open tasks, with status and next steps.
• [ ] List recurring deadlines for the next 60 days.
• [ ] Identify external contacts who need to know about the change.
• [ ] If a replacement is starting, schedule overlap for walkthroughs.
• [ ] Transfer ownership of any documents, folders or automations the assistant created.

With a managed provider, coordinate handover with them. At ExecWing, back-fill is included, and we help structure handovers.

Phase 2: Access revocation (last day)

Do this on the last day — ideally at the end of their final shift:

Identity and email

• [ ] Remove mailbox and calendar delegations.
• [ ] Disable the assistant's company email account (or convert it to a shared mailbox if you need to keep messages).
• [ ] Set up forwarding or an auto-reply for the assistant's address if external contacts used it.
• [ ] Revoke sessions and app passwords where your platform allows.

Password manager

• [ ] Remove the assistant from the company password manager.
• [ ] Rotate passwords in every shared vault they could access.
• [ ] Re-generate any MFA secrets stored in shared vaults, if applicable.

Business applications

• [ ] Deactivate named user accounts in CRM, project management, helpdesk, accounting and other tools.
• [ ] Reassign records, tasks and tickets they owned.
• [ ] Remove them from shared channels in Slack or Teams, or deactivate their account.

Finance

• [ ] Cancel spend-management cards issued to them.
• [ ] Remove access to bank and payment portals.
• [ ] Review recent payment-related changes for anything unexpected.

Files

• [ ] Remove sharing on folders and documents.
• [ ] Transfer ownership of files they own.
• [ ] Check for external sharing links they created and disable them.

Admin and integrations

• [ ] Remove any admin roles.
• [ ] Review third-party integrations or API tokens they set up and rotate or transfer them.
• [ ] Review automation tools (for example, Zapier) for connections authenticated with their accounts.

Social media and marketing

• [ ] Remove them from business manager roles.
• [ ] Rotate passwords on any shared social accounts.

Phase 3: Verification (within a week)

• [ ] Walk through the access register and confirm each item is revoked.
• [ ] Check audit logs for activity after the last day.
• [ ] Confirm the replacement (if any) has the access they need — and only that.
• [ ] Update the access register.

Phase 4: Communication

• [ ] Tell internal colleagues about the change and who's covering.
• [ ] Tell key external contacts, if the assistant communicated with them regularly.
• [ ] Update email signatures, scheduling links and directories.

Why "same day" matters

Delays create windows of risk, and also confusion: messages sent to an inbox nobody reads, scheduled tasks that fail when an account is disabled weeks later. Revoking everything at once, with forwarding and reassignment in place, is cleaner for everyone.

Departures on poor terms

If an assistant leaves suddenly or a relationship ends badly:

• Revoke access before or at the time of the conversation, not after.
• Prioritize email, password manager, financial and admin access.
• Review recent activity logs.
• Involve your provider immediately.

A note on dignity

Secure offboarding doesn't have to feel adversarial. Explain at onboarding that access is revoked for everyone on their last day as standard practice. When it happens, it's routine rather than personal.

How a provider helps

A managed provider can coordinate handover, supply a replacement and confirm on their side that devices and accounts under their control are cleaned up. Ask your provider what their offboarding process covers. ExecWing's controls are described on our security page.

Copyable checklist

Offboarding — [Name] — Last day: [date] Handover: SOPs ☐ Open tasks ☐ Deadlines ☐ Contacts ☐ File ownership ☐ Revoke: Delegations ☐ Email ☐ Password manager ☐ Rotate shared ☐ Apps ☐ Chat ☐ Cards ☐ Bank ☐ Files ☐ Admin ☐ Integrations ☐ Social ☐ Verify: Register reviewed ☐ Logs checked ☐ Replacement access ☐ Communicate: Internal ☐ External ☐ Signatures/links ☐

Offboarding when you change providers or roles

Offboarding isn't only for departures. Run the same checklist when:

• An assistant moves from supporting one leader to another inside your company.
• You change a role's scope — for example, removing finance responsibilities.
• You switch providers and a new assistant takes over.

In each case, remove access that no longer maps to current tasks, rotate shared credentials the previous scope could reach and update the access register. Partial offboarding is where stale permissions most often accumulate.

Records to keep

Keep a short record of each offboarding: date, systems revoked, credentials rotated, who verified and any issues found. It takes minutes and gives you evidence that the process was followed — useful for your own security reviews, for customer security questionnaires and, for regulated businesses, as part of your information security program documentation.

Frequently asked questions

Should we wait until the replacement starts? No. Revoke the departing assistant's access on their last day regardless of when the replacement begins; use the SOPs and a temporary coverage plan in between.

Do we need to rotate every shared password? Rotate every credential in vaults the assistant could access. That's another reason to keep vaults small and function-based.

Quick answers

Who should run the offboarding checklist? Someone other than the departing assistant — typically the leader they supported or your IT or operations lead.

Key takeaways

• Keep an access register so offboarding is a checklist, not a hunt.
• Use the notice period for handover: SOPs, open tasks, deadlines and file ownership.
• Revoke all access on the last day and rotate every shared credential.
• Verify within a week using audit logs and the register.
• Run the same process when roles change, not only when people leave.

The bottom line

Plan offboarding before you need it with an access register. During notice, focus on handover. On the last day, revoke everything — delegations, accounts, vault access — and rotate shared passwords. Verify within a week. It's routine hygiene that prevents some of the most avoidable security problems.

The best time to prepare is now, while nobody is leaving: start the access register, move shared credentials into function-based vaults and save this checklist where your team can find it.