IT offboarding is one of the few processes where the order matters more than the list. Doing the right things in the wrong sequence costs you either security or the laptop, and usually the laptop.
TL;DR
- Separate what you revoke immediately from what you leave until the last day. Treating revocation as one event is what costs you the device.
- High-risk access goes on day one of notice. Email, chat and calendar stay to the end, because they are the only thing the leaver still wants.
- Ask for the equipment during that window, not after it. Once access is gone you have nothing to coordinate around.
- Leave device management in place until the machine is physically back. A remotely locked laptop has no reason to return.
- Wipe on arrival and record it, then close the asset row. The row is not closed by the courier.
- Most of this is a sequencing decision rather than a tooling one.
Why the order matters
Security wants access gone early, which is correct. Recovery wants the departing person to stay engaged, which is also correct. Treated as a conflict, security wins and should, and the laptop goes missing.
The resolution is not to delay revocation. It is to split what is being revoked. Administrative consoles and production access are standing risk and should go immediately. Email and chat are working tools on a device you are about to recover, and they are the only coordination the process has.
Most companies revoke everything on day one of notice and then ask for the laptop on day thirty, which is the arrangement that produces the recovery rates people complain about.
The sequence
| Hour one of notice | Revoke admin consoles, production, customer data exports, payment systems | Standing risk, and none of it affects returning a laptop |
| Day three to five | Send the equipment arrangement with a booked collection date | They still have email and a reason to engage |
| Last working day | Revoke email, chat, calendar, HR portal | Low risk on a device you are recovering, high value as coordination |
| At collection | Lock the device remotely, once the courier confirms pickup | Lock earlier and there is no reason to hand it over |
| On arrival | Wipe, record date and method, change the asset state | Closes the data obligation in your custody |
| Within a fortnight | Decide reissue, store, sell or dispose | A device with no decision becomes cupboard stock |
The fourth row is the one teams get wrong most often. Locking a machine the moment notice is given feels prudent and removes any incentive to return it, since the person now holds a brick they cannot use and cannot easily post.
A worked example
A company ran a thorough offboarding checklist with fourteen items tracked in the HRIS, reviewed quarterly and audited twice. Thirteen of the fourteen completed on time, every time.
The fourteenth was equipment returned, sitting at about 61 per cent, and nobody had noticed because completion was reported as an average across all items. Thirteen out of fourteen is 93 per cent, which reads as excellent on any dashboard.
The thirteen had something in common: each is completed by somebody inside the company, using systems they log into, as part of a paid job. The equipment line is the only one that depends on a person who has left and gains nothing from acting, which is why it behaves differently and needs a different mechanism.
The message that gets the device back
Checklist:
- Name the specific device with its serial, not “company equipment”, which invites the recipient to decide what counts.
- State a booked collection date and window that you arranged, rather than asking them to organise a return.
- Confirm the address you hold and ask them to correct it, since it is frequently eighteen months old.
- Say the device will be wiped on arrival and the wipe recorded, which removes a reason to delay.
- Promise a confirmation email on the day it arrives, and send it.
- Leave out policy extracts and anything that reads as a warning, which converts a logistics request into a dispute.
Send it from a person rather than a no-reply address. A return that needs one clarification will otherwise not happen, and the clarification is usually about the address.
Closing the record properly
The process is not finished when the courier delivers. It is finished when the asset row says so with evidence behind it.
Three closures, not one. The physical outcome, meaning where the hardware now is. The data outcome, meaning the wipe with a date and method. And the financial outcome, meaning written off or recovered. Most registers collapse all three into a single status, which is why they cannot answer a question about one machine later.
Where a device genuinely will not come back, record the write-off and close the row rather than leaving it open. An open row nobody is pursuing is what corrupts the register over time.
What tooling contributes
Most of this is sequencing and wording rather than software. Where tooling helps is in making the trigger automatic, so the equipment step fires from the HR event rather than from somebody remembering.
Freshservice covers the internal choreography, with offboarding templates that fire tasks at the right people, tiered at $19, $49 and $99 per agent per month.
Disclosure: RemoAsset is owned by the same people who publish PeopleOpsHQ. Offboarding in the HRIS triggers the collection directly, and because the same platform delivered the device it already holds the serial and the address, which is what a return depends on. It publishes no price and requires a demo, it is weaker for hardware it did not supply, and it is not a certified disposal vendor. The alternatives are compared in our laptop retrieval comparison.
Final thoughts
Every item on an IT offboarding checklist except one is completed by somebody who works for you. That single exception needs its own sequence, its own wording and its own timing, and treating it as a fourteenth checkbox is why recovery rates sit where they do.
Split the revocation, ask during the notice period while email still works, book the collection yourself, leave management on until the device is back, and close the row on an evidenced wipe. None of that costs anything and together it moves the number that matters.
Frequently asked questions
What order should IT offboarding tasks happen in?
Revoke high-risk access immediately on notice, meaning administrative consoles, production systems, customer data exports and payment systems, since none of that affects somebody’s ability to return a laptop. Keep email, chat, calendar and the HR portal until the last working day, because those are the only things the departing person still wants and therefore the only coordination you have. Send the equipment arrangement in that window, around day three to five, rather than after access has gone.
Should we lock the device remotely when somebody resigns?
Not until the courier has confirmed collection. A laptop locked at the start of a notice period is a device the holder cannot use and has no particular reason to post back, which removes the last incentive in a process that already depends on somebody outside the company acting. Leave management enrolment in place so the device remains visible and controllable, and trigger the lock at the moment it physically leaves their possession.
Why does the equipment step fail when the rest of the checklist works?
Because every other item is completed by somebody inside the company, using systems they log into, as part of a job they are paid to do. The equipment line is the only one that depends on a person who has already left, feels no obligation and gains nothing from acting, so designing it like the other items produces an owner who is accountable for an outcome they cannot deliver. Over time that trains people to mark it complete and move on.
What should the equipment request actually say?
Name the specific device with its serial rather than referring to company equipment, state a collection date and window you have already booked, confirm the address you hold and ask them to correct it, say the device will be wiped on arrival, and promise a confirmation when it lands. Leave out policy extracts and anything resembling a warning, since a message that reads as a threat gets forwarded for advice rather than acted on, which converts a logistics request into a dispute.
When should the asset record be closed?
On an evidenced wipe, not on delivery, and with three separate closures rather than one status change. Record where the hardware physically is, record the data outcome with a date and method, and record the financial outcome as either recovered or written off. Registers that collapse all three into a single disposed status are the reason companies cannot answer a question about one specific machine a year later.
What if somebody refuses to return the device?
Decide in advance what the device is worth to you and act accordingly, since a three-year-old machine with a wiped drive and no remaining warranty is frequently worth less than the effort of pursuing it. Record the write-off at residual value, revoke everything, and close the row rather than leaving it open indefinitely, because an open row nobody is pursuing is what degrades the register over time. What options are available to an employer in that situation depends on the jurisdiction and the individual terms, so take local advice rather than applying a policy.