Employee Offboarding Checklist
Offboarding is everything that has to happen between the moment an employee's departure is known and the moment their file is closed: final pay on the state deadline, access removed at the right hour, benefits continuation notices on the federal timeline, property back, knowledge handed over, and the state's separation paperwork done. It has more legal deadlines than onboarding, and it happens under worse conditions, often in a week when the manager would rather not think about it.
The checklist below dates each item from the last day, adjusts for resignation versus termination, and adds the state notices for the states that have them. The rest of the page covers the four areas where offboarding fails most: pay, access, benefits and the record.
Interactive offboarding checklist
Progress is stored in this browser only. Dates are calculated from the last day. Final pay deadlines shown are for the selected state; check the full table for the others.
Final pay and what goes in it
The deadline is set by the state and by the type of separation. California pays a dismissed employee on the last day and a resigning one within 72 hours. Colorado and Massachusetts pay a dismissed employee immediately. Many states allow the next regular payday for both. Our final paycheck table covers all fifty states and the District of Columbia, and the penalties for missing the date, which in California run to a day's wages per day late for up to 30 days.
The check covers all hours worked through the last day, including overtime, commissions that are earned under the plan's terms, and accrued vacation where state law or the policy requires payout. Several states treat earned vacation as wages that cannot be forfeited whatever the handbook says. Deductions for unreturned equipment are restricted in most states and prohibited in some; ask for the property back and pursue it separately. Expenses submitted after the last day are still reimbursable; set a cut-off and say so in the termination letter.
Severance, where offered, is paid under the separation agreement on its own timeline, not with the final check, and only after the agreement is signed and any revocation period has passed. Our severance pay page has the calculator and the release rules.
Access, property and the data problem
Access revocation is the offboarding step most often done late, and the surveys on it are alarming enough to quote with care: several vendor studies over the past decade have found that between a quarter and a half of former employees could still reach at least one company system after leaving, and that manual deprovisioning commonly takes days. The cause is usually not negligence but sprawl. The identity provider is disabled on the last day; the twelve SaaS tools the person signed up for with a company card, the shared passwords in the team's document, and the API keys in their name are not.
The fix is an inventory kept while the person is employed, not reconstructed after. The equipment receipt from the new hire forms stage lists devices; an access record listing each system, the account and who owns the licence does the same for software. On the last day, disable the identity provider first (which cuts single-sign-on access everywhere), then work down the list, rotate any shared credential the person knew, and remove their MFA devices. For involuntary separations the revocation happens during the termination meeting, not after it.
Property comes back against the receipt. Devices are wiped after the data on them has been preserved if there is any prospect of a dispute; a laptop reimaged the day after a contested termination is evidence destroyed. Where the company monitored the device, the monitoring policy should already say what is retained and for how long.
Benefits continuation on the federal clock
For employers with 20 or more employees on the group health plan, COBRA starts a chain of deadlines: the employer notifies the plan administrator within 30 days of the qualifying event; the administrator sends the election notice within 14 days of that (44 days in total if the employer is its own administrator); the former employee has 60 days from the later of the notice or the loss of coverage to elect, and 45 days after electing to make the first payment. Coverage runs for 18 months at up to 102 per cent of the full premium, or 36 months for certain events. Employers with fewer than 20 employees are often covered by state continuation laws with shorter periods and their own notice rules.
The checklist treats the 30-day employer notice as the deadline because it is the one HR controls. Missing it exposes the employer to a statutory penalty per day and, worse, to the medical bills a former employee incurred while uncovered. Where a third party administers COBRA, the notification is usually a payroll feed, and the offboarding step is to confirm the feed fired.
The 401(k) administrator, life and disability carriers, and any flexible spending account administrator get the same notification. Health savings accounts belong to the employee and go with them. The termination letter tells the employee to expect these notices; it does not replace them.
Closing the record
- Unemployment insurance response. The state will ask why the person left. The answer must match the termination letter and the file. A different reason on the claim form than in the letter is the first inconsistency a plaintiff's lawyer finds.
- State separation notices. California's Change in Relationship notice and EDD pamphlet, New York's Form IA 12.3, Georgia's DOL-800, and the unemployment information notices a dozen other states require. Handed over on the last day and copied to the file.
- Retention clocks. Form I-9 for the later of three years from hire or one year from separation, then destroyed. Payroll records for at least four years under IRS rules. Personnel files for the period state law sets, commonly three years, longer if a claim is pending or threatened, in which case nothing is destroyed.
- Exit interview notes. Kept separately from the personnel file, and used in aggregate. Our exit interview questions page covers what to ask and why the answers are biased.
- Reference policy. Decide, before the first call comes, who may respond and what is confirmed. Our employment verification page sets out the tiers.
- The handover. Customers, vendors and colleagues told who owns what now; the departed person removed from bank mandates, domain registrations, admin roles and vendor portals, where a forgotten name causes trouble a year later.
Layoffs add two items at the front: the WARN Act assessment, where 50 or more employees at a site are affected, and the group release rules for anyone aged 40 or over. Our furlough versus layoff page covers the first and the severance page the second.
Key takeaways
- Final pay is due on the state deadline, which for dismissals in California, Colorado and Massachusetts is the last day. Earned vacation is non-forfeitable in several states.
- Disable the identity provider first, then work down an access inventory kept during employment. Rotate shared credentials and remove MFA devices.
- For plans with 20 or more employees, notify the COBRA administrator within 30 days; the election notice follows within 14 days of that.
- The unemployment claim response, the termination letter and the file must give the same reason.
- California, New York, Georgia and a dozen other states require a separation notice or pamphlet on the last day.
- Preserve devices and data before wiping where any dispute is possible, and start the retention clocks on the I-9 and payroll records.
Frequently asked questions
What should an offboarding checklist include?
Three stages. At notice: the resignation or termination letter, handover plan, payroll and IT notified, a check for open protected matters, and for layoffs the WARN and release assessments. On the last day: final pay on the state deadline, property returned, access revoked, state separation notices, the termination letter and the exit interview. Within 30 days: COBRA and benefits notifications, the unemployment response, records closed and retention clocks started.
When must a departing employee receive their final paycheck?
It depends on the state and on whether the employee resigned or was dismissed. California requires payment on the last day for dismissals and within 72 hours for resignations. Colorado and Massachusetts require immediate payment on dismissal. Many states allow the next regular payday. Penalties for lateness apply in most states.
When should system access be removed?
For an involuntary termination, during the termination meeting. For a resignation, at the end of the last working day. Disable the identity provider first to cut single-sign-on access, then remove accounts on systems outside it, rotate shared passwords the person knew, and remove their MFA devices. Keep an access inventory during employment so the list exists.
What is the COBRA deadline for employers?
The employer must notify the plan administrator within 30 days of the qualifying event. The administrator then has 14 days to send the election notice, so an employer that administers its own plan has 44 days in total. The former employee has 60 days from the later of the notice or the loss of coverage to elect. COBRA applies to group health plans of employers with 20 or more employees.
Do employers have to give a separation notice?
In several states, yes. California requires a written Notice to Employee as to Change in Relationship and the EDD pamphlet. New York requires the Record of Employment, Form IA 12.3, within five working days. Georgia requires the DOL-800 Separation Notice. Around a dozen other states require an unemployment insurance information notice at separation.
How long should employee records be kept after they leave?
Form I-9 for the later of three years from the hire date or one year after separation. Payroll and tax records for at least four years. Personnel files for the period state law sets, commonly three years, and indefinitely while any claim is pending or threatened. Medical and accommodation records separately, with restricted access.