Joiner, mover, leaver evidence: what to keep for an audit

For each joiner, mover and leaver, keep a record showing the request, the approval, the access granted or removed and the time it happened. Auditors sample people from your full HR list, so the evidence has to exist for every one of them, not only the tidy cases.

Joiners

Keep:

• The start date from HR.
• The access request and who approved it.
• Proof that access matches the role, not more.
• Completion of required training or policy acknowledgment, if your policy sets deadlines.
• Device issue and setup records, if they matter to your controls.

Timing is the test. If your policy says access is granted before day one and a record shows day three, that is a deviation to explain.

Movers

Role changes are the weak spot. People collect access over the years and nobody removes the old. Keep:

• The change record from HR.
• The new access approved.
• Evidence that the old access was removed, with date.

If you cannot show removal, the auditor may ask whether access was reviewed another way, such as periodic access reviews.

Leavers

This is the most sampled of the three. Keep:

• The termination date from HR.
• The ticket or workflow that triggered removal.
• A log or export showing accounts disabled, with timestamps.
• Return of devices, if tracked.
• Removal from third party tools and shared accounts.

Check shared credentials and API keys the person knew. Disabling the user account does not rotate a shared secret.

Build the population properly

The auditor will ask for everyone who joined, moved or left in the period. Draw it from HR, then compare with account lists from your main systems. Contractors and interns often exist in the identity system but not HR. Reconcile the two before you hand the list over.

Common causes of exceptions

• Offboarding done days late over a weekend or holiday.
• Accounts left in a SaaS tool no one connected to the identity system.
• Verbal requests with no ticket.
• Different time zones making a same day removal look late.

Automating the trail

Linking HR, identity and ticket systems gives a timestamped trail. Safeguard's compliance and evidence automation can collect account and user records for this, along with people and training status. Your process still needs people who act on each step.

One simple improvement is a single checklist per event type that lives in your ticket tool. Each step has an owner, and closing the ticket requires attaching proof. The completed ticket then becomes the evidence for that person, ready to be sampled. It also gives managers a clear list of what to do, which removes the weekend delays that cause the most exceptions.

Quick check

Last reviewed: 19 October 2026.