To prove offboarding, show a complete list of people who left during the period, the date each left, and a dated record that access was removed from each in-scope system. Compare the two dates against your own stated deadline, and explain any late removals with the fix you made.
How the test works
The auditor asks for all terminations in the period, then samples several. For each sampled person they want the termination date from HR and the removal date from the systems. If your policy says access is removed within one business day, they check that.
The population
Pull the leaver list from the HR system, not from memory. Include contractors and anyone whose access ended for other reasons. Show how you know it is complete, for example by reconciling the HR count to the identity provider's disabled accounts for the same period.
Removal evidence
The strongest evidence is a single sign on or identity provider log showing the account disabled with a timestamp. For systems outside single sign on, such as cloud consoles with local users, source control and databases, keep a ticket or export for each.
List your in-scope systems and check each one in the sample. Missing a secondary system is a typical gap.
Handle late removals
If someone kept access past the deadline, check logs to see whether the account was used after leaving. Record the result. Then fix the cause: automate the identity provider disable from the HR event, and add a checklist item for systems it does not cover.
Shared accounts and keys
Leavers who knew shared passwords or API keys create a hidden gap. Show that you rotated them. Move toward individual accounts so there is less to rotate.
Build the process around the HR event
Start from the HR system. When a termination is recorded, create tasks for each in-scope system automatically, with an owner and a due date. Close the loop by checking that each task was completed and attach the proof. A checklist with signatures is better than memory, and an automatic identity provider disable is better than a checklist.
Test your own sample
Each quarter, pick five leavers and check every system yourself. Record the dates and results. When the auditor samples, you will already know what they will find. Fix anything that fails and note what you changed.
Departures that are not clean
Not every departure follows the plan. Sudden terminations, contractor ends and role changes can slip past an HR based process. Add a trigger from your contractor and vendor management process, and review role changes as part of access reviews. For sensitive roles, remove access at the same moment the person is told, and record the time.
Retain the evidence
Keep offboarding records for the length of your retention policy and at least through the audit cycle. Store them with the leaver list and a copy of the termination date source, so that each sample can be traced end to end quickly.
Quick check
Is a disabled single sign on account enough?
Only if every in-scope system depends on it. Systems with local accounts or long lived keys need separate checks.
Last reviewed: 19 October 2026.
