Skip to main content
EnzRossi
FreeChecklist/6 parts

Developer Offboarding Checklist

Adapt this for your stack. Not every item applies to every team, but skipping the audit step always costs you later.

By Alisson EnzUpdated October 20263 min read
Get the free PDFStart reading
6 parts/3 min read

Table of contents

What's inside

The first 2 chapters are free to read on this page. The full checklist comes as a PDF you can save, print and share with your team.

  1. 01Day 1: Immediate access revocationDo this within hours, not days. Every hour of delay is an hour of unnecessary risk.
  2. 02Day 1: Knowledge transfer initiationStart this the same day you learn about the departure. Do not wait until the last week.
  3. 03Week 1: Code and documentation auditMake sure nothing breaks after they leave.
  4. 04Week 1: Exit interviewRun this as a conversation, not a survey. For terminations, skip to knowledge transfer and access items.
  5. 05Final day: Administrative closureRun the checklist one more time. Do not rely on memory.
  6. 06Post-departure: 30-day auditThe step everyone skips. Set a calendar reminder. This is not optional.

What you'll take away

  • Access revocation checklist

    Every account, key, token, and permission that needs to be revoked on day one.

  • Knowledge transfer protocol

    How to capture what lives in someone's head before they leave.

  • Code and infrastructure audit

    What to review in repos, CI/CD, and cloud access when an engineer departs.

Free preview

Part 1

Day 1: Immediate access revocation

Do this within hours, not days. Every hour of delay is an hour of unnecessary risk.

Code and deployment

  • Git hosting. Remove from the GitHub, GitLab, or Bitbucket organization and every repository.
  • CI/CD. Revoke pipeline access (GitHub Actions, CircleCI, Jenkins, and similar).
  • Deploy keys. Rotate any shared deploy keys or machine tokens they could access.

Cloud and infrastructure

  • Cloud consoles. Revoke AWS, GCP, or Azure access. Check IAM users and assumed roles.
  • Kubernetes. Remove from cluster RBAC and revoke service account tokens they created.
  • Network. Revoke VPN credentials and invalidate SSH keys on every server.
  • Databases. Revoke production credentials. Rotate shared credentials if any existed.

Communication and tools

  • Slack and email. Deactivate Slack, disable company email, and forward it to their manager for 30 days.
  • Internal tools. Remove from Notion, Linear or Jira, Figma, and every other internal tool.
  • Third-party SaaS. Remove from Datadog, PagerDuty, Sentry, LaunchDarkly, and similar.

Identity and credentials

  • Password manager. Remove from the vault. Rotate any shared credentials they accessed.
  • SSO. Revoke the session and force logout across all connected applications.
  • Personal tokens. Invalidate any API keys or tokens they created in any system.

Part 2

Day 1: Knowledge transfer initiation

Start this the same day you learn about the departure. Do not wait until the last week.

Map what they own

  • Inventory. List every service, codebase, and system they own or mainly maintain.
  • Single points of failure. Identify the systems only they know how to operate.
  • New owners. Assign a new owner to each critical system right away.

Transfer the knowledge

  • Recorded sessions. Schedule and record a knowledge transfer session for each critical system.
  • Missing docs. Have them write down undocumented processes: deploy quirks, environment gotchas, tribal knowledge.
  • Pairing. Have them pair with the new owner on at least one live task per system.

Reassign open work

  • Tickets and PRs. Reassign all open Jira or Linear tickets and in-progress pull requests.
  • Schedules. Transfer scheduled deployments and update on-call rotations.

Keep reading in the PDF

4 more chapters are in the free PDF, with every table, template and checklist ready to print.

  1. 03

    Week 1: Code and documentation audit

    Make sure nothing breaks after they leave.

  2. 04

    Week 1: Exit interview

    Run this as a conversation, not a survey. For terminations, skip to knowledge transfer and access items.

    Write up key themes within 24 hours. Share relevant feedback with leadership. If patterns emerge across multiple exits, flag them as systemic.

  3. 05

    Final day: Administrative closure

    Run the checklist one more time. Do not rely on memory.

  4. 06

    Post-departure: 30-day audit

    The step everyone skips. Set a calendar reminder. This is not optional.

    If you found lingering access during this audit, your Day 1 process has a gap. Fix the process, not just the permission.

Send me the PDF
Alisson Enz

About the author

Alisson Enz

Founder & CEO, EnzRossi

Alisson founded EnzRossi, which builds AI-ready product and engineering teams in Latin America for US companies. These guides come from what our team learns screening engineers and supporting remote teams every week.

More about EnzRossi

Keep learning

More from the library

See the whole library

Checklist/6 parts/5 min read

The Team Scaling Checklist

A printable checklist for CTOs and engineering leaders planning to double or triple their engineering team. Covers infrastructure readiness, team structure, hiring pipeline, budget modeling, and early warning signals.

Read the preview

Guide/10 chapters/25 min read

How to Manage Remote Developers

Managing remote developers is not the same as managing in-office developers remotely. Different rules. Different tools. Different instincts. This guide covers the frameworks, templates, and rituals that actually work.

Read the preview

Checklist/5 parts/3 min read

The Final 1-on-1 Checklist

A printable checklist for engineering managers and tech leads who want to run 1-on-1s that actually build trust, surface problems early, and keep good people around.

Read the preview

Need a replacement fast?

We can have vetted candidates ready in 3 days.

Book a Free Consultation

We use cookies for analytics and marketing.