Employee Offboarding & Access Revocation Procedure

Employee Offboarding & Access Revocation Procedure

1. Purpose

Ensure that termination and offboarding actions are coordinated across HR, managers and downstream systems without assuming that a termination record automatically proves access removal.

2. Scope

Applies to employees leaving Metrolane through resignation or other approved termination events.

3. Roles

HR owns the employment event; the manager confirms operational handover; downstream system owners complete access deactivation and asset/knowledge handover; unresolved actions remain visible until completed.

4. Preconditions

A valid employment record and effective termination date must exist. The effective date is Business Time and must not be replaced by the software execution date.

5. Procedure

1. Record the termination event and effective date in HR with the appropriate reason.
2. Identify active assignments, downstream identities and responsibilities requiring handover.
3. Notify responsible system/process owners of the required effective date.
4. Revoke or disable access according to each system's authorized process; do not treat the HR event alone as proof that access has been removed.
5. Record completion evidence or an explicit pending state.
6. Complete asset, work and knowledge handover as applicable.
7. Escalate any access remaining active after the required point.
8. Close offboarding only when required downstream actions have evidence.

6. Exceptions and escalation

If downstream deactivation is not yet actioned, the offboarding record remains incomplete for access purposes even though the HR termination event is valid. The issue is escalated; it is not hidden by editing the termination date.

7. Records

Termination event, notices, downstream access evidence, outstanding-action notes and closure evidence form the offboarding record.

8. Related controlled information

The procedure supports both completed offboarding and cases where one or more downstream access-removal steps remain pending and require escalation.

Process controls

Personnel performing this procedure must use the current published version and the authoritative business records for the activity being processed. Source references, identities and quantities must remain traceable throughout the procedure. Where information is incomplete or contradictory, the affected work is held or escalated rather than completed using an assumed value.

Evidence and audit trail

Each completed execution of the procedure should leave enough evidence to reconstruct the decision path: the triggering business record, the information reviewed, the action or disposition selected, the responsible function and the resulting status. The procedure does not replace the operational transaction; it defines how that transaction is handled and evidenced.

Deviations and escalation

A deviation from this procedure must be explicit, justified and recorded through the responsible business function. Repeated deviations should trigger review of the procedure rather than becoming an undocumented alternate process. Matters that cannot be resolved within the responsible function are escalated to the appropriate owner while preserving the current state and evidence.

Version control

Only the currently published version should be used for new work from its effective date onward. Historical versions remain part of the controlled record so that earlier business activity can be interpreted against the procedure that was effective at that time.