The Employee Offboarding Checklist Most Companies Get Wrong

Offboarding checklists are usually thorough about access. Disable the email account, revoke the VPN, collect the keys and the badge, change the shared passwords. They are almost always silent on one thing: what sensitive data is actually sitting on the computer being handed back.

The gap

A long-serving employee's computer collects things. Client files saved for convenience, spreadsheets exported for a one-time task, email attachments downloaded and forgotten, scanned IDs on the desktop. Some of it should have been cleaned up long ago. When that laptop is wiped and handed to the next hire without anyone looking first, two things are lost: the chance to learn whether the person kept more than their role required, and any record of what was on the machine if questions come up later.

Picture a small bookkeeping office where a part-time employee leaves on good terms. IT disables her accounts the same afternoon and reimages the laptop the next morning. Months later a client asks whether their tax documents were ever stored on staff computers. Nobody can say. That is a documentation problem, and it is avoidable.

What to add to offboarding

1. Scan before you wipe. If the computer already runs a MyVaultMate agent, review its latest findings. If a fresh look is needed, run a manual scan first. Include synced OneDrive or Google Drive folders and any external or USB disks the person used.
2. Compare to expectations. Does the data match what that role should have handled? A receptionist's laptop holding payment card numbers or full intake forms is a surprise worth understanding.
3. Export a record. Save the findings as a PDF, CSV or XLSX and keep it with the offboarding file. It shows what was found and when you looked.
4. Handle what you found. MyVaultMate finds and ranks; it moves or deletes nothing on its own. Your IT provider or your own staff decides what to keep, move to the proper location or securely remove.
5. Then wipe or reassign. Once the data is accounted for, reimaging is a clean, final step.
6. Check the cloud side. Review shared folders and forwarding rules that the person created, since those live outside the laptop.

What a scan will and will not tell you

Be realistic about limits. The agent reads Word and Excel (new and old formats), PDF, text, CSV, JSON, XML, HTML, .eml and Outlook .msg files. It does not read pictures, videos, recordings or image-only PDFs (each is listed as “Not scanned” with a risk score of 70), and it does not read RTF and PowerPoint files, Outlook .pst data files, or zip archives yet. A clean scan therefore means "no matches in the file types we read," not "nothing sensitive exists." Detection is rule-based, so occasional false alarms happen, and health information is found through health ID numbers (medical record, Medicare and insurance member numbers) and a keyword signal that a file reads like a medical record.

Why this is cheap insurance

If the computer is already enrolled, this step is a review of an existing scan, not a new project. The cost of skipping it is invisible until a dispute, an audit or an incident investigation asks what was on that machine. A one-page record in the personnel file answers that question in a sentence.

Make it routine

• Add "review device findings" to the same checklist line as "disable email."
• Name who reviews it, and who signs off before reimaging.
• Apply it to departing contractors who used office machines, not just employees.
• Do the same when someone changes roles inside the office and no longer needs certain data.

You can start a 14-day trial at /trial/ (a card is required and never charged automatically: the 14 days start at your first computer, and you choose a plan when they end) and try it on the next laptop that comes back.