Virtual Assistant Offboarding Checklist: Access and Handover

Why does a virtual assistant need a formal offboarding checklist?

When a virtual assistant leaves, work does not stop at the last video call. Customer conversations, recurring reports, stored passwords, shared folders, and automations may still depend on their account. Without a handover, a business may lose context or leave unnecessary access open long after the working arrangement ends.

Good offboarding therefore has two parallel tracks. The operational track transfers unfinished work, records, and ownership to a manager or successor. The security track removes access to business data and systems according to the approved termination plan. Closing an account before recovering client-owned files can be as disruptive as forgetting to close the account at all.

Plan the order of actions in advance. A short, respectful process with clear expectations is more reliable than an urgent instruction to send everything over before midnight. Follow the applicable agreement and legal requirements about notice, final compensation, data handling, and returned property.

What access must be removed when a VA leaves?

Make a register of every work system the person touched: company email, calendar, CRM, project boards, cloud storage, analytics tools, advertising accounts, social media management, ecommerce systems, customer support desks, password managers, VPNs, and any third-party dashboards. Record whether access is through a named login, group membership, shared secret, service token, or integration.

A named login can often be disabled after ownership is transferred. A shared account requires additional steps because disabling one user's personal account may not prevent continued access. The system owner may need to rotate a secret, revoke existing sessions, review application passwords, or replace a token used in a workflow.

Do not store actual passwords in the inventory. Store a system name, access owner, permission type, cutoff time, removal method, reviewer, and confirmation. Where data retention duties apply, preserve the authorized business record without keeping a former worker's unnecessary live access.

When should offboarding activities happen?

An orderly planned departure may allow the business to prepare several days ahead. An unexpected or high-risk separation may require the security team to terminate access immediately. The timing is a risk decision and must respect employment, contractual, privacy, and preservation requirements.

In a routine handover, name a coordinator, collect the current work list, and schedule a walkthrough with the successor. Agree on the final deliverables and what will remain unfinished. Save work in client-controlled systems and identify the final reviewer before individual accounts are deactivated.

On the final day, verify the agreed compensation or invoice handling process, receive the handover, and have system owners confirm their access tasks. After the cutoff, check for stale integrations, unexpected login activity, missed dependencies, and tasks assigned to an inactive user.

What should a virtual assistant handover document include?

The handover is not a folder dump. The successor needs a concise record of recurring tasks, current priorities, source documents, important contacts, approved templates, upcoming deadlines, and unresolved decisions. A note that says 'everything is in Drive' is not enough to continue a complicated queue.

For each active workflow, record what is complete, what is waiting, the last verified state, where evidence lives, who should act next, and when. Include ordinary pitfalls such as a tool integration that fails when a certain permission expires or a client who expects a weekly report in a specific format.

Use the business's approved storage and communication systems. Do not ask someone to email personal copies of customer records, share a personal password, or export material that is not part of the agreed business handover. The manager should check the records before marking the transition complete.

• Recurring workflow name, frequency, current SOP, and new owner.
• Open tasks with status, next action, promised deadline, and source link.
• Business contacts and approved communication templates.
• Automations, scheduled reports, and integrations requiring an owner.
• Pending exceptions that require business approval.

Is deactivating a VA account enough to remove access?

Disabling a primary user account is a key step, but it might not cover every connection. The assistant could have separate logins to third-party tools, shared folder links, delegated mailbox permissions, saved app tokens, or client-managed devices. Each service owner should follow the organization's security procedure for terminating accounts and sessions.

Check connected OAuth apps, long-lived keys, shared mailbox delegates, mobile access, project invitations, and password manager groups. When a shared secret was used or exposed, rotate it through the designated owner. Do not tell the departing assistant to delete corporate records before confirming the company's lawful retention needs.

CISA's Cybersecurity Performance Goals include a defined process for revoking credentials when personnel depart. Use that principle as an operational control, while tailoring exact timing and access steps to the contract, security risk, and applicable obligations.

What other obligations belong in a VA exit process?

Ask the contract or HR owner to verify what compensation, notices, reimbursements, deposits, or other arrangements are due. Terms differ between direct engagements, employees, independent contractors, and managed placements; a simple article cannot determine which arrangement applies to a specific working relationship.

If the assistant uses company property, list the hardware and accessories, shipping method, return deadline, and confirmation. If the assistant uses a personal device with approved company applications, involve the IT owner in revoking accounts and addressing company data under the agreed device and privacy policy.

Communicate any client-facing transition clearly. Customers should not discover that their request was abandoned because the previous assistant left. Provide the successor's contact path and avoid publishing unnecessary personal details about the departing person.

What evidence should a manager retain after offboarding?

Proof of completion should be proportional to the system and risk. A manager sign-off may be enough for a simple checklist item, while an administrator's access log may be more appropriate for sensitive tools. Do not retain excessive private information just to demonstrate that the checklist was completed.

A reusable offboarding spreadsheet should list the system, control owner, task, deadline, status, evidence note, and reviewer. Update it when the technology stack changes rather than using a template that misses newly added systems.

1. Confirm every open customer and internal assignment has an active owner and a reviewed next action.
2. Verify company-owned files, reports, and automations are accessible to an authorized current account.
3. Review account and group access removal confirmations from system owners.
4. Check whether shared passwords, app tokens, delegated mailbox rights, and active sessions were addressed.
5. Confirm invoices, payroll, property, and contractual documents were sent to the correct administrative owner.
6. Record unresolved exceptions and an explicit follow-up date instead of pretending every task is done.
7. Conduct a short post-transition review to improve future onboarding and offboarding procedures.

How can onboarding make VA offboarding easier?

Many offboarding problems start on day one. A personal email used as the account owner, a sole employee holding the only automation token, or undocumented SOPs can make departures needlessly expensive. Prevent these weaknesses by creating company-controlled identities and storing approved processes in a shared workspace.

Assign a backup owner for each recurring workflow. Use named accounts and limited permissions, maintain a central SOP register, and review user access when responsibilities change. These practices improve ordinary coverage during illness or vacation, not only termination events.

If you are preparing to hire another assistant, bring the handover evidence into the replacement job brief. It should clarify workload, required tools, working hours, and mistakes the next person must be able to prevent. VAPH's hiring flow can help translate the confirmed duties into a more focused candidate search.