Offboarding Case Tracker

This is the help text the console shows in the help panel on this page.

This tab tracks all offboarding cases for departing employees. Each case represents a structured decommissioning workflow that ensures no access is left behind.

Case Cards

Each card shows:

  • Employee name and email
  • Task progress — for example 2 / 5 tasks done
  • Opened At date and the case status
  • A PDF button to export the case as a report
  • Mandatory Deprovisioning Tasks — one task per asset to revoke. Owners and managers tick a task when the access has been removed; where a Jira integration is set up, the link icon creates a ticket for the task.
  • Assets Detected in Recent Audits — systems where the employee still has active access
  • Open Cases and Completed: counts of offboardings in progress and closed.
  • Recent Activity: the five most recently completed offboardings.

Workflow

  1. An offboarding case is created, either with Start Offboarding on the Employees page or with Remediate on the Compliance page.
  2. The system detects all assets where the employee has access.
  3. Each asset becomes a task requiring confirmation of revocation.
  4. Once all tasks are complete, the case is closed and an audit record is created.

Compliance Value

A closed offboarding case with all tasks completed serves as evidence for ISO 27001 A.5.18 (access rights management) and SOC 2 CC6.2 (logical access removal).

Reconciliation (per case)

Each case header shows how many access items are revoked, outstanding, in discrepancy, or marked done, unverified. A Clean tag means nothing is outstanding and there is no discrepancy.

  • Discrepancy: the task was marked done but the access is still detected. Use Show only these to focus on such items and check them first.
  • Expand a case with Show items to see task status (what someone confirmed) next to inventory status (what the access data shows).
  • Items with access but no task show the next step: remove the access in the source system.
  • Latest detection is the newest time access was detected. It is not the time of a scan and does not guarantee the data is current.
  • Use Needs attention to list only cases with outstanding items or discrepancies.
  • Related: the organisation-wide report is called Offboarding violations.
Last reviewed: 2026-10-15

Was this page helpful?

Esc