Executive Assistant Vendor Offboarding Checklist

executive assistant vendor offboarding

Close vendor access, assets, integrations, records, billing, and operational dependencies through a timed executive office offboarding process.

Set the effective end boundary

Confirm the contract owner, final service time, notice terms, transition period, and people authorized to change the date. Distinguish immediate risk removal from an orderly planned exit. Avoid telling the vendor that access will continue unless the responsible owner has approved the extension.

Inventory identities and entry points

List named accounts, shared credentials, guest profiles, badges, keys, devices, mailboxes, calendar permissions, portals, application tokens, and integration connections. Include subcontractors and support identities. Compare the list with system owners because invoices and contact lists rarely reveal every access path.

Sequence revocation with continuity

Give security and system owners the exact time for disabling each identity, session, key, token, forwarding rule, and recovery method. Preserve business continuity by moving legitimate workflows before access ends. Never keep a generic vendor account active merely because ownership of one task is unclear.

Recover assets and information

Arrange return of devices, credentials, documents, prototypes, records, storage media, and physical access items. Use an approved transfer route for company data held by the vendor. Verify receipt and condition without asking the vendor to send confidential material through personal email.

Close integrations and automation

Identify scheduled messages, calendar feeds, webhooks, delegated inboxes, forms, payment connections, and data exports that may continue after the human account closes. Reassign or remove them with the application owner. Test critical workflows from a non-vendor account after the change.

Reconcile commercial details

Send final invoices, credits, subscriptions, renewals, purchase orders, and deposits to finance and procurement owners. Do not approve disputed charges or promise payment outside delegated authority. Remove the vendor from standing attendee lists and future budget assumptions when directed.

Verify closure and residual risk

Ask each control owner to attest to completed actions and named exceptions. Monitor failed logins, bounced automations, returned mail, and missing dependencies for an appropriate period. Convert unresolved operational work into assigned tasks rather than leaving a former vendor as an informal backup.

Run a closure review

Compare the approved vendor roster with identity systems, badge records, application guests, active tokens, subscriptions, forwarding rules, recurring meetings, and retained assets. Name an owner for each residual item. Use lessons from missed dependencies to improve onboarding inventories for future engagements.

Common questions

Should every vendor account close at once?

Use the authorized schedule while ensuring that sensitive access ends at the required time.

Who owns retained vendor data?

Contract, legal, records, and system owners should define transfer and retention.

What if an integration has no replacement owner?

Escalate the dependency and disable it according to the risk owner's direction.

Source and service boundaries

Plan operational transitions with administrative support and the vendor access review guide. Ask about a defined offboarding workflow without sharing credentials. Architecture reference: NIST zero trust architecture.