---
title: Employee Offboarding IT Checklist for CPA Firms
description: "A step-by-step IT offboarding checklist for CPA firms: Microsoft 365, tax software, client portals, IRS e-Services, devices and your WISP."
---

[Cybersecurity For Businesses In 2024](https://blog.tech-adv.com/cybersecurity-for-businesses-in-2024)

# [Employee Offboarding IT Checklist for CPA Firms](https://blog.tech-adv.com/cybersecurity-for-businesses-in-2024/employee-offboarding-it-checklist-cpa-firms)

 Written by [Tech Advisors](https://blog.tech-adv.com/cybersecurity-for-businesses-in-2024/author/tech-advisors) | Oct 21, 2026, 10:35:33 AM

When someone leaves your firm, the goodbye lunch is the easy part. The hard part is making sure their access leaves with them. A departing staff accountant may still have a working Microsoft 365 login, a saved password to your client portal, a seat in your tax software, and a phone full of client email. At a CPA firm, every one of those is a door into taxpayer data.

Most firms handle offboarding from memory. That works until the week it doesn't, usually in the middle of tax season. This checklist turns it into a repeatable process your office manager and your IT provider can run the same way every time, whether the person is retiring after twenty years or leaving on two weeks' notice.

## Key takeaways

- Build the access list **before** the last day, not after. You can't remove what you don't know they have.
- Disable the Microsoft 365 account on the last day, and sign out every active session, not just the password.
- Tax software, client portals and IRS e-Services are separate logins. Each one needs its own step.
- Change every shared password the person knew: Wi-Fi, vendor portals, admin accounts.
- Write it down. The FTC Safeguards Rule expects access controls, and your WISP should describe how you remove access.

## Before the last day: build the access list

Start as soon as you know the departure date. Sit down with the person's manager and list every system they touch. For a typical CPA firm employee that includes:

- Their Microsoft 365 account: email, OneDrive, Teams, and any shared mailboxes they can open
- Tax and accounting software such as UltraTax, CCH Axcess, Lacerte, Drake or QuickBooks Online Accountant
- Client portals and file-sharing tools such as SmartVault, ShareFile or TaxDome
- Their IRS e-Services account and any role they hold on the firm's e-file application
- Remote access: VPN, remote desktop or a hosted desktop
- The firm's password manager, if you use one, and any shared vaults
- Phones, voicemail, and any company-paid mobile device

Decide now where their work goes. Who takes over their open engagements? Who needs their email for the next few months? Getting those answers early keeps the last day from turning into a scramble.

## On the last day: close the doors

Do these steps at the end of the person's final working day, in this order:

1. **Block sign-in to Microsoft 365** and revoke their active sessions, so a laptop or phone that is already signed in loses access too. Remove their MFA methods so an old authenticator app can't be used to get back in.
2. **Convert their mailbox to a shared mailbox**, or set up forwarding, and give the manager access. Clients will keep emailing them for a while.
3. **Move their OneDrive files** to the person taking over their work before the account is removed.
4. **Remove them from tax software, client portals and IRS e-Services.** These logins live outside Microsoft 365, so disabling email does not disable them.
5. **Turn off remote access** and remove them from the password manager.

## Devices, phones and the front door

Collect the firm laptop and any company phone, and check them in against your asset list. If the person read firm email on a personal phone, remove the company data from it. With a device-management tool like Microsoft Intune this is a selective wipe: it removes the firm's apps and data and leaves personal photos alone.

Don't forget the physical side: building badges, office keys, and the alarm code.

## The week after: check and tidy up

| Task | Why it matters |
| --- | --- |
| Change shared passwords they knew | Wi-Fi keys, vendor portals and shared admin logins don't change when one account is disabled. |
| Review sign-in activity | Look for attempts to use the old account after the last day. |
| Check mailbox rules and forwarding | Make sure no rule is still sending firm email to a personal address. |
| Release licenses | Free up the Microsoft 365 and tax software seats you're paying for. |
| Update your records | Note what was removed and when, for your WISP and your next audit. |

## Why this belongs in your WISP

The FTC Safeguards Rule requires firms that handle customer financial information to limit access to the people who need it. Removing access promptly when someone leaves is the simplest way to show you do. IRS Publication 4557 makes the same point for tax professionals: protect taxpayer data by controlling who can reach it.

Your written information security plan should describe your offboarding steps, who is responsible for each one, and how you record that they happened. If your WISP doesn't mention offboarding yet, this checklist is a good place to start.

## Final thoughts

Good offboarding is boring, and that's the point. When the same steps happen every time, a departure never becomes the reason client data ends up somewhere it shouldn't. If you'd like help turning this into a documented process, or you'd rather have your IT provider handle it for you, Tech Advisors does this for accounting firms every week.

[View full post](https://blog.tech-adv.com/cybersecurity-for-businesses-in-2024/employee-offboarding-it-checklist-cpa-firms)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Tech Advisors"
  },
  "dateModified" : "2026-10-21T12:04:28.757Z",
  "datePublished" : "2026-10-21T10:35:33Z",
  "headline" : "Employee Offboarding at a CPA Firm: The IT Checklist",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://43915658.fs1.hubspotusercontent-na1.net/hubfs/43915658/blog-images/employee-offboarding-it-checklist.jpeg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.tech-adv.com/cybersecurity-for-businesses-in-2024/employee-offboarding-it-checklist-cpa-firms",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60,
      "url" : "/hs/hsstatic/content_shared_assets/static-1.4092/img/default-amp-logo.png",
      "width" : 60
    },
    "name" : "Cybersecurity For Businesses In 2024"
  }
}
```