Offboarding fails in the gaps: the SaaS tool bought on a card that is not in your identity provider, the personal device nobody logged, the shared mailbox still forwarding. This checklist is ordered by risk and by clock, so the things that must happen inside the hour are not sitting below the laptop return.
The measure of IT onboarding is whether someone can do actual work on day one without filing a ticket. That requires starting before they arrive and provisioning from a role template rather than by copying the permissions of whoever sits nearest.
This matrix is the artefact that replaces 'give them the same as Priya'. It makes onboarding a lookup instead of a judgement call, and gives access reviews a baseline to compare actual access against.
Most provisioning delay is not procurement, it is the three days spent asking the hiring manager for information that should have arrived with the request. Standard bundles by role remove most of the questions entirely.