Joiners and leavers get attention because they are visible events. Movers do not, which is why permission creep is almost entirely a mover problem: people accumulate access from every role they have held.
Fix the HR trigger first. Almost every JML failure traces to IT not being told. Define the trigger (a status change in the HR system, ideally automated) rather than relying on a manager remembering to raise a ticket.
Treat a mover as a leaver plus a joiner. Remove the old role's access first, then grant the new role's. Adding without removing is how someone ends up holding finance, HR, and engineering access after three internal moves.
Set an SLA per event and measure it. Leaver revocation within one business day is the common standard and the one auditors test. Measure actual performance rather than assuming the process works.
Here's a preview. Unlock the free download to get all 3 sections (2 more below).
| Event | Trigger | Triggered by | IT SLA | Access action | Evidence produced |
|---|---|---|---|---|---|
| Joiner | Contract signed; start date set in the HR system | HR system automation | Ready by start date | Grant role template only | Onboarding ticket with provisioning record |
| Mover: internal transfer | Role change effective date in the HR system | HR system automation | On effective date | Remove old role template, then grant new | Change ticket showing both removal and grant |
More free templates IT teams use alongside this one.
Offboarding fails in the gaps: the SaaS tool bought on a card that is not in your identity provider, the personal device nobody logged, the shared mailbox still forwarding. This checklist is ordered by risk and by clock, so the things that must happen inside the hour are not sitting below the laptop return.
The measure of IT onboarding is whether someone can do actual work on day one without filing a ticket. That requires starting before they arrive and provisioning from a role template rather than by copying the permissions of whoever sits nearest.
An access review where every manager clicks approve is worse than no review, because it manufactures evidence that access was checked. This template is built to produce the two things auditors actually test: a named reviewer who attested, and proof that the revocations they asked for happened.
The defined process for granting, changing, and revoking access as people join, change roles, and leave. It covers the trigger for each event, who owns it, the SLA, the access action, and the evidence produced for audit.
Because internal moves usually grant new access without removing the old. After two or three moves a person holds access across several functions, which breaks segregation of duties and is rarely noticed until an access review.
Within one business day for a standard departure, and immediately for involuntary ones or anyone holding privileged access. Auditors commonly sample leavers and test the gap between departure date and revocation timestamp.
