Financial Advisor Employee Offboarding: IT Access and Record Preservation Checklist

When an employee leaves a financial advisory firm, changing the email password is only part of the job. Client records must remain available, replacement staff need approved access, and the departing employee's connections to custodians, vendors, and firm systems need individual attention.

For advisory businesses in Frederick, Maryland, this checklist provides a practical way to coordinate leadership, compliance, operations, and IT. Use it for planned departures and adapt the timing for urgent situations. The goal is a documented handoff that protects client information without deleting required records or interrupting client service.

1. Set the cutoff time and decision owners

Open one restricted offboarding record with the employee's identity, authorized departure time, approving manager, IT owner, and compliance contact. Identify who can request custodian changes, approve record access, and decide whether evidence needs preservation. Keep personnel details limited to those who need them.

For a planned departure, prepare the inventory and replacement access beforehand. For an urgent departure, coordinate containment and preservation in parallel. Do not delay necessary access restrictions while waiting for every administrative detail.

2. Inventory accounts, permissions, and dependencies

Build the list from administrator consoles and existing records, not just the employee's recollection. For each entry, record its owner, administrator, access-removal method, retained-data location, and completion evidence.

• Microsoft 365, local network accounts, VPN, remote-support tools, and password managers.
• CRM, planning, portfolio reporting, billing, e-signature, document storage, and communications archives.
• Custodian portals, trading permissions, money-movement permissions, and vendor support accounts.
• Shared mailboxes, group ownership, delegated permissions, scheduled reports, and integrations.
• Firm-issued laptops, phones, security keys, removable storage, and approved personal-device access.

Record which accounts the firm controls and which belong to the employee personally. Do not take ownership of a personal account or rely on the employee's personal recovery channel to administer a firm service.

Separate the person's access from firm-owned automation. If a reporting job depends on their account, arrange a supported replacement identity and test it before disabling the dependency. Do not give the next employee the departing employee's login.

3. Decide what must be preserved before deleting anything

Have the compliance lead identify record categories, applicable retention periods, legal holds, and authorized reviewers. Include relevant email, messages, client instructions, CRM notes, documents, and local files. Check that archived information remains readable and retrievable after the employee loses access.

SEC Rule 204-2 requires covered investment advisers to maintain specified business records, including certain written communications. FINRA Rule 4511 addresses member firms. Do not assume every RIA has identical obligations or automatically falls under FINRA's rulebook. Compliance should determine the requirements for the firm's registration and business.

Record where preserved material resides, who can retrieve it, and how retrieval was tested. A manager's working copy is not, by itself, proof that the firm's recordkeeping requirements are satisfied.

4. Remove access in each system

At the approved time, disable applicable accounts, reset credentials where appropriate, and revoke active sessions and refresh tokens. Review registered MFA methods, security keys, recovery contacts, and app-specific credentials associated with firm accounts. Rotate shared secrets the person knew without disrupting unrelated services.

Microsoft's access-revocation guidance explains that an application can issue its own session token, which Microsoft Entra ID cannot directly revoke. A central account change therefore does not prove every vendor session has ended. Check application-specific controls and document any delay.

Have the authorized firm contact verify removal of custodian portal entitlements, including administrative, trading, and money-movement access. Obtain confirmation from vendors when their intervention is required. Track those requests until completion, rather than marking them done when submitted.

5. Handle Microsoft 365 preservation and licensing deliberately

Choose the mailbox outcome with compliance and operations before removing licenses or deleting the account. A shared mailbox can support an approved service handoff, while an inactive mailbox can serve a different preservation purpose.

Microsoft's shared-mailbox guidance says the original account must remain as its anchor. Conversion alone does not prevent the former user from signing in. Licensing depends on mailbox size and features, including holds and archiving.

For an inactive mailbox, confirm appropriate licensing and that the required hold or retention settings have actually applied before deletion. Also verify the separate disposition of OneDrive, SharePoint, and other work content. If identities synchronize from on-premises Active Directory, have IT follow the appropriate hybrid process.

6. Recover devices without indiscriminate wiping

Record returned equipment by asset identifier and verify its condition. Before reissuing or wiping a device, confirm required records and potential evidence are preserved.

For personal devices, use the approved process for removing firm-managed data without erasing unrelated personal content. Microsoft's mobile-device guidance includes account-only wipe options, but the administrator must verify what the selected action does for that device and configuration. Never treat a pending remote command as proof of successful removal.

7. Verify the handoff and close exceptions

Confirm that replacement staff can complete essential client-service workflows using their own authorized accounts. Review mailbox forwarding, delegated access, group ownership, and retained-record retrieval. Investigate unexpected sign-ins or exports through the firm's incident process rather than assuming misconduct.

Close the checklist with timestamps, administrator or vendor confirmations, device receipts, preservation decisions, and unresolved exceptions assigned to named owners. Schedule removal of temporary successor access. Leadership and compliance own the business and recordkeeping decisions; IT implements and verifies the approved technical steps.

This checklist is general operational information, not legal advice. The firm's compliance team and counsel should determine its specific obligations.