Scarlet Risk · Tool guide
An employee offboarding checklist for access risk
When an employee leaves, an offboarding record should distinguish access that was actually checked from tasks someone still needs to verify. Scarlet Risk’s Employee Offboarding Sweeper combines checks of connected Google Workspace and GitHub accounts with a manual completion checklist. It detects and reports access; it never suspends accounts, removes memberships, or revokes permissions for you.
What the offboarding sweep checks
Start with the departing employee’s name and work email. Connect the relevant services in your account before running the sweep. Google Workspace checks cover directory account state, administrator status, and email aliases. GitHub checks cover access visible through your connected account. Findings identify their source, severity, and whether action is needed.
The scope is these connected services, not every application in your business. If a service is not connected, the tool reports that limitation rather than claiming the employee’s access was checked. Review the findings with the person responsible for each system before marking work complete.
The manual offboarding checklist
Some departure tasks cannot be verified through the connected directories. The sweep includes manual prompts so those tasks remain visible rather than disappearing behind an apparently clean scan.
- Recover company devices and review physical access.
- Review password vaults and rotate shared credentials where needed.
- Check mail routing and forwarding arrangements.
From findings to a signed-off completion record
Review each item, carry out the necessary changes in the relevant service, and mark completed tasks in the sweep. The completion checklist is saved to your account. Once all items requiring action are marked complete, enter the reviewer’s name to sign off the record. Completed sweeps retain the employee details, signer, and sign-off timestamp; the active sweep also offers a print option for your records.
Marking an item complete is the reviewer’s confirmation, not an automatic second scan or proof that a permission was removed. A signed-off record documents the review process; it is not a cryptographic signature or an independent audit opinion.
Where it fits in a compliance and risk program
For a small business or MSP, the record provides a consistent way to discuss a departure’s access risks and outstanding actions. It can support evidence collection for an access-management review, but it does not replace your wider HR offboarding process, payroll responsibilities, or checks in unconnected applications.
The Store purchase is $15 per employee swept, paid once with no subscription required. Sign in to purchase and run a sweep against your own connected accounts. This version is an on-demand review, not continuous monitoring that automatically starts when an employee is deactivated.