A.6.5 Audit Checklist

When to use this

Use this checklist during an internal audit of leaver, mover, contractor offboarding, and continuing responsibility controls.

Related controls

• A.6.5 Responsibilities After Termination or Change of Employment
• A.6.5 Audit Evidence Pack
• Leaver and Role Change Security Checklist
• Post-Employment Security Responsibilities Register

Audit checklist

• Confirm termination and role-change procedures exist.
• Confirm owners are assigned for HR, IT, facilities, security, and managers.
• Sample leavers and compare termination date to access removal timestamps.
• Sample movers and verify old-role access was removed.
• Check physical access revocation.
• Check asset and information return evidence.
• Check notification records to relevant parties.
• Check high-risk termination handling.
• Verify continuing duties are defined in contract/NDA and communicated.
• Check contractor and third-party user offboarding.
• Record nonconformities, observations, and improvement actions.

Findings table