ISO 27001 Offboarding and Role Changes: A.6.5 Evidence

Direct answer: ISO 27001 offboarding and role-change controls should translate a confirmed employment or contractual event into coordinated action across access, assets, information, responsibilities and continuing obligations. Auditors should be able to trace who authorized the event, what changed, when each action occurred and how exceptions were resolved.

ISO/IEC 27001:2022 Annex A control 6.5 addresses responsibilities after termination or a change of employment. Its purpose is broader than disabling one account. A departure or transfer can affect logical access, physical access, devices, records, client responsibilities, privileged knowledge and confidentiality duties.

This article provides AuditPrepared implementation guidance. It does not reproduce the standard. The organisation’s risk assessment, legal obligations, contracts and Statement of Applicability determine the required control design.

Treat departures and transfers as security events

Create a single event record when an employee, contractor, temporary worker or relevant external party:

• resigns or is dismissed;
• reaches a fixed contract end date;
• moves to another department, country or legal entity;
• changes responsibilities, seniority or system privileges;
• begins extended leave that changes the access need; or
• stops supporting a customer, matter, product or supplier relationship.

The record should identify the effective time, event type, risk level, approving manager and affected relationships. A calendar date alone is often insufficient. A high-risk dismissal may require access removal during a controlled meeting, while a routine internal transfer may use a planned effective time and a short, approved handover period.

Assign one accountable coordinator

Many failures occur between teams. Human resources knows the employment event, the manager knows the business duties, IT controls accounts, facilities controls badges, security investigates risk and legal interprets continuing obligations.

Assign a coordinator who confirms that all relevant actions are complete. The coordinator does not need to perform every task. They need visibility over the full event and authority to escalate missed deadlines.

Role	Typical responsibility	Useful evidence
HR or contract owner	Confirm event, effective time and employment terms	Approved event record
Line manager	Identify duties, data, systems and handover needs	Access and responsibility review
Identity or IT team	Change or remove logical access	Identity logs and service tickets
Facilities	Recover badges, keys and physical assets	Return receipt or badge record
Information owner	Decide data transfer, retention and deletion	Approved disposition decision
Security	Set risk level and investigate unusual activity	Risk note and alert review
Legal or privacy	Interpret continuing duties and restrictions	Advice or confirmed obligation

Define substitutes for absences and after-hours events. A process that depends on one HR administrator is not reliable enough for urgent cases.

Build actions from risk and role

Use a role profile or access inventory to determine what changes. Consider:

• workforce identity and single sign-on;
• privileged, shared, emergency and service accounts;
• source code, cloud, finance and production access;
• physical badges, keys and visitor credentials;
• laptops, phones, removable media and authentication devices;
• customer, supplier and partner portals;
• mailing lists, messaging groups and file shares;
• certificates, tokens, API keys and locally stored secrets;
• records, intellectual property and regulated data; and
• delegated approvals, on-call duties and business ownership.

Do not assume disabling the main identity closes every route. Locally managed applications, supplier portals and shared secrets may sit outside central provisioning. The access-control governance guide explains how ownership and periodic review support complete access decisions.

Separate termination from role change

For termination, remove access that is no longer required and recover organisational assets. Transfer business records to an authorized custodian rather than indiscriminately deleting or forwarding a mailbox. Preserve information required for legal, contractual, security or operational reasons.

For a role change, remove old access as well as granting new access. Adding permissions without revoking the previous role creates privilege accumulation. Record any temporary overlap, the approving owner, an expiry time and the reason it is necessary.

Review segregation of duties after the change. A promotion or transfer can unintentionally combine request, approval and execution rights that were previously separated.

Manage information and continuing duties

Access removal does not end confidentiality, intellectual-property or privacy obligations. Identify which duties continue, communicate them in a form the person can understand and retain evidence that the organisation did so.

The employment-terms guidance for A.6.2 helps teams align pre-employment agreements with later exit handling. Classification also matters: use the information-classification guide to decide how sensitive records should be transferred, retained or disposed of.

Avoid uncontrolled practices such as copying all files to a manager, sharing a departed person’s password or leaving an account active for convenience. Preserve business continuity through controlled delegation and record ownership.

Set timing according to risk

Define service levels by action and event type. Examples include immediate privileged-access removal, same-day identity changes and asset recovery by an agreed date. These are organisational choices, not universal ISO deadlines.

For higher-risk exits, consider:

• confidential coordination before the effective time;
• synchronized logical and physical access removal;
• monitoring for unusual downloads or forwarding based on lawful authority;
• rapid rotation of shared secrets the person knew;
• controlled return of remote equipment; and
• an escalation path for missing assets or inaccessible records.

Security monitoring must respect applicable employment, privacy and surveillance law. Obtain appropriate legal advice rather than treating monitoring as automatically permitted.

Preserve evidence of design and operation

Design evidence

• defined triggers and event categories;
• ownership and escalation rules;
• role-based action sets and timing targets;
• integration between HR, identity, facilities and asset systems;
• rules for information transfer and retention;
• treatment of external workers and supplier identities; and
• exception, overdue and high-risk handling.

Operating evidence

• approved termination or transfer record;
• timestamped access changes and badge status;
• asset return, reassignment or approved loss handling;
• manager confirmation of responsibilities and data custody;
• removal from groups, portals and delegated roles;
• acknowledgment of continuing obligations where appropriate;
• exception approvals and closure evidence; and
• periodic metrics and management follow-up.

An unsigned form is not evidence that access changed. Conversely, a directory log alone may not show that supplier access, devices and business ownership were addressed. Strong evidence connects the initiating event to every material outcome.

Trace a worked example

A cloud administrator transfers to a sales-engineering role on 15 October. HR records the effective time and the manager identifies production, code repository, privileged-access and on-call duties associated with the old role.

The new access is approved before the transfer. At the effective time, automated provisioning removes standard groups, while the privileged-access owner separately revokes an emergency account and production role. The on-call schedule and certificate-approval duty move to another administrator. A seven-day read-only overlap for one project folder is approved by the information owner and expires automatically.

The coordinator compares the completed actions with the former role profile, verifies the expiry and closes the event. The evidence demonstrates a controlled change of responsibility, not merely a new job title.

Audit a meaningful sample

Sample different event types: voluntary departure, dismissal, internal transfer, contractor end and high-privilege change. Include remote workers and people with third-party access.

For each sample:

1. compare the source event with its effective time;
2. identify systems, assets and duties associated with the former role;
3. inspect timestamps for access and badge changes;
4. trace data and business ownership decisions;
5. test temporary access for approval and expiry;
6. inspect overdue actions and escalation; and
7. confirm the event was independently closed.

The ISO 27001 readiness checker can help teams find broader process gaps before an audit.

Result	Example
Pass	Sampled events show timely, risk-based action across access, assets, data and responsibilities, with exceptions closed.
Partial	Central accounts are disabled, but external access, role overlap or information custody is inconsistently recorded.
Fail	Events rely on informal messages, former access remains active or no one verifies completion.

Common questions

Does A.6.5 require immediate removal for every account?

The required timing depends on risk, need and the organisation’s control design. High-risk and privileged access commonly needs synchronized removal. Any approved overlap should be limited, justified and monitored.

Can the manager keep using the former employee’s account?

That usually damages accountability. Use controlled delegation, reassignment or retention processes that preserve individual identities and authorization.

What if an asset cannot be recovered?

Escalate it as an exception, assess information exposure, apply remote protection where available and decide whether incident or legal action is required. Keep the decision and closure evidence.

Close the whole security relationship

Effective offboarding and role-change control follows the person, their access, their assets and their responsibilities through one coordinated event. Clear ownership, risk-based timing and traceable evidence turn a fragile administrative task into a dependable security control.