Blog · Employee onboarding · Problem 42 of 93
Your onboarding lives in one person's head. Turn it into a checklist anyone can run.
· 3 min read · By Case Jones
One person, often an office manager or the first engineer, knows how to set up a new hire. They do it from memory, and it mostly works, until they are on vacation the week someone starts.
What it costs to leave it
Steps get missed when the person is busy, and the missed ones are often security steps like MFA or a background check. New hires lose days waiting for accounts. When an auditor asks for five onboarding records, there is nothing to show beyond what that one person remembers.
How to get the steps out of their head
The knowledge is there. You need one hour with the person who has it and a format that does not depend on them.
- 1
Shadow the next onboarding, or replay the last one
Sit with the person while they set up the next hire, or walk through the last one together. Write every step, including the small ones they do without thinking. Ask what they do when something goes wrong.
- 2
Sort the steps by who does them and when
Group them by role. HR handles the offer letter and the background check, IT handles the laptop and accounts, the manager handles the first-week plan. Then order them by timing, from before day one to the end of week one.
- 3
Decide what each step should leave behind
For the steps an auditor or a customer will care about, say what proves they happened. A signed policy acknowledgement, a screenshot showing MFA on, a photo of the laptop's disk encryption setting. Most steps need nothing more than a tick and a date.
- 4
Start it from the hiring event
A checklist that someone has to remember to open has the same problem as one in their head. Start it when the offer is signed or when the HR system marks someone as hired. Give each step a due date counted from the start date.
- 5
Test it on the next hire, then fix it
Have someone else run the checklist for the next start, with the original person on hand. Every question they ask is a missing line. Update it the same day.
Example
A sample onboarding checklist for a 40-person company
Before day one: HR confirms background check, IT orders laptop, IT creates Google account in the right groups. Day one: IT confirms disk encryption and MFA with a screenshot, employee signs acceptable use policy, manager shares the first-week plan. Week one: employee completes security training, IT grants role access by ticket, manager signs off that access matches the role.
Or let the checklist run itself
In 93 Compliance, you write onboarding as a procedure and it becomes a runnable checklist. It can start from a button or from your HR system through an API key or webhook when someone is marked as hired. Each step goes to a role, and the person doing it sees what started it and a link back.
Steps wait in the team's queue, and someone takes them. People on time off are skipped, and overdue steps remind, then go to the role's leads or the manager, then administrators. Controls collect photos, files, answers or a sign-off, and every run is kept as a record you can show an auditor. The iPhone app's Work tab lets people do their steps and take photo evidence from the camera.
- Onboarding as a runnable checklist
- Starts from a button, a schedule or your HR system
- Steps routed to HR, IT and managers through team queues
- Reminders and escalation for overdue steps
- A kept record of every onboarding
Make it a checklist
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
What should an employee onboarding checklist include for security?
Background check where lawful and relevant, signed acceptable use and confidentiality agreements, device encryption, MFA on all accounts, access granted only for the role, and security training within a set time. Keep a record of each.
Who should own onboarding?
One person should own the checklist itself and keep it up to date. The steps can belong to different roles, and the owner makes sure each role knows its part.
How many onboarding records will an auditor look at?
Auditors usually pick a sample of new hires from the audit period and ask for each one's records. The size of the sample depends on your auditor and how many people you hired.