93 Compliance
← The onboarding checklist in someone's head

Example · a procedure run in 93 Compliance

Onboarding and offboarding, run as checklists with evidence

These are two checklists running right now at Fernhollow Health, a fictional company we use for demos. Each one started from a procedure the company wrote, and each step goes to a role: HR, IT, the manager, Security, or the person joining or leaving. A step is checked off with its evidence (a file, a photo, an answer or a sign-off), and 93 Compliance keeps who did it and when. Nothing here is made up for the page: it's the demo company's own data as of 12 November 2026.

Checklist

New Hire Onboarding Procedure — Sam Wright

A candidate signs an offer letter

Started 11 Nov 2026, 00:48 UTC · by Marcus Oyelaran · New Hire Onboarding Procedure, version 1

In progress · 3 of 17 done
Department:
Customer Success
Start date:
2026-11-15
Role bundle:
Customer Success
New hire's full name:
Sam Wright
Employment type:
Employee

Waiting on: Manager (Lucía Ortega): Confirm role bundle and extra access needed, overdue

  1. 1

    Send offer and agreements for e-signature

    HRPriya Raman· done by Priya Raman, 11 Nov 2026, 00:49 UTC

    Send the offer letter, confidentiality agreement and invention assignment for e-signature.

    • Kept · Signed offer and agreements:evidence.pdf· fingerprinted· 11 Nov 2026, 00:49 UTC
  2. 2

    Start background check

    HRPriya Raman· done by Priya Raman, 11 Nov 2026, 00:49 UTC

    Start the background check once the offer is signed. Do not set a start date before it clears, where allowed by local law.

    • Kept · Background check result:Pass· 11 Nov 2026, 00:49 UTC
  3. 3

    Create new hire record and open onboarding ticket

    HRPriya Raman· done by Priya Raman, 11 Nov 2026, 00:49 UTC

    Create the new hire in the HR system with role, department, manager and start date. This opens an onboarding ticket in #it-onboarding automatically.

    • Kept · HR record created:evidence.pdf· fingerprinted· 11 Nov 2026, 00:49 UTC
    • Kept · Onboarding ticket reference:Done· 11 Nov 2026, 00:49 UTC
  4. 4

    Confirm role bundle and extra access needed

    Overdue
    ManagerLucía Ortega· due 12 Nov 2026, 00:49 UTC

    Confirm the role bundle in the ticket (Engineering, Customer Success, Sales, Operations or People) and list any access outside the bundle with a reason.

    • Needs a sign-off:Manager's approval in ticket

    Overdue 2026-11-12 00:53 UTC: reminded Overdue 2026-11-12 04:53 UTC: sent to the administrators

  5. 5

    Approve access outside role bundle

    Check
    Security· after step 4

    Approve any access outside the role bundle. Privileged access (AWS, production databases, Okta admin, GitHub owner) is never granted in the first 14 days.

    preventive check, against: Excessive or privileged access granted too early

    Not the same person who did step 4 (Manager: Confirm role bundle and extra access needed).

    • Needs a sign-off:Security approval in ticket
  6. 6

    Create Okta account and assign approved groups

    IT· after step 5

    Create the Okta account and assign the approved Okta groups only. Google Workspace, Slack, GitHub and Zendesk accounts are created through Okta provisioning. No local accounts.

    • Needs a file:Okta user and group assignment log
  7. 7

    Prepare the MacBook

    Check
    IT· after step 5

    Enrol in Jamf, confirm FileVault is on with the recovery key escrowed, and confirm the firewall, screen lock and endpoint protection profiles are applied.

    preventive check, against: Unencrypted or non-compliant device issued to new hire

    • Needs a file:Jamf inventory record showing FileVault Encrypted and compliance Pass
  8. 8

    Ship laptop and security key

    IT· after step 7

    Ship the laptop and a FIDO2 security key (engineers and admins) with tracking, to arrive by day 1.

    • Needs a answer:Shipping tracking number
  9. 9

    Sign policy acknowledgements

    Check
    New hire· after steps 6, 8

    Sign the Acceptable Use Policy and acknowledge the Information Security, HIPAA and Remote Work and Device policies in 93 Compliance. Okta access to anything other than 93 Compliance and Google Workspace is held until this is done.

    preventive check, against: New hire gains system access without acknowledging security and privacy obligations

    • Needs a file:Signed acknowledgements in 93 Compliance
  10. 10

    Enrol MFA and set password

    New hire· after step 9

    Enrol in Okta Verify (number matching) and, if issued, the FIDO2 key. Set a password of at least 14 characters in 1Password. Done with IT on a call.

    • Needs a file:Okta factor enrolment log
  11. 11

    Verify MFA enrolment and trusted device

    Check
    IT· after step 10

    Check in Okta that MFA is enrolled and the device shows as trusted. Close the setup part of the ticket.

    detective check, against: Account accessible without MFA or from an untrusted device

    • Needs a photo:Screenshot or Okta report
  12. 12

    Assign training

    HR· after step 9

    Assign security awareness training and HIPAA training in 93 Compliance, due 30 days after the start date.

    • Needs a file:Training assignment record
  13. 13

    Complete training

    New hire· after step 12

    Complete both the security awareness and HIPAA training courses.

    • Needs a file:Completion record and quiz score
  14. 14

    Send training reminders and escalate if overdue

    HR· after step 12

    Send reminders at day 14 and day 25 if training is not done. On day 31, notify the manager and Security; Security may suspend non-essential access until it is done.

    • Needs a file:Reminder log
  15. 15

    Review actual access against approved bundle

    Check
    Manager· after step 11

    Review the new hire's actual access in Okta and in each connected system against the approved role bundle. Confirm it is correct, or list what should be removed. This must be the manager, not IT. If the manager is also IT, Security performs this step instead.

    detective check, against: Access granted beyond what the role requires goes undetected

    Not the same person who did step 6 (IT: Create Okta account and assign approved groups).

    • Needs a sign-off:Signed access confirmation
  16. 16

    Remove flagged access

    IT· after step 15

    Remove any access the manager (or Security) flagged in the access review.

    • Needs a file:Removal recorded in ticket
  17. 17

    Close onboarding record

    HR· after steps 13, 16

    Close the onboarding record once training completion and the access review are both done.

    • Needs a tick box:Closed onboarding record

If something goes wrong: If a control step fails (privileged access requested early, device not encrypted or non-compliant, MFA not enrolled, training overdue past day 31, or unapproved access found at the day-14 review), notify Security and the Manager. Security may suspend non-essential access until the issue is resolved. Escalate to the People & HR Manager or IT Lead if not resolved within the escalation window. (Tells Security; escalates after 4 hours.)

Kept for audit: Signed offer and agreements, background check result, HR record, onboarding ticket, manager and Security approvals, Okta provisioning log, Jamf inventory record, shipping tracking, signed policy acknowledgements, Okta factor enrolment log, MFA verification evidence, training assignment and completion records, reminder log, signed access confirmation, access removal record, closed onboarding record. (Length of employment plus 3 years.)

What you're looking at

  • Started: what set the run off, who started it, and the details it was started with.
  • Steps: green is done, blue is open now (it shows who has it and when it's due), grey waits for the steps before it. A step marked Check is a control: it names the risk it stops.
  • Needs / Kept: the evidence a step asks for, and what was handed in. Files are fingerprinted (SHA-256) when they arrive, so a changed file shows.
  • Not the same person: a check that must be done by someone other than the person who did an earlier step, such as the manager (not IT) confirming the new hire's access.
  • Overdue: 93 Compliance reminds the person, then tells the administrators. The notes on a step are those messages.
  • Cleanup for this page: email addresses are left out. The demo's set-up script checked off the first steps with stand-in answers, so some answers read “Done” and the files are placeholder PDFs.

Run your own checklists

Write the procedure once, or let 93 Compliance draft it from your policies. Every run then goes step by step to the right people, with the evidence kept for the audit.

Start free
Onboarding and offboarding checklists example | 93 Compliance | 93 Compliance