Managing keys and passes during onboarding and offboarding

You manage the issuing and collection of keys and access passes most tightly by setting up onboarding and offboarding as a process in your ITSM or ESM tool, not as loose emails between IT, FM and HR. Work with fixed role profiles that determine which assets someone receives, record per employee who has what (a CMDB), and let the right tasks for each department arise automatically with every ticket. When someone leaves, you run the same process in reverse, so no laptop or pass stays assigned to their name.

Why does collection at offboarding so often go wrong?

Issuing usually goes fine: if a new employee is missing a laptop or pass, they raise the alarm themselves. At departure that prompt is gone. Nobody actively reports that a laptop, a key or an access pass is still assigned to them, and so assets quietly disappear out the door.

In sectors with high turnover or temporary staff, such as healthcare, that problem piles up. Every month people come and go, and every missed collection is a cost and a security risk. An access pass that stays active or a laptop with business-sensitive data that drops off the radar is exactly what you do not want.

Why is the last working day almost never the contract end date?

There is another trap nearly every organisation walks into: IT and FM plan the collection on the date the contract ends, but by then the employee is long gone. Remaining holiday days are usually taken before departure, so the last day in the office often falls one or more weeks before the formal leaving date. HR does know, it is right there in the leave records, but that information rarely reaches IT and FM in time. The result: the last working day has already passed, and the laptop, keys and pass need collecting from someone who no longer enters the building.

The fix is to record two dates in the same offboarding notice:

• The contract end date: the day you definitively revoke accounts, licences and the access pass.
• The last physical working day: the day you plan the handover, the collection of laptop, keys and pass, and the moment the employee signs.

Attach the IT and FM collection tasks automatically to that last working day, not to the contract date. Ask for the last working day as a standard field in the notice form, or pull it from the leave records through the HR integration, and let an AI Worker raise a flag whenever an offboarding notice has a contract date but no last working day. Then nobody has to sort things out afterwards with an employee who has already left.

How do you set up issuing and collection as a process?

The core is that onboarding and offboarding is a shared process, not a separate handoff per department. A new employee means a laptop (IT), an access pass (FM) and a registration (HR). Three departments, one ticket, one overview. Set it up like this:

• Create fixed role profiles. Per role you record which assets belong to it, so the right laptop, phone, keys and pass issuing are on the list automatically.
• Create a ticket for every onboarding or offboarding notice, at least two weeks in advance, so there is time to arrange or collect everything.
• Let the profile generate the tasks for IT, FM and HR, and keep the overview in one portal instead of in five mailboxes.
• Have the employee sign digitally for receipt and for collection, so there is always a recorded moment of handover.

A simple overview of who does what, in both directions:

Department	At onboarding	At offboarding
IT	Set up laptop and accounts, assign software	Collect laptop, revoke accounts and licences
FM	Issue access pass and keys, set up workspace	Deactivate pass, collect keys and workspace
HR	Process contract and registration	Report departure and start the process

What do you record in a CMDB?

A CMDB (configuration management database) is a register of your company assets that records which asset, with details such as serial number and type, belongs to which employee.

By automatically creating a registration at issuing, you know at any moment which assets someone has accumulated. If a laptop does not work, you see right away which device it is. And at offboarding the return list is not a puzzle, but a checklist the system has ready for you. That is the difference between hoping you forget nothing and knowing for certain that you forget nothing.

How do automation and AI help with offboarding?

The less the process depends on people remembering it, the more reliable it becomes. Two levers help with that.

Connect your ITSM or ESM tool to your HR system, think of AFAS, NMBRS or YouForce. A new or departing employee then starts the process automatically, without anyone manually passing on that someone is arriving or leaving.

And let an AI Worker thoroughly review every offboarding notice: which assets are still assigned, which accounts are still active, which pass has not yet been deactivated. An AI agent that actually creates and closes tasks, not just suggests, catches exactly the collection that would otherwise slip through the cracks.

What does a process instead of separate tools deliver?

Onboarding and offboarding touch IT, FM and HR at the same time. As soon as those three work in separate tools, the friction appears: three systems, three handoffs, and assets that fall between the cracks. Gfacility brings IT Service Management, Facility Management and HR processes together on one engine, so the whole joiner-mover-leaver flow sits in one portal, with a CMDB underneath and AI Workers that guard collection. The portal works where your people already work, in Outlook and Teams, so the ticket actually gets created and the process does not end up running through email after all.