Third-party onboarding is the short, repeatable process you run before an outside company or contractor is given anything, and offboarding is the matching process when the engagement ends. Both are recordkeeping jobs: a checklist completed before access is granted, a written note of exactly what was granted and to whom, a light review while the engagement runs, and a closeout that is signed off rather than assumed.
This article is general information about documentation and recordkeeping. It is not legal, compliance or security advice. Which obligations and frameworks apply to a given business varies by organization, industry and jurisdiction, and what any particular engagement should include is a judgment for you and a qualified professional who knows your circumstances.
Why third-party onboarding and offboarding belong in one record
Most businesses have some version of the first half. Someone asks the questions, somebody signs something, access appears. The second half is where the paperwork disappears, because an engagement ending is rarely a project with an owner.
Keeping both halves in one record fixes that. If the same page that recorded what was granted also carries the closeout lines, the closeout is visible as unfinished work rather than as nothing at all. A folder with an open “returned” line reads differently from a folder that just stopped being updated.
The other reason to pair them is that the closeout is only as good as the grant record. You cannot confirm that something was handed back if you never wrote down what went out.
The third-party onboarding checklist before access is granted
Run this before anything is handed over, including trial accounts and temporary shares. Short engagements are where records go missing most often, precisely because they feel too small to document.
- Confirm the engagement is written down. Who the party is, what they will do, who inside the business owns the relationship, and the dates. One paragraph is enough, and it should exist before access does.
- Confirm the review is on file. If this party will touch client, financial or employee records, the written review and the replies belong in their folder before access is granted, not after.
- Decide what they actually need. Write the list of what the work requires, described in your own terms: which record categories, which shared locations, which systems, and whether they need to change records or only read them.
- Decide what they will not get. Writing the exclusions down is what makes the grant reviewable later, and it is the step almost everybody skips.
- Agree how they will connect. Their own named accounts rather than a shared one, and sign-in arranged the way you arrange it for everyone. Record what was agreed.
- Set the end date. Every grant gets an end date, even open-ended engagements, where the date is simply when it will next be re-confirmed. A grant with no end date never ends.
- Name the internal owner and a backup. Two names, because the single most common cause of an unclosed engagement is the owner leaving.
- Record the agreement. The signed document or a pointer to where it is held, plus a note of anything agreed by email that is not in the document.
Nothing on that list requires specialist knowledge. It requires that one person is accountable for completing it and that the checklist lives with the engagement rather than in somebody’s head.
The record of what was granted
This is the single most valuable page in the folder, and it is the one most businesses do not have. It exists so that a year later, or on the day the engagement ends, somebody can answer “what do they have?” without guessing.
| Field | What you write | Why it matters at closeout |
|---|---|---|
| What was granted | Each item, named plainly | The closeout list is a copy of this column |
| Who holds it | The individual at the third party, by name | Companies hand back; people hold |
| Granted on | A date | Tells you the age of the arrangement |
| Granted by | A name inside your business | Gives the closeout somebody to confirm with |
| Scope and limits | What the grant does and does not cover | Lets a later reader see whether it drifted |
| End or re-confirm date | A date | The trigger for the review and the closeout |
| Changed since | Dated lines, appended | Where additions are caught; grants grow quietly |
The “changed since” row is the one to insist on. Engagements expand. A contractor brought in for one task is asked to help with a second, a supplier is sent a new category of records, a second person at the vendor joins the work. Each of those is one appended line, and without them the grant record describes an arrangement that stopped being true months ago.
Keep people and companies separate
Write the company in the engagement record and the individuals in the grant record. When a named individual at a third party moves on, that is a change to your grant record even though nothing about the company changed. Businesses that track only the company name discover this at the worst possible moment.
Review cadence while the engagement runs
The review while an engagement is live should be small enough that it actually happens. The aim is not to re-run the whole review; it is to confirm the record still matches reality.
Set a light pass on a fixed rhythm, quarterly for parties that touch client or financial records and twice a year for everyone else. Each pass answers four questions, with a date and a name against the answers:
- Is the internal owner still correct?
- Is the list of what was granted still accurate, including the people at the other end?
- Has the work changed in a way that should have changed the grant?
- Is the end or re-confirm date still right?
Then add event triggers, because calendars miss things that matter. Re-open the record when the engagement’s scope changes, when the third party tells you about a change on their side, when your internal owner leaves or changes role, and when you are about to send a new category of records.
Log the pass even when the answer to all four questions is no change. Those one-line entries are what distinguish a live record from an abandoned one.
Closeout when the engagement ends
Treat the end of an engagement as a short task with an owner and a date, not as something that happens by itself. The closeout list is the grant record read backwards.
- Confirm the engagement has ended, in writing, with the date and who confirmed it.
- Work down the grant record item by item, marking each one returned, withdrawn or closed, with a date against each line.
- Deal with the copies. Ask what the third party still holds, what they intend to keep, and for how long, in whatever terms your agreement uses. File the answer rather than summarizing it.
- Collect anything that belongs to you. Work product, records, and any documentation produced during the engagement, filed where your team can find it rather than where the project lived.
- Update the related records. Remove the party from the live section of your vendor list, update the rows of your data inventory that named them, and close or amend any register entry that referenced the engagement.
- Close the folder with a date and a name. Move it to a closed section rather than deleting anything, and keep it for as long as you keep comparable business records.
The closeout is also the cheapest moment to learn something. One line in the folder noting what was awkward about the engagement, written while it is fresh, is worth more than a formal review nobody schedules.
Both halves of this process are paperwork, and that is the point. The onboarding checklist takes about twenty minutes per party, the live review takes a few minutes each pass, and the closeout takes an afternoon that would otherwise become a year of uncertainty. For a plain list of the records these processes feed, including the vendor folders, the data inventory and the register, see the Trust Center Document Checklist page on this site.