Mover Risk Checklist
A mover risk checklist manages access and data exposure when employees change roles, teams, locations, business units, or privilege levels.
Primary Audience & Scope
HR, IAM, managers, data owners, program managers
When to Use
- •A workforce or third-party lifecycle event occurs.
- •High-impact access needs review.
- •Evidence of access decisions is required.
Interactive Work Area
Fill or track items interactively and copy out to your Clipboard
Template Table Structure
| Field | Working prompt | Item | Required evidence / record |
|---|---|---|---|
| Person or entity | Name, ID, role, organization, sponsor | Trigger | Departure, role change, contract end, review cycle, incident, exception |
| Access scope | Systems, data, facilities, privileged rights, groups, shared spaces | Decision | Keep, remove, modify, suspend, exception, investigate |
| Owner | Manager, IAM, data owner, vendor manager, Legal/HR as applicable | Due date | YYYY-MM-DD |
| Validation | Evidence that action was completed and reviewed | — | — |
Checklist Audit List
Role change trigger identified.
Old manager certifies access no longer needed.
New manager certifies required access.
Data owners approve continued access to sensitive repositories or datasets.
Privileged access reviewed and adjusted.
Physical access reviewed.
System ownership and shared mailbox ownership transferred.
Access validation completed after role change.
What Completion Looks Like
- 1Access decisions recorded.
- 2Removals validated.
- 3Exceptions time-bounded.
- 4Evidence retained.
- 5Owner and due date assigned.
Insider Risk Capability Framework™ (IRCF™) Alignment
Operationalize This Template in RiskTKO®
Use RiskTKO® or request ITMG® support to adapt this template, align it to the Insider Risk Capability Framework™, and connect the output to measurable exposure reduction. Contractor Offboarding Checklist