Vendor Offboarding Checklist

Why supplier exits go wrong

Vendor exits go wrong in two expensive places. The first is a notice deadline nobody diarised, so the auto-renewal fires and you pay for another full term of a supplier you already decided to leave. The second is data — access is cut before anyone exported it, or a destruction certificate arrives for records you never managed to load anywhere else.

Both come from the same cause: an exit treated as a cancellation rather than a project. This is that project, in the order it happens, with the function that owns each task and whether it falls at decision and notice, during transition, or at close-out. It is the same 47 tasks as the downloadable workbook — not a summary of it — so procurement, legal, IT and finance are all working one list.

1. Exit Decision & Approvals

Before anyone serves notice, be sure you can actually leave. A single-source vendor with no replacement lined up is not an exit, it is an outage with a date on it.

• Document exit rationale and decision approval Non-renewal, termination for convenience or cause, or consolidation — name the approver. Procurement Decision & notice
• Assess business criticality and single-source risk Confirm a replacement or in-house plan exists before notice is served. Business owner Decision & notice
• Identify downstream dependencies Integrations, sub-processors, client commitments, regulatory reporting. Business owner Decision & notice
• Secure legal, security, finance and owner sign-off Approve the exit plan and target termination date. Procurement Decision & notice
• Agree the communication plan Internal stakeholders, affected customers, single named vendor contact. Procurement Decision & notice

2. Contract Close-Out

The notice deadline is the whole game. Miss it and the auto-renewal fires, and you are paying for another full term of a vendor you decided to leave.

• Read termination clause; calculate notice deadline Auto-renewal dates, notice method and address, cure period for cause. Legal Decision & notice
• Serve written notice in the contractual form Retain proof of delivery. Legal Decision & notice
• Quantify early-termination fees and minimums Compare cost of exiting now vs running to renewal. Finance Decision & notice
• Invoke transition-assistance / exit-support clause Agree scope, duration, rates and deliverables in writing. Procurement Decision & notice
• Confirm surviving obligations Confidentiality, IP and licenses, indemnities, audit rights, insurance, data protection. Legal Decision & notice
• Terminate all subordinate documents SOWs, order forms, POs, DPA and sub-processor arrangements. Procurement Decision & notice

3. Service Transition & Knowledge Transfer

Continuity is bought with overlap. Collect the runbooks, configs and credential inventories while the vendor still has a reason to answer the phone.

• Publish dated transition plan with cutover date Include a rollback position if the replacement is not ready. Business owner Transition
• Onboard replacement vendor or internal team in parallel Overlap services where continuity matters. Business owner Transition
• Collect operational documentation before access ends Runbooks, configs, custom code, credential inventory, open tickets, escalation history. IT Transition
• Hold knowledge-transfer sessions Record them where the contract permits. Business owner Transition
• Notify affected customers or partners Include any sub-processor change notice your own contracts require. Legal Transition
• Confirm service levels hold through notice period Write down the exit criteria for "transition complete". Business owner Transition

4. Data Return & Destruction

Get the extract out before access dies, validate it in the new system, and only then authorise destruction — a certificate for data you could not load is worthless.

• Inventory every data set the vendor holds Personal data, financial records, source code, documents, backups, sub-processor copies. Security Transition
• Export a full data extract in an agreed format Do it before access is cut; verify against record counts. IT Transition
• Load and validate data in the new system Validate before authorizing destruction at the outgoing vendor. IT Transition
• Obtain signed certificate of data destruction Cover production, backups, archives and sub-processors; state method and date. Security Close-out
• Reconcile destruction against retention obligations Document carve-outs for legal hold, tax or regulatory retention. Legal Close-out
• Update privacy records Remove from processor register, data-flow maps, published sub-processor list. Legal Close-out

5. Access & Integration Teardown

Both directions, and rotate anything they could see. Integrations left running do not fail loudly; they leave silent gaps in your data.

• Disable vendor accounts and guest identities At the agreed hour; log timestamps. IT Transition
• Revoke API keys, tokens, service accounts, webhooks In both directions; rotate any secret the vendor could have held. IT Transition
• Remove network paths VPN and site-to-site tunnels, SFTP endpoints, IP allowlists, firewall rules. IT Transition
• Decommission integrations and scheduled jobs Prevent silent data gaps and alert noise from failing syncs. IT Transition
• Cancel physical and site access Badges, visitor authorizations, facility keys, equipment access. Facilities Transition
• Run a post-teardown access review Confirm no residual identity, key or integration remains active. Security Close-out

6. Asset & Property Recovery

Not just laptops. Domains, certificates, licence seats and the right to use your logo are all property, and all easy to leave behind.

• Recover company equipment on loan Log serials and condition on the Property Recovery tab. IT Close-out
• Recover badges, keys and site passes Deactivate before or on collection. Facilities Close-out
• Recover confidential documents and media Or obtain certified destruction. Security Close-out
• Take delivery of deliverables and source materials Source code, designs, final work product, build artifacts. Business owner Close-out
• Transfer domains, DNS and certificates Move registrar and certificate ownership to your control. IT Close-out
• Reclaim licenses, seats and subscriptions Cancel or transfer; confirm seat counts removed. IT Close-out
• Stop vendor marketing use of your brand Remove name and logo from customer lists, case studies and website unless agreed. Marketing Close-out

7. Financial Settlement

The money usually flows back to you here — unused prepayments, SLA credits, deposits. Cancel the payment rails yourself rather than trusting the final invoice to be final.

• Reconcile open invoices, POs and accruals Match against services actually delivered. Finance Close-out
• Claim credits, refunds and prepaid balances Unused prepayments, SLA service credits, deposits held. Finance Close-out
• Cancel recurring payments and payment rails Auto-renew, card-on-file, standing ACH or direct-debit mandates. Finance Close-out
• Issue final payment and record mutual release Note any disputed amounts separately. Finance Close-out
• Deactivate the vendor master record in AP After final payment clears; confirm 1099 position for the tax year. Finance Close-out
• Release the budget line and update forecasts Redirect the spend rather than silently retaining it. Finance Close-out

8. Records, Risk & Review

Close the vendor properly in the risk register and write down whether you would use them again. That note is the only thing your successor will have.

• Close the vendor in the third-party risk register Retire recurring due-diligence, SOC 2 and insurance-certificate reviews. Security Close-out
• File the termination packet Notice and proof of delivery, transition plan, destruction certificate, access log, settlement, release. Procurement Close-out
• Retain records for audit and statutory period Note the disposal date. Legal Close-out
• Score final vendor performance Record a rehire or do-not-use recommendation for future sourcing. Procurement Close-out
• Hold a short exit retrospective Feed lessons into the contract template and this checklist. Procurement Close-out

Next

• Employee Offboarding Checklist — the same discipline for a person rather than a supplier.
• Offboarding and data-protection compliance — the data-return and destruction obligations in more depth.
• Managing device and asset returns
• All checklists