Most people only look for a virtual assistant offboarding checklist after something goes wrong. The service ends on Friday. Your assistant has shared a folder called "Handover," and you've got a list of passwords to change.

Then, the following week:

  • A customer asks about an unfinished refund nobody knew about.
  • A scheduled report fails to run.
  • You discover the main spreadsheet belongs to an account outside your business.

The missing piece wasn't another farewell checklist. You treated two different jobs as one.

  1. Make sure they can't access your systems anymore.
  2. Make sure someone else can carry on the work.

Those have different finish lines. A useful virtual assistant offboarding checklist proves both.

This guide covers ending an outsourced service agreement, not dismissing an employee. The order of steps depends on the risk, your contract and what your systems actually allow.

Here, a virtual assistant (VA) means an independent freelancer or agency.

Editorial scene showing reviewing the owner decision at a worktable for this guide.

Is this a friendly handover or a security incident?

Start by writing down why the service is ending, and whether there's any immediate concern about access.

A friendly, planned exit normally allows a careful transfer.

Suspected misuse might mean you need to lock things down before transferring anything.

Don't use the same sequence for both. Leaving broad access open during a suspected breach can increase the damage. Deleting accounts too quickly can destroy records or break recovery. If security is involved, get proper technical help and keep relevant evidence.

Name one person to coordinate the exit. In a small business, that's probably you. They track actions, owners and proof, without needing to personally make every legal or technical call.

Read the agreement before setting a final date. Check:

  • notice,
  • outstanding fees,
  • any paid handover help,
  • who owns the work,
  • confidentiality,
  • returning or deleting data.

If you're buying through an agency, contact the agency's named manager. The person doing the work might not be the one who can agree handover terms.

Editorial scene showing checking a remote handover with another person for this guide.

List every unfinished job before asking for a general "handover"

Create a private document called Open work at transition. Ask for every:

  • unfinished case,
  • recurring task,
  • future commitment.

Include things waiting on someone else, not just things currently being worked on.

For each item, record:

  • a clear identifier (not just a customer name),
  • current state,
  • last completed action,
  • next required action,
  • due date,
  • a link to the evidence,
  • proposed new owner.

Pay close attention to the difference between:

  • prepared and approved,
  • approved and sent.

A finished draft might still need a decision. An approved payment might not have been made. A scheduled message might go out next week even though the task looks done.

Ask what lives outside the task system: relevant business inbox, calendar invites, recurring invoices, platform queues. Don't ask for their personal mailbox or other clients' records.

Then find the items that become expensive if forgotten: promised customer replies, renewals, disputed payments, a campaign already scheduled. Give those an interim owner now, even if the long-term replacement isn't ready.

Editorial scene showing comparing the workload against a simple calendar for this guide.

List access by system, not by the passwords you remember

Create a second document: an access register. For each system your VA used, list:

  • the account or invitation,
  • the permissions granted,
  • any shared password,
  • the business owner,
  • how access will be removed,
  • who will check it.

Then go looking for less obvious access:

  • Connected apps (tools linked to your accounts),
  • API keys (codes software uses to connect, without a normal login),
  • Active sessions (they may still be logged in somewhere),
  • Email forwarding rules,
  • Recovery email addresses or phone numbers,
  • Devices registered to business accounts.

None of those necessarily disappears just because you removed an entry from your password manager.

When you remove something, record the account, action, time and what you saw afterwards. If it's only been requested from support, leave it marked open. A request isn't proof that access ended.

Don't put actual passwords in this register. Refer to where they're stored. The checklist shouldn't become a portable list of secrets.

Our secure access guide covers setting access up properly next time.

Editorial scene showing reviewing the evidence before approving the next step for this guide.

A worked example: three hidden dependencies

Here's a hypothetical example.

A small design studio is ending a reporting and admin service. The VA maintains project updates, sends approved reports and tracks customer questions. It's ending amicably because the VA is narrowing their services.

Dependency 1: the file the studio didn't own. The handover folder has report PDFs. Useful records. But the replacement can't edit next month's report, because the source spreadsheet sits in the VA's own external account. A shared link gave access without giving the studio ownership.

Dependency 2: the hidden customer conversation. The open-work register reveals a client waiting for a revised quote. The report was done, but the promised follow-up wasn't. The owner takes over that conversation, so it doesn't vanish behind a "completed" report.

Dependency 3: the automation running under their name. A recurring report runs on a connection created using the VA's identity. Remove their access, and the report might stop. Keep their access forever, and the business stays dependent on someone who's left.

So the studio plans three separate actions:

  1. Get a usable, business-controlled copy of the source file.
  2. Transfer the customer conversation with its next action.
  3. Rebuild or reconnect the automation under a business-managed identity.

Each gets its own proof of completion.

The test: can the new owner take the next real action without using the old VA's account or asking them to remember what happened? A folder full of finished PDFs doesn't answer that.

Editorial scene showing checking access and responsibility before the work continues for this guide.

Transfer ownership, then prove the files still work

Check who owns each important file before changing any accounts. A document showing up in your shared folder doesn't mean your business owns it.

Google's admin guidance on transferring Drive ownership covers transfers within the same organisation. It says direct transfer to or from external accounts isn't supported by that admin method.

So don't assume a freelancer's files can just be reassigned through your admin console. If transfer isn't available, agree an export or copy process, and check you have the right to it.

Then check what survived. Formulas, comments, links, version history, forms and connected data may not all come across the same way.

In the studio example, the replacement opens the copied spreadsheet, checks its inputs, produces a sample report, and compares it with the approved original. Any broken connections get recorded. That tells you far more than "the download finished."

Keep the originals as needed while fixing the new working copy. Don't delete the source just because a file with the same name exists elsewhere.

If transfer is blocked, write down the exact file and the consequence:

"Next report can't be regenerated because the source workbook is still externally owned."

That tells you exactly what to resolve before Friday.

Hand the replacement a real case, not a document library

Pick one representative open item. Ask the replacement to explain its state using only the handover records:

  • What's the latest approved information?
  • What's the next action?
  • What's missing?
  • What authority is needed?

Do a safe rehearsal before any external action. In the studio example, the replacement drafts a reply about the revised quote but doesn't send it. The owner checks they understood the pending pricing decision, not just the writing style.

Where context is missing, add it to the shared record. Don't solve every gap through private messages, which just recreates the same dependency with a new person.

Transition help from the departing VA should follow your agreement. Don't assume an independent provider owes unlimited training after the service ends. If extra overlap would help, agree a defined scope and fee.

Prioritise active cases, recurring deadlines and risky exceptions first. Organising old history can wait.

Our onboarding checklist covers the other side of the handover.

Switch off access and switch on the new owner at the same time

Set a clear cutover time, with a named time zone. Record which systems change, who changes them and who's available if something breaks. In a friendly exit, tell your VA the plan so they can finish agreed handover work first.

At cutover:

  • Remove named invitations and delegated access.
  • Change any genuinely shared passwords they knew.
  • Check recovery and two-step verification settings tied to them.
  • Keep business ownership and recovery routes intact throughout.

For Google Workspace accounts, Google's suspension guidance says suspending a user blocks access without deleting their email, documents and calendars. But it also blocks new email and calendar invites to that account, and suspended accounts are still billed.

So suspension isn't a complete plan for mail continuity or saving money. Decide separately about:

  • mail routing,
  • data retention,
  • licences,
  • ownership.

Don't delete an account just to save a licence fee before you understand what data and automations depend on it. Google's user removal guidance treats data transfer as a deliberate part of the process.

In the studio example, the replacement confirms their access works before the old access is removed. Then the coordinator checks the reporting connection under the new identity. If it fails, they use a manual fallback while an administrator fixes it. They don't quietly restore the old VA's login as a permanent fix.

Check the scheduled things that run after everyone's gone

Review anything scheduled or automated:

  • reports,
  • social media posts,
  • email campaigns,
  • recurring workflows.

Removing a person might leave a queued action running, or stop it unexpectedly. It depends on how each tool stores schedules and logins.

For each automation, name:

  • the business owner (who decides if it continues),
  • the credential owner (whose login it runs under).

Decide: continue, pause or retire. Then test a safe run and check the actual output, not just a green "connected" badge.

Check connected apps separately too. Google's guidance on linked apps explains that removing "Sign in with Google" doesn't delete data held by the other app. Removing access isn't proof of deletion elsewhere.

But don't remove every integration in a panic. An accounting feed or booking tool might be shared infrastructure the whole business relies on. Understand what each does before revoking, unless there's a security emergency.

For customer communications, check the sender, the reply-to address and the new owner. A message can go out correctly while replies land in an inbox nobody's watching. Send a harmless test where appropriate.

Keep a short post-cutover watch list of specific things to check: the next report run, the open quote conversation, the incoming client inbox. Not a vague "keep an eye on everything."

Keep the records you need, delete the copies that shouldn't exist

Agree what happens to your data:

  • What must be returned?
  • What copies must be deleted?
  • What records can each side legitimately keep?

Your VA might need to keep their own invoices. That doesn't mean keeping your entire customer database.

Where UK controller-processor rules apply, the ICO's contracts guidance describes end-of-contract return or deletion, with exceptions where storage is legally required. The guidance is under review following legislative changes, so check the current version.

Don't assume every VA is automatically a "processor." It depends on what they actually did with the data.

Ask for a specific confirmation covering the agreed data and locations, including downloads and any approved helpers. Don't demand access to their personal device as a routine shortcut.

If backups can't be deleted immediately, agree how they'll be handled. Don't accept a vague "it's all gone," and don't insist on something impossible just to tick a box.

Keep the offboarding records themselves private. They may contain customer details, security settings or a dispute.

Close only when every leftover issue has an owner

Reconcile the final invoice, approved expenses, prepaid balances and any agreed handover work against your actual terms.

Record disputed items separately and use the agreed process. Don't invent fines, hold back payment for unrelated finished work, or use account access as leverage without proper advice.

Send a short closure note: service end date, work transferred, access changes and anything still outstanding. Keep facts separate from opinions. Customers usually just need the new contact and continuity details, not the backstory.

Your final register should show:

  • the next owner of every active case,
  • where essential source files now live,
  • completed access removals with proof,
  • leftover exceptions with an owner and a decision date.

Some leftovers can wait. A query about the old archive might be sorted later. A missing account owner or an inaccessible live customer queue is urgent and needs a decision now.

Back to the design studio after its next reporting cycle: the report runs from a business-owned spreadsheet, the quote conversation has a new owner, and automations use the right identity. That proves continuity. The recorded removal of old permissions proves the separate access outcome.

A clean exit isn't just the old VA's name disappearing from a settings screen. It's a business that keeps working, knows what's unresolved, and doesn't rely on access that should have ended.

The offboarding checklist

VA OFFBOARDING CHECKLIST

Reason for ending / planned or security concern:
Exit coordinator:
Contract terms checked (notice, fees, data, ownership):

OPEN WORK REGISTER
For each item: ID / state / last action / next action /
due date / evidence link / new owner

ACCESS REGISTER
For each system: account / permissions / shared passwords /
connected apps / API keys / forwarding / recovery details /
removal method / who checks / proof

FILES
Business owns source files? (Y/N)
Export or transfer method:
Tested by replacement? Result:

AUTOMATIONS
Each one: business owner / credential owner /
continue, pause or retire / tested?

CUTOVER
Date and time (named time zone):
Replacement access confirmed before removal? (Y/N)
Accounts suspended / removed / licences decided:

DATA
Returned / deleted / legitimately retained:
Confirmation received:

CLOSE
Final invoice reconciled:
Disputed items and process:
Closure note sent:
Post-cutover watch list:
Remaining exceptions, owners and dates:

For building a better setup next time, see how to give a virtual assistant access safely and how to keep a good virtual assistant.

Frequently asked questions

What should I do when my virtual assistant leaves?

Two separate things: make sure they can no longer access your systems, and make sure someone else can carry on the work. Build an open-work register and an access register, transfer files, check automations, then remove access in a planned order.

Can I transfer Google Drive files from an external freelancer?

Google's admin transfer tools work within the same organisation and don't support direct transfer from external accounts. You'll usually need an agreed export or copy, and should check what that preserves.

Should I suspend or delete my VA's Google Workspace account?

Suspension blocks access without deleting their data, but new email and invites are blocked too, and the account may still be billed. Plan mail routing, data transfer and licences before deleting anything.

Does removing a VA's login remove all their access?

Not always. Check connected apps, API keys, shared passwords, forwarding rules, recovery details and automations running under their identity.

Can I withhold final payment if I'm unhappy with my VA?

Don't improvise penalties. Pay according to your contract, raise disputed items through the agreed process, and get advice if needed.