Xoxoday Empuls requires all constituents to return company-issued assets — including devices, access credentials, security tokens, and proprietary documentation — as part of a formal offboarding and asset-handback process jointly coordinated by HR, IT, and management.
What Assets Must Be Returned
Xoxoday Empuls requires constituents to return all company-issued physical and logical assets at the point of termination or status change. This includes computing devices such as laptops and desktop workstations, mobile devices and PDAs, physical access cards and building keys, security tokens and smart cards, and any proprietary or confidential documentation in the employee’s possession. The scope intentionally covers both hardware and information assets. A returned laptop alone is insufficient — confidential documents, whether printed or stored on personal devices, must also be surrendered as part of the handback process.How the Offboarding Checklist Works
The asset return process is managed through a formal offboarding and asset-handback checklist coordinated jointly by HR, IT, and the departing employee’s direct manager. Each function holds a defined responsibility: HR initiates the offboarding workflow, IT prepares the asset inventory and revocation steps, and the manager confirms handback completion. For organisations using HRIS platforms such as Workday, SAP SuccessFactors, or Darwinbox, the offboarding trigger can be aligned with the system-of-record status change to prompt asset collection automatically, reducing the risk of steps being missed during high-volume attrition periods.Access Revocation Is Tied to Asset Recovery
Xoxoday Empuls sequences access revocation to the completion of asset handback. Facility access and system credentials are revoked only after the relevant assets have been recovered and verified by IT. This creates a clear, auditable chain of custody rather than an ad hoc process. As a practical example, a departing engineer’s laptop is collected, inspected, and logged by IT before Active Directory credentials, VPN access, and physical badge are formally deactivated. This prevents scenarios where access removal is marked complete before the device itself has been secured.Compliance Alignment
This asset return and access revocation process aligns with the controls required under ISO 27001 — specifically control A.8.1.4 (return of assets) — and supports the access management criteria evaluated during SOC 2 Type II audits. Maintaining a documented, auditable offboarding trail is a prerequisite for demonstrating compliance to enterprise customers and external auditors. Xoxoday Empuls treats asset recovery as a security control boundary, not an administrative formality. Every handback is logged, verified, and tied to downstream access deprovisioning to close the offboarding loop completely. Learn more: [Xoxoday Empuls Help Centre — 8. IT RISK ASSESSMENT](Does Empuls revoke employee access within 24 hours?
Understand how Xoxoday Empuls handles the deprovisioning of system credentials, facility access, and VPN rights when an employee exits or changes role.