The Joiner Mover Leaver Policy Template: Ownership, SLAs, and Compliance

A joiner mover leaver policy document is not the same thing as a joiner-mover-leaver workflow. The workflow is the automation that moves access and equipment through each stage. The policy is the written standard that says what should happen, who owns each step, and what "done" looks like, and it is the document auditors, new managers, and compliance reviews actually ask for by name. Most businesses have the workflow half-built and no policy document at all, which becomes a real problem the moment a SOC 2 auditor, a new HR hire, or an offboarding dispute asks "where is this written down."

This guide is the policy template itself: the exact sections, ownership assignments, and SLA language we draft for clients, ready to adapt to your organization rather than write from a blank page.

Why You Need the Policy Document, Not Just the Workflow

A working joiner-mover-leaver automation answers "what happens." A policy document answers "what is supposed to happen, who is accountable if it does not, and how do we prove it." These serve different audiences: your automation serves your IT and HR systems; your policy document serves auditors, new managers who need to know their responsibilities, and your own team six months from now when someone asks why an exception was made.

Compliance frameworks that reference access management (SOC 2 CC6.1-6.3, ISO 27001 Annex A.9, GDPR Article 32) specifically look for a documented policy, not just evidence that a system exists. A well-built n8n workflow with zero written policy behind it is a common finding in SOC 2 readiness audits, precisely because auditors cannot verify a process is followed consistently without a documented standard to check it against.

The Policy Template: Section by Section

Section 1: Purpose and scope

State plainly what the policy covers (all employee lifecycle events affecting system access and physical assets) and who it applies to (all employees, contractors, and temporary staff, explicitly naming contractors since this group is the most common gap in real policies we review).

Section 2: Ownership matrix

This is the section most policy templates skip, and the one auditors ask about first. Define exactly who owns each stage:

Section 3: The joiner standard

Every new hire gets provisioned access according to a role-based template, never an ad hoc copy of another employee's permissions. Copying an existing employee's access (a common shortcut) is how permission creep compounds silently over years; a role-based template, reviewed quarterly, keeps grants tied to actual job function.

Section 4: The mover standard

Every role change triggers a two-part review: granting new access needed for the new role, and explicitly revoking access tied only to the old role. The most common compliance gap in real audits is the first half happening (new access granted) while the second half is skipped (old access lingers indefinitely). This policy makes the revocation step mandatory and tracked, not optional cleanup.

Section 5: The leaver standard, split by termination type

Voluntary and involuntary departures need different SLAs. Voluntary: access revoked at end of final scheduled day, after knowledge transfer completes. Involuntary or for-cause: access revoked within 1 hour of the termination conversation, before the employee leaves the building or the call ends, with IT on standby to execute the moment HR confirms.

Section 6: Exception handling

Every real organization has exceptions (a departing employee needed for a 2-week transition period, a contractor extension). The policy must state that exceptions require written approval from a named role (typically CISO or Head of People) and an explicit end date, never an open-ended extension, since undocumented exceptions are exactly what turns into an audit finding a year later.

Section 7: Audit and review cadence

State explicitly how often the policy itself gets reviewed (we recommend every 6 months or after any compliance framework change) and how access grants are periodically re-certified (quarterly access reviews, where each manager confirms their team's current access is still appropriate).

The Ownership Gap: What Our Client Audits Actually Find

Across joiner-mover-leaver policy reviews we have run for clients pursuing SOC 2 or ISO 27001 readiness, the same three gaps appear consistently enough to treat them as the default starting condition, not the exception:

These figures come from our own client audit work, not a general industry survey, and they explain why a policy document paired with the automated workflow closes gaps a workflow alone cannot: the workflow executes steps, but only the policy assigns accountability when a step is skipped or an exception is made.

How the Policy and the Automation Work Together

The policy document defines the SLA (revoke access within 1 hour of involuntary termination). The joiner-mover-leaver automation workflow is what actually executes that SLA reliably, triggering the revocation the moment HR marks a termination in the system, logging the exact timestamp for audit evidence. Neither one replaces the other. The policy without automation is unenforceable in practice; automation without a documented policy has nothing for an auditor to check it against.

Frequently Asked Questions

Do we need a separate policy document if we already have a working automated workflow?

Yes, for any organization pursuing SOC 2, ISO 27001, or similar compliance frameworks. Auditors specifically request a written policy as evidence, separate from proof that a system exists, since a policy documents intended process and accountability in a way system logs alone do not.

Who should own the joiner-mover-leaver policy document itself?

Typically HR or People Ops owns the document, with IT/Security as a required co-signer, since the policy spans both HR process and technical access controls. Neither function alone should own it, since a policy written only by HR often lacks enforceable technical SLAs, and one written only by IT often misses HR process steps like knowledge transfer.

How often should the policy be reviewed and updated?

Every 6 months at minimum, and immediately after any change to compliance framework requirements, a significant reorg, or a security incident that reveals a gap in the current process.

What is the biggest mistake companies make with this policy?

Writing detailed joiner and mover sections while leaving the leaver section vague, especially around involuntary terminations. Since involuntary departures carry the highest security risk, this is precisely the section that needs the most specific, hour-level SLA language, not the least.

Can PURIST help draft this policy for our specific compliance framework?

Yes. A free automation audit includes a review of your current joiner-mover-leaver process against SOC 2 and ISO 27001 requirements, and we draft the policy document alongside building or auditing the underlying automated workflow.