A standard offboarding checklist covers accounts, devices, keys and a final pay run. For a migration practice it is missing the part that generates obligations after the person has gone.
When the departing employee is a registered migration agent, their name is written into service agreements, they remain a responsible migration agent on matters they worked on, and the practice may need to vary agreements to keep giving assistance lawfully. None of that is on a generic checklist, and all of it is time-bound.
What happens to the agreements they are named in
Section 42(3)(b) requires a service agreement to include the name, MARN and contact details of the agent who signs it, and of each agent who, when it was signed, was expected to give immigration assistance under it.
So a departing RMA is named in every agreement they were expected to work on. OMARA's guidance addresses what to do when someone not listed needs to take over: where an RMA who was not listed in accordance with that subparagraph gives immigration assistance to the client, an amendment to the service agreement should be made under section 44.
Section 44 is not a notification. Before the variation, each client covered must be given written notice of the proposal and the reasons for it, and the variation does not take effect unless each client agrees in writing — unless the agreement itself provides that not every client's agreement is required, in which case at least one client must agree and any other conditions must be met.
The practical consequence: a departure across a caseload of forty matters may require forty variations, each needing client notice and written agreement, before the replacement agent can lawfully do the work. That is a project, and it starts on the day notice is given rather than the day the person leaves.
The guidance also notes the converse, which is useful: unless it is expected that a named agent will be unavailable, you need not list every agent who might cover an unanticipated absence. But planned absence is different — where an agent has planned leave during a period a client will need assistance, the details of the agents expected to take over should be listed.
Their responsibility does not leave with them
Section 12 defines a responsible migration agent in relation to a service agreement as each agent who gives, or has given, immigration assistance under it.
Past tense. An agent who worked on a matter remains a responsible migration agent for that agreement after they leave your practice, which carries duties around completion of the work, fees, disbursements and refunds. That is worth both parties understanding before the last day, and worth recording — because it means the file needs to show clearly who did what and when.
Two related points:
- Section 35 confidentiality binds the individual, and covers former clients. A departing agent's obligation not to disclose a client's affairs is not something your employment contract creates or removes.
- Section 25 requires an agent to take reasonable steps to ensure their MARN is not used in a way suggesting another person's work was theirs, and to notify the Authority in writing within 14 days of becoming aware of misuse. A departing agent whose credentials remain active is exposed to exactly that, and so are you.
The security half, done properly
The ASD's small business guidance covers the basics. Three points deserve emphasis in a practice context.
Privileged accounts first. The Essential Eight requires that requests for privileged access are validated when first requested and that privileged users have dedicated accounts. Removal is the other half of that. A departing person's administrative account is the highest-value credential in the building.
The mailbox is not just an account. Converting it to a shared mailbox so the team can see incoming mail is the usual approach and it needs care: it preserves years of client correspondence in a place with unclear ownership, and it is exactly the kind of arrangement that turns one compromised login into a large data breach.
Delegations and integrations. Calendar delegations, shared drive ownership, API keys created under their account, and anything where they were the notification recipient. As our guide to role-based access control sets out, an integration is a user, and one authenticated as a departed employee will keep working until someone notices.
Departure is a data breach risk, not just an access risk
Copying client files before leaving is one of the more common causes of small-business data incidents, and in a migration practice the copied material is passports, police certificates and medical results.
Two controls do most of the work: knowing what a person downloaded or exported in their last weeks, and being able to say so afterwards. Both require logging that exists before you need it. If your practice cannot answer "what did they take" from records rather than inference, that is worth fixing while nobody is leaving.
Sequenced offboarding
On notice
- Identify every service agreement naming them, and start the section 44 variations. This is the long pole.
- Identify matters where they are a responsible migration agent, and plan the handover.
- Freeze new privileged access and review what they hold.
- Note the date; a monitoring window on their account starts now.
Last week
- Complete handovers with the client informed in writing — section 39 requires clients to be kept informed of material developments, and a change of agent is one.
- Ensure file notes are written up. Records of oral communications must be contemporaneous, so a departing agent writing up three months of calls on their last afternoon is producing something that is not a contemporaneous record.
- Confirm nothing client-related exists only on their device.
Last day
- Disable, do not delete. Deleting an account can destroy the audit history you may need.
- Revoke sessions and tokens, not just the password. An active session survives a password change.
- Recover devices and remove access to any personal device holding client data.
- Reassign delegations, integrations and shared ownership.
- Redirect the mailbox rather than leaving it open, and route client mail to the matter.
After
- Review access logs for the final period.
- Notify the Department and any review authority of the change of agent where matters are pending.
- Record the offboarding as a dated event. Under section 32 you must respond to Authority requests completely, and this is a document you would rather hold.
The offboarding test
- Could you list, in an hour, every service agreement naming a given agent?
- Do you know which matters they are a responsible migration agent for?
- Would their integrations stop working on their last day, or keep running?
- Can you say what they exported or downloaded in their final month?
- Are their file notes written contemporaneously, or in a final-week batch?
- Is any client-related information only on their device?
Where a system helps
Offboarding is hard in proportion to how scattered the practice is. Each additional system is another account to find, another permission model to check, and another place where a leaver's access quietly persists.
It also determines whether the Code questions are answerable at all. "Which agreements name this agent" and "which matters did they give assistance on" are trivial queries in a system that models agents, agreements and matters — and near-unanswerable across a shared drive and an email archive.
LodgeHQ keeps agents, agreements, matters and access in one place, so a departure is a report rather than an investigation. Our comparison of CRM options for migration agents covers the wider choice, and you can start a free trial to see the audit trail.
Verify before you rely on it
Whether the Privacy Act's breach obligations apply to your practice depends on your structure and turnover, and the Essential Eight maturity model is revised periodically. Read the current sources, including the Privacy Act and the OAIC's data breach guidance.
This is general information for migration practices, not legal or employment advice. Where a departure is contested, or where you suspect information has been taken, get advice before acting.