Process library - internal review

Processes

Horizontal process assessment models (English source). Each one serves two uses: score how mature a company's process is (analysis), and hand it over as a Correction Pack (solution). Client-facing Portuguese versions are the deliverable templates, not this page.

Defined: Onboarding (from hire to productive) - Movers (role change) - Offboarding (employee departure). Planned: Recruitment and selection, Access management (request, review, revocation), Asset management (assignment, inventory, return), Training plan.

JML - employee lifecycle (Joiners)

Onboarding (from hire to productive)

Take a new employee from the decision to hire to being productive, with access, assets, training and follow-up, meeting legal obligations and without depending on one person's knowledge.

Trigger

An area manager recognises the need to reinforce the team - due to sustained workload, someone leaving, a new project or a growth plan. They formalise the request (not a verbal 'I need someone'), justify it and inform management/HR; opening a vacancy is an approved decision, not automatic.

Roles

Manager / area supervisor (The new employee's direct manager)
Ultimately responsible for integration and performance: sets expectations and objectives, handles the welcome and first tasks, follows up closely and EVALUATES during the probation period. They confirm or terminate.
Boundary: Is not the buddy - evaluation and day-to-day informal support must be kept separate.
Buddy (mentor) (An EXPERIENCED colleague from the team (a peer, not the manager))
Assigned for the first few weeks: answers day-to-day questions, shows how things work in practice, helps with social and cultural integration, reduces the fear of asking.
Boundary: Does NOT evaluate or report on performance. They are a safe harbour - keeping the buddy separate from the evaluator is what makes the system work; if the buddy evaluated, the new employee would stop asking questions.
HR (Human Resources (or whoever fills that role))
Process owner: contract, legal obligations, notification to Social Security, coordination of the checklist and artifacts.
Boundary: Does not replace the daily follow-up from the manager and the buddy.
IT / Administrative (Whoever manages systems and assets)
Grants access (minimum necessary profile) and assigns + registers assets.
Boundary: Does not decide the access profile - executes the minimum necessary that the manager approves.

Phases

#	Phase	Owner	Timing	What
1	Identifying the need	Area manager	before opening the vacancy	Recognise and JUSTIFY the need (workload indicators, backlog, departure). Formal headcount request, not verbal.
2	Vacancy approval	Management	before recruiting	Decide whether to open the vacancy: budget, headcount, contract type. Explicit approval.
3	Recruitment and selection	HR + Area manager	variable	Define the profile, advertise, screen, interview, decide. See the 'recruitment' process.
4	Offer and hiring	HR	before the start date	Offer, contract, contract type and probation period defined. Legal admission obligations (see legal notes).
5	Pre-onboarding (preparing the setup)	HR + IT + Manager	day -5 to day 0	Prepare the workstation; REQUEST access in advance; ASSIGN and register assets; prepare the integration plan and buddy.
6	Initial integration	Manager + buddy	first ~15 days	Day-1 welcome, introductions, initial training and work instructions, first real tasks with close follow-up.
7	Probation follow-up	Area manager	during the probation period	Continuous evaluation against role requirements; structured feedback; an informed decision to confirm or terminate WITHIN the probation period.
8	Confirmation and close	HR + Manager	end of the probation period	Confirm the integration, define the ongoing training plan, record it. Review assigned access/assets.

RACI

Task	R	A	C	I
Identify and justify the need	Area manager	Management	-	HR
Approve the vacancy (budget/headcount)	Management	Management	HR	-
Recruit and select	HR	Area manager	Management	-
Hire and meet admission obligations	HR	Management	-	Accounting
Request and grant access	IT	Area manager	-	Security/GDPR
Assign and register assets	IT/Administrative	Area manager	-	Accounting
Initial training and follow-up	Manager + buddy	Area manager	-	HR
Evaluate and decide during probation	Area manager	Management	HR	-

Artifacts (deliverable templates)

Headcount request form
Justification of the need, role, contract type, budget and approval.
Employment contract document
Contract with type, probation period and clauses; basis for admission obligations.
Onboarding checklist checklist
Everything that must be ready (workstation, access, assets, introductions, training) by owner and deadline.
Access request form form
Access by system/application, with minimum necessary profile, approver and date. Basis for later revocation.
Asset assignment register register
Assets handed over (laptop, phone, keys, cards), serial number, date and receipt signature.
Training plan plan
Initial and ongoing training by role, with owner and milestones.
Probation period evaluation register
Structured evaluation against requirements, with feedback and a confirm/terminate decision dated within the period.

Work instructions

Access request (day -5)

List the systems/applications the role uses (principle of least privilege).
For each one, define the minimum access profile, not the most permissive.
Submit the access form with manager approval BEFORE day 1.
Record who approved it and when - it's the same record used to REVOKE access at offboarding.

Asset assignment (day -1/day 0)

Prepare the asset(s) and register the serial number in the asset register.
Hand over against a receipt signature (who, what, when).
Keep the register up to date - it's the only way to recover assets on departure.

Day-1 welcome

Confirm the workstation, access and assets are ready (checklist).
Introductions to the team and the buddy; explain who to go to for what.
Give the first work instructions and a small first real task.
Schedule follow-up points for the first weeks.

Buddy system

Choose an experienced colleague from the same or a nearby team - a peer, NOT the direct manager.
Assign before day 1 and introduce them to the new employee right at the welcome.
Make it clear to the buddy that the role is to support and show how things work - not to evaluate.
Give the buddy real time for the role (it is not unpaid favour); schedule informal check-ins for the first weeks.
The buddy does NOT report on performance to the manager - the new employee has to feel they can ask anything.

Legal notes (confirm against current law)

Probation period
During the probation period either party may terminate the contract without just cause or compensation (with notice according to time already elapsed). The DURATION depends on the contract type and role - generally longer for open-ended contracts and roles of trust/complexity, shorter for short fixed-term contracts. Always confirm the specific duration before acting; do not assume a fixed number.
Verify: Duration applicable to the contract type and role under the current Labour Code.
Admission notification
The admission must be notified to Social Security before the employee starts work. Failing to do so is an administrative offence.
Verify: Current deadline and channel for notifying Social Security before the employee starts.
Occupational health and safety
An admission occupational health exam and work-accident insurance are mandatory; build them into onboarding.
Verify: Mandatory occupational health exams (admission) and work-accident insurance.
Employee data (GDPR)
Collect only the necessary data and grant the minimum access; document it. Links to access management.
Verify: Legal basis and minimisation of the data collected and the access granted.

Maturity ladder

none - Each manager onboards their own way, with no record; access and assets requested haphazardly on day 1; nobody knows what the new employee has.
ad-hoc - There's an email or an informal list that someone follows from memory; it works as long as that person is present (key-person dependency).
documented - Written process with RACI, checklist, access request form and asset register; roles defined (manager evaluates, buddy supports) and buddy assigned; any manager can onboard someone without depending on one person.
measured - Tracked indicators: time to productive, probation confirmation rate, access/assets 100% tracked and revoked on departure.

Common risks

Key-person dependency - Only one person knows how to onboard; when they're out, hiring stalls or goes wrong.
Access requested late - New employee stuck in the first days, waiting for access - cost and a bad first impression.
Access left unrevoked - Access that stays active beyond what's needed or after departure - a direct security risk (links to offboarding/access management).
Unregistered assets - Laptops/phones/keys go untracked - loss of material and inability to recover them on departure.
No buddy / peer support - New employee isolated, overloads the manager with questions or doesn't ask at all; slower integration and more dropouts during probation.
Poor integration - Departure during probation - sunk recruitment and onboarding cost, and starting over.
Legal non-compliance - Failure to notify Social Security, occupational health or insurance - administrative offences and exposure.

Related: recruitment, offboarding, access-management, asset-management, training-plan

JML - employee lifecycle (Movers)

Movers (role change)

Manage a role change/transfer/promotion end to end: give the new role what it needs, REMOVE what the old one no longer justifies, and settle compensation, taxes, contract and reporting - without letting access accumulate or payroll changes slip.

Trigger

An approved role change: promotion, team/department transfer, change of responsibilities or location. Recognised by the origin and/or destination manager and by HR; it has an effective date - the process must run IN TIME for that date, not after.

Roles

Origin manager (The manager the employee is leaving)
Identifies what is no longer needed (access, assets, responsibilities) and hands over knowledge.
Boundary: Cannot assume 'the destination will handle it' - whatever was in their scope must be explicitly removed.
Destination manager (The new manager)
Defines what the new role needs (access, assets, training, expectations) and follows up on integration into the new role.
Boundary: Does not grant access on their own - approves the minimum necessary, IT executes.
HR (Human Resources)
Formalises the change: contract addendum, compensation change, notification to Social Security, updating the org chart and the RACI.
Boundary: Does not decide technical access - coordinates it.
IT / Security (Whoever manages identities and access)
Grants access for the new role and REVOKES access for the old one (recertification). Keeps the access register consistent with the current role.
Boundary: Does not keep old access 'just in case' - the principle is the minimum necessary for the CURRENT role.
Accounting / Payroll (Whoever processes payroll)
Applies the new compensation with the correct effect on income tax withholding and Social Security from the effective date.
Boundary: Does not act without the change being formalised by HR.

Phases

#	Phase	Owner	Timing	What
1	Formalise the change	HR + Managers	before the effective date	New role, effective date, approval, and what changes (reporting, location, responsibilities). Nothing verbal.
2	ACCESS recertification	IT + Destination manager	on the effective date	Grant access for the NEW role AND REVOKE access for the old one. Review everything the person has accumulated; leave only the minimum necessary for the current role. This is the most-often-missed step (access creep).
3	ASSET adjustment	IT/Administrative	on the effective date	Assign new assets needed; collect/reassign those the new role no longer justifies. Update the register.
4	COMPENSATION change and tax effects	HR + Accounting	effective on the effective date	New salary/allowances/benefits; effect on income tax withholding and Social Security; ensure payroll applies it from the correct date.
5	Contract and structure	HR	around the time of the change	Contract addendum (role, pay, location); update the org chart and who reports to whom and who approves what (the RACI changes).
6	Integration into the new role	Destination manager + buddy	first few weeks	'Light' onboarding: training for the new role, introductions, expectations. A buddy from the new team helps, just like with Joiners.
7	Follow-up	Destination manager	first few months	Confirm the person is settling into the new role; adjust as needed. Close the handover with the origin manager.

RACI

Task	R	A	C	I
Formalise the change (role, date, reporting)	HR	Management	Origin/destination managers	-
Grant new access and REVOKE old access	IT	Destination manager	-	Security/GDPR
Reassign assets	IT/Administrative	Destination manager	-	Accounting
Apply new compensation and tax effects	Accounting	HR	-	Employee
Contract addendum and org chart	HR	Management	-	Managers
Integrate and follow up in the new role	Destination manager	Destination manager	Origin manager	-

Artifacts (deliverable templates)

Role change record register
Old role -> new role, effective date, reporting, location and approval.
Access recertification register
List of access the person had, a decision for each one (keep/grant/REVOKE) against the current role, with approver and date. It's the defence against access creep.
Access request/change form form
Access to grant and revoke by system, with minimum profile and approver.
Asset register register
Assets assigned/collected with the change, kept up to date.
Contract addendum document
Formal change of role, pay and location; basis for payroll and tax effects.
Training plan (new role) plan
Training needed for the new role.

Work instructions

Access recertification (the critical step)

List ALL of the person's current access (not just what's being added).
For each access, decide against the NEW role: keep, grant or REVOKE - default to revoke.
Grant the new access and revoke the old on the effective date; record who approved it.
Only access the current role justifies survives - nothing stays 'just in case' or 'out of habit'.

Compensation change with tax effect

HR formalises the new pay and the effective date (addendum).
Accounting applies it in payroll from that date, with the correct effect on income tax withholding and Social Security.
Confirm the first payroll run after the change (salary/tax errors erode trust).

Legal notes (confirm against current law)

Contract change
A change of role/pay/location usually requires written agreement (addendum). Formalise it; don't manage it by email.
Verify: Whether and how a contract addendum is required for the specific change (role, pay, location).
New probation period?
In a promotion/internal move, as a rule a new probation period does NOT start (the employment relationship continues) - but it depends on the case. Don't assume; confirm before acting.
Verify: Whether a probation period applies (or not) to an INTERNAL change, per the current Labour Code and the specific case.
Tax and Social Security effects
A salary change affects withholding and contributions; apply it from the correct effective date.
Verify: Impact of the new pay on income tax withholding and contributions; effective date.
Data and access (GDPR)
Keeping access beyond the current role is excess processing; recertification is also a GDPR measure.
Verify: That the recertification applies the minimum necessary for the new role.

Maturity ladder

none - Someone changes role and nobody touches access or the contract; pay gets sorted out 'whenever'; access piles up (access creep).
ad-hoc - Someone remembers to request the new access, but the old is rarely revoked; compensation is handled case by case.
documented - Written process with access recertification (grant AND revoke), contract addendum, payroll change with tax effect, and org chart/RACI update.
measured - Access recertified 100% at every change (zero creep), payroll changes applied on the correct date, update time measured.

Common risks

Access creep (old access left unrevoked) - The person accumulates permissions with every change - the biggest security and compliance risk, and the classic audit finding.
Salary/tax errors - New compensation applied late or with incorrect withholding - conflict with the employee and tax exposure.
Outdated contract - The actual role/pay doesn't match the contract - employment-law risk.
Reporting confusion - Org chart and approvals out of date - decisions with no owner, the RACI problem that Movers makes worse.
Incomplete handover - Knowledge and tasks from the old role are left without an owner when the person moves.

Related: onboarding, offboarding, access-management, asset-management

JML - employee lifecycle (Leavers)

Offboarding (employee departure)

Manage the departure completely and securely: revoke ALL access, recover assets, settle the final accounts with the correct tax effect, meet the legal obligations and transfer knowledge before the person leaves.

Trigger

A termination with a known date: resignation (notified), termination on the company's initiative, end of a fixed-term contract, retirement or mutual agreement. The notice period gives the window to run the process ON TIME - access revocation and asset collection happen ON the departure date, neither before (the person is still working) nor after (a window of risk).

Roles

Area manager (The direct manager)
Ensures the handover (tasks, contacts, files, tacit knowledge), decides who takes over what, and communicates the departure to the team/clients at the right time.
Boundary: Does not let knowledge walk out the door - the handover is their responsibility, not a favour from the departing person.
HR (Human Resources)
Process owner: formalises the termination, notice period, final accounts, legal documents (work certificate, declarations), notification to Social Security, exit interview.
Boundary: Does not assume 'IT handles access' - coordinates the closing of everything.
IT / Security (Whoever manages identities and access)
REVOKES all access (logical and physical) on the departure date, including shared and forgotten access; deactivates the account; reassigns what belonged to the person.
Boundary: Does not leave accounts active 'for a few days' - an account active after departure is an open door.
Accounting / Payroll (Whoever processes payroll)
Final settlement: last salary, unused holidays and prorated amounts, any compensation, with the correct effect on income tax and Social Security.
Boundary: Does not process without the termination being formalised by HR.

Phases

#	Phase	Owner	Timing	What
1	Formalise the departure	HR	on receiving/deciding the termination	Type of termination, effective date, reason, notice period. Record it; nothing verbal.
2	Communication and planning	Manager + HR	after formalising	Who to inform and when (team, clients, suppliers); prepare the departure checklist and the handover.
3	Handover / knowledge transfer	Manager + departing employee	before the departure date	Pass on ongoing tasks, contacts, files, shared access and tacit knowledge to whoever takes over. This is where you avoid losing what only they knew.
4	Access REVOCATION	IT/Security	on the departure date (last day)	Revoke ALL access - systems, email, VPN, applications, shared access, physical cards/keys. Deactivate the account. This is the critical security step.
5	Asset collection	IT/Administrative	on the departure date	Collect laptop, phone, keys, cards, badge - against the asset register. Wipe/clean data from the devices.
6	Final settlement + tax effects	HR + Accounting	as required by law	Last salary, unused holidays and prorated amounts, any compensation; effect on income tax and notification of the termination to Social Security.
7	Termination documents	HR	at departure	Work certificate and the declarations the person is entitled to (e.g. for unemployment purposes).
8	Exit interview	HR	close to departure	Understand why they left and what to improve. Optional, but valuable and cheap data.
9	Close	HR + IT	after departure	Confirm access revoked 100%, assets collected, accounts closed and documents delivered. Mark the case as closed.

RACI

Task	R	A	C	I
Formalise the termination and notice period	HR	Management	Manager	-
Handover / knowledge transfer	Manager	Manager	Departing employee	-
Revoke ALL access	IT	Manager	-	Security/GDPR
Collect assets	IT/Administrative	Manager	-	Accounting
Final settlement and tax effects	Accounting	HR	-	Employee
Legal termination documents	HR	HR	-	Employee

Artifacts (deliverable templates)

Departure record register
Type of termination, effective date, reason and notice period.
Offboarding checklist checklist
Everything that must be closed (access, assets, accounts, documents, handover) by owner and date.
Handover record register
Ongoing tasks, contacts, files and knowledge passed on, and who takes over each one.
Access revocation record register
Every access the person had, marked as revoked, with date and owner. Cross-checked against the grant record (onboarding/movers) - it's the proof nothing was left open.
Access form form
The same base used to grant access, now used to revoke it - which is why the grant record has to exist.
Asset register (return) register
Assets collected against the assignment record, with date and condition; devices wiped.
Final settlement document
Last salary, holidays and prorated amounts, compensation; basis for the tax effect and the notification to Social Security.
Work certificate + declarations document
Termination documents the person is entitled to.
Exit interview guide form
Structured questions about the reason for leaving and what to improve.

Work instructions

Access revocation (last day)

Start from the grant record (onboarding/movers): everything granted must be revoked.
Revoke systems, email, VPN, applications, shared access and physical cards/keys.
Deactivate (not just 'hide') the account; remove from groups and lists.
Record each revocation with date and owner - it's the audit proof that nothing was left open.

Asset collection and wipe

Collect each asset against the assignment record; note condition and date.
Wipe/clean company data from the devices before reassigning them.
Close the asset register for that person (nothing left outstanding).

Final settlement and legal obligations

HR calculates unused holidays, prorated amounts and any compensation according to the type of termination.
Accounting processes it with the correct tax effect (income tax) and notifies Social Security of the termination.
Deliver the work certificate and the due declarations.

Legal notes (confirm against current law)

Notice period and form of termination
Each type of termination has its own rules on notice period, form and grounds. A dismissal that doesn't follow the required form/grounds is unlawful. Always confirm the correct classification; don't improvise.
Verify: Notice period and formalities for the TYPE of termination (resignation, dismissal, end of fixed term, mutual agreement) under the Labour Code.
Final settlement
The employee is entitled to unused holidays and prorated amounts; depending on the type of termination there may be compensation. Calculate it correctly.
Verify: Calculation of unused holidays, prorated holiday/bonus amounts and any compensation.
Work certificate and declarations
The work certificate is mandatory; there are declarations the person is entitled to (e.g. for unemployment status). Do not withhold documents.
Verify: Mandatory documents to deliver at termination.
Notification to Social Security + GDPR
Notify the termination to Social Security within the deadlines; keep only what's necessary for the legal retention period and delete the rest (GDPR).
Verify: Deadline for notifying the termination and the retention/deletion period for the former employee's data.

Maturity ladder

none - The person leaves and access stays active for weeks/months; assets get lost; knowledge walks out; accounts settled haphazardly.
ad-hoc - HR remembers the final accounts, but access is left unrevoked and assets uncollected; no structured handover.
documented - Offboarding checklist with access revocation on the last day, asset collection, final settlement + legal documents and a recorded handover.
measured - Access revoked 100% on the day (cross-checked against the grant record), assets recovered, closing time measured, exit interviews analysed.

Common risks

Access active after departure - A former employee or orphaned account with access to systems and data - the biggest security risk and the #1 finding of any access audit.
Assets not recovered - Laptops/phones/keys lost - cost and, worse, company data out of control.
Knowledge lost - The person takes what only they knew; without a handover, tasks and clients are left without an owner (key-person dependency revealed too late).
Legal non-compliance - Failure in the form of termination, incorrectly calculated accounts, withheld documents or missing notification to Social Security - litigation and administrative offences.
Poor departure - A badly managed departure costs reputation (the former employee talks) and can lead to litigation; a missed exit interview is information you don't get back.

Related: onboarding, movers, access-management, asset-management