Start with ownership, not a password list
A company can own a domain yet depend on a former contractor to reach its registrar. Before a handover, list the business systems that matter: domain, website, work email, bookkeeping, documents and payment providers. For each one, record the account owner, billing contact, recovery route and the person responsible for the next renewal. Keep this inventory separate from secret values.
Invite a named user
Where a service supports team access, invite the incoming person to their own account and give only the role needed for their work. Administrator access is not a substitute for choosing a role. Ask the receiving person to confirm they can complete a harmless task, such as viewing a test document. A successful invitation email alone does not prove that access works.
Handle recovery as a separate task
Review recovery email, phone and multi-factor authentication without posting codes or recovery keys into the handover document. Use an approved password manager for secrets. If the service has only one login, agree who will own it and use its supported credential-change process. Do not remove the outgoing recovery method until a replacement has been tested.
Close the loop with evidence
Record the date, receiving owner and what was actually checked. Then remove access that is no longer needed, subject to record-retention and legal requirements. Keep the business files rather than deleting a departed person’s work blindly. This is an operational checklist, not legal advice or a promise that every platform supports the same transfer process.