An internal transfer looks simple because the employee already exists in every system. That is exactly why it goes wrong. Pay and title change in the HR system, but nobody removes the old team’s file shares, the finance approval limit or the admin account from three roles ago. Meanwhile the new manager waits a fortnight for access to the tools the job needs. This free internal transfer checklist treats a move as what it is: a small leaver process and a small joiner process on the same day. It covers the approval, the new terms, the access changes, the handover, any relocation and the first 90 days in the new role, for UK and US employers.
Access is added, rarely taken away. When someone joins, IT builds their access from a request. When they leave, an offboarding process removes it. When they move, the new access is requested because the employee chases it, and the old access stays because nobody chases that. After a few moves, a long-serving employee can hold the combined rights of every role they have had. Security teams call this privilege creep. It is how a sales manager ends up able to approve the supplier payments they used to process.
The fix is to change access on a date, not on request. Set an effective date when the move is approved. New-role access is ready for that morning, and old-role access ends that day, apart from any short handover access agreed with an end date. NIST’s security controls for account management and personnel transfer make the same point: when someone is reassigned, review their access and change it to match the new duties.
The terms change too, and the paperwork differs by country. A move can change pay, hours, location, overtime eligibility and the tax state. In the US it does not need a new Form I-9, but in either country it may affect a sponsored visa. Moves also happen for different reasons: a promotion, a lateral move, a secondment or redeployment into a vacancy instead of a redundancy, which the Redundancy & Layoff Process Checklist covers from the other side.
Agreement: changes to contract terms need the employee’s agreement, unless the contract already allows them.
Written statement: under section 4 of the Employment Rights Act 1996, written details of changed particulars, no later than one month after the change.
Relocation: qualifying relocation costs up to £8,000 can be paid free of tax and National Insurance.
Sponsored workers: a Skilled Worker moving to a different occupation code needs a new visa application, and other role changes are reported to the Home Office within 10 working days.
Overtime: re-check FLSA exempt status, since the new role must pass both the salary level and the duties test.
Tax: if the work state changes, so can state income tax withholding and unemployment registration.
Form I-9: no new form for a transfer within the same employer; reverify only if work authorisation is expiring.
Visas: an H-1B move outside the approved work area may need an amended petition before the move.
Six phases from the request to the 90-day review. The relocation phase appears only when the work location changes, and UK or US tasks follow the jurisdiction chosen on the first task.
The phase that prevents privilege creep. Due dates are set from the effective date, so access changes on the day of the move.
Shown only when the move changes the employee’s work location.
Phase 3 asks the old and new managers to sort every entitlement into remove, keep or add. The matrix below is a starting point by system type. The “review” column lists what is easy to miss: access that does not look like access, or that sits outside single sign-on.
| System type | Remove | Keep | Add | Review |
|---|---|---|---|---|
| Directory groups and SSO roles | Old team and old role groups | Company-wide groups | New team and new role groups | Nested groups that grant more than their name suggests |
| Email and shared mailboxes | Old team lists and shared mailboxes | Personal mailbox | New team lists and mailboxes | Delegate, send-as and calendar rights |
| File shares and document sites | Old team sites, after the handover window | Personal files | New team sites | Files the employee owns that the old team still needs |
| Business applications | Old-role roles and licences | Basic user access, if both roles use it | New-role role and licence | Segregation-of-duties conflicts between old and new rights |
| Finance approvals | Old approval limits and bank signatory rights | Expense claims | New limits, only if the role needs them | Approval chains still routed to the employee |
| Privileged and admin accounts | All, unless the new role needs them | — | A separate admin account, if required | Standing admin rights that could be time-limited |
| Physical access | Old site or restricted areas | General building entry | New site or areas | Out-of-hours access |
| Tools outside SSO | Old-role SaaS accounts | Company-wide tools | New-role tools | Accounts created with a work email that IT does not manage |
Two rules make the matrix work. First, the old manager signs off the removals and the new manager signs off the additions, because each knows only one side of the job. Second, the before-and-after list is kept, so that the next user access review can check that what was agreed actually happened. If your organisation reviews access once a year, a move that went wrong can sit unnoticed for up to twelve months. The 30-day review in Phase 6 catches it sooner.
The “add” column works best when each role has a standard access profile: the groups, applications and permission levels that anyone in that role needs. Without one, IT is often asked to give the mover “the same access as Sam”, which copies everything Sam has collected over the years, including rights that belong to Sam’s previous jobs. Building profiles for your most common roles takes an afternoon per team, and it makes joiners faster as well as movers. Where a role has no profile yet, ask the new manager to list what the job needs, and have each system owner approve it.
Handover access is the most common exception. If the employee needs read access to the old team’s site for two weeks to finish handing over, grant it as a named exception with an end date, and make removing it a task with its own due date. An exception without an end date is how privilege creep starts.
The effective date entered on the first task sets the due dates for the new terms, the access changes, the handover and the 30 and 90-day reviews. Access is removed on the day of the move because that task is due on the day of the move.
HR owns the terms, IT owns the access and the managers own the handover. Each task is assigned to the right person, the move is an approval that halts the checklist until the receiving manager signs off, and relocation tasks appear only when the location changes.
The remove, keep and add list is recorded on the checklist, with an audit trail of who removed what and when. When auditors or the next access review ask how a mover’s rights were changed, the answer is already written down.
Moves sit between onboarding and offboarding in the employee lifecycle. CheckFlow’s HR checklist software runs joiners, movers and leavers from templates, with assignments, approvals and due dates shared between HR, IT and line managers.
The new-role half of a move is a small onboarding. CheckFlow’s IT onboarding checklist software shows how IT teams provision accounts and devices from a role profile, and the User Access Review Checklist confirms the result at the next periodic review.
Joiner-mover-leaver, or JML, describes the three points in employment where access and records must change. A joiner starts, a leaver goes, and a mover changes role, team, manager or location while staying employed. Movers are the hardest of the three to control, because nothing forces old access to be removed. A mover process changes access on the effective date and records what was removed, kept and added.
No. USCIS treats an employee who transfers to another location of the same employer, or who is promoted, demoted or given a raise, as continuing in employment, so no new Form I-9 is needed. Where the transfer is between distinct units of the same employer, the existing form can be transferred to the receiving unit. Reverification is still needed if the employee’s work authorisation is expiring. See I-9 Central on continuing employment.
Yes. Section 4 of the Employment Rights Act 1996 requires a written statement of any change to the particulars in the employee’s written statement, at the earliest opportunity and no later than one month after the change. If the change means working outside the UK for more than a month, it is due before they leave. The change itself should be agreed first; Acas guidance on changing a contract explains how.
On the effective date of the move. If the employee needs some old access to finish a handover, grant it as a named exception with an end date and a task to remove it. Waiting until the next periodic access review leaves the employee with two roles’ worth of rights for months, which is how segregation-of-duties conflicts appear.
Yes, in either direction. Exempt status under the Fair Labor Standards Act depends on both the salary and the duties of the job. The Department of Labor currently applies a minimum salary of $684 a week for the executive, administrative and professional exemptions, after a court vacated the 2024 rule. A move into a role with different duties, or onto lower pay, can make an exempt employee non-exempt. Some states set a higher bar. California, for example, requires a salary of at least twice the state minimum wage for full-time work, which is $70,304 a year in 2026.
State income tax withholding generally follows where the work is done, so payroll may need a new state registration, a new state withholding form from the employee and a new unemployment insurance account. Local taxes, paid leave laws and final-pay rules can change too. Moving expense reimbursements are taxable wages for most employees, and the exclusion that once applied has now been removed permanently for everyone except the armed forces and the intelligence community. Ask your payroll provider or a tax adviser before the effective date.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
