Luxury Properties Hub · Human Resources & Shared Services

HR Operations
Standard Procedures

Onboarding, Access Provisioning, Offboarding & Service Levels

Recruitment & HR → Admin → IT (Outsourced) → Line Manager → Marketing → Accounts → PRO

01Purpose, scope and definitions

02Governance — department responsibilities and RACI

03SOP-HR-05 New Joiner Readiness — workflow

04SOP-HR-05 Onboarding SLA schedule and readiness timeline

05Role Access Matrix — Bitrix24 and supporting systems

06SOP-HR-06 Employee Exit & Offboarding — workflow

07SOP-HR-06 Offboarding SLA schedule and immediate-exit protocol

08Master service level and escalation matrix

09Registers, forms, KPIs and audit controls

10Appendix A — current data health assessment

11Appendix B — external IT service scope (issued separately)

DocumentSOP-HR-05 / SOP-HR-06

Revision2.0

OwnerHR Director

Review cycleAnnual

Applies toAll departments, all locations

Core systemsBitrix24 (CRM + HR), Microsoft 365

IT deliveryOutsourced service provider

ClassificationInternal

Uncontrolled when printed. The controlled copy is held in the HR folder of the company document system.

SECTION 01

Purpose, Scope and Definitions

Why this document exists and how to read it

Purpose

This pack defines how Luxury Properties Hub brings a new employee to full working capability before their first day, and how it withdraws that capability cleanly when they leave. It replaces informal, verbal handovers between departments with a single timed sequence in which every task has one named owner and one measurable deadline.

Two failures are being engineered out. First, the joiner who arrives with no laptop, no email and no CRM login — which costs the company a productive week and damages the employment brand at the exact moment it matters most. Second, the leaver whose access, data and client relationships remain live after the last working day — which is a commercial, regulatory and data-protection exposure.

Scope

All permanent, probationary, part-time and commission-only staff.
All departments: Recruitment & HR, Admin, Sales (Off-plan and Secondary), Marketing, Accounts, Conveyancing, PRO and Government Relations.
All company-provisioned systems, devices, SIM cards, portals and access cards.
The outsourced IT service provider, whose obligations are set out in Appendix B.

Contractors, freelancers and agency staff follow the same access sequence but on a restricted matrix approved by the Department Head in writing before any account is created.

Definitions

Day 0The date the signed offer letter is received by Recruitment. Day −1, −2, −3Working days counted backwards from the agreed start date. Start dateThe joiner's first physical working day. LWDLast Working Day — the leaver's final day of active service. Working hoursMonday to Saturday, 09:00–18:00 Gulf Standard Time. Working dayOne full working day within the above hours. External ITThe outsourced IT service provider under Appendix B. ProvisioningCreation of an account, permission set, device or asset. RevocationDisabling of all access with evidence recorded. ReadinessState in which every item on the Day −1 checklist is verified complete.

How to read the workflow pages

Card anatomy

Dark bar — the stage and the day it must be completed by.
Tan bar — the category of work in that stage.
Owner — the single accountable department. Not shared.
Grey chip — the service level for that task.
Red chip — a hard deadline with an escalation attached.
Gold left edge — task delivered by External IT under Appendix B.

Rule of the pack

No task may be marked complete on a verbal confirmation. Completion means a dated entry against the employee record in Bitrix24 or a signed line on the relevant register. Any owner who cannot meet a service level must escalate before the deadline passes, not after — to the HR Director within 48 hours, and immediately where the start date is at risk.

SECTION 02

Governance and Department Responsibilities

One accountable owner per task — no shared ownership

Recruitment & HR

Owns the process end to end. Triggers every other department, holds the employee record, chairs induction and exit, and is the only department permitted to declare a joiner "ready" or a leaver "cleared".

Admin & Facilities

Owns physical assets: the Asset Register, devices, SIM cards, access cards, desks and the procurement route. Also owns recovery of all of the above at exit.

IT — Outsourced

Owns identity and access: Microsoft 365, Bitrix24 accounts and permission sets, drive permissions, distribution groups, device build, and timed revocation with documented evidence. Governed by Appendix B.

Line Manager

Owns the human outcome: first-week plan, objectives, buddy assignment, department training, and at exit the handover plan and reassignment of live pipeline.

Marketing

Owns market-facing identity: headshots, personal branding for sales roles, email signature, portal profiles — and their removal or reassignment at exit.

Accounts & PRO

Accounts owns payroll, WPS registration, commission position and final settlement. PRO owns visa, labour contract, Emirates ID and broker card lifecycle.

Process step	HR Dir.	Recruit.	Admin	Ext. IT	Line Mgr	Marketing	Accounts	PRO
Confirm signed offer and start date	A	R	—	—	I	—	—	I
Issue New Joiner Notification	A	R	I	I	I	I	I	I
Collect employee data form	A	R	—	—	—	—	C	C
Device, SIM and workstation supply	I	C	R	C	I	—	C	—
Email, drive and group provisioning	A	I	C	R	I	—	—	—
Bitrix24 CRM user and permission set	A	I	C	R	C	—	—	—
Bitrix24 HR record and structure	A	R	I	C	—	—	C	R
Device build, test and handover	I	I	C	R	—	—	—	—
First-week plan, objectives and buddy	A	C	—	—	R	—	—	—
Day-one induction and document signing	A	R	C	C	C	—	—	C
Headshots, branding and email signature	I	C	—	C	I	R	—	—
Payroll, WPS and bank registration	A	C	—	—	—	—	R	C
Visa, labour contract and broker card	A	C	C	—	—	—	C	R
Resignation or termination acceptance	A	R	—	—	C	—	I	I
Leaver Notification and clearance form	A	R	C	I	I	I	I	I
Pipeline and client reassignment	I	I	—	C	R	—	—	C
Access revocation and mailbox handling	A	C	C	R	I	—	—	—
Asset recovery and register update	I	C	R	C	I	—	—	—
Final settlement and gratuity	A	C	C	—	C	—	R	C
Visa cancellation and exit formalities	A	C	I	—	—	—	C	R

R Responsible — performs the work · A Accountable — answerable for the outcome · C Consulted — input required before completion · I Informed — notified on completion · — not involved

SECTION 03

New Joiner Readiness

SOP-HR-05 · Offer signature to day one

Recruitment → Admin → IT (Outsourced) → Line Manager → Marketing

Day 0Stage 1

Trigger

Receive the signed offer letter and confirm the agreed start date with the candidate in writing.

Recruitment4 working hrs

Issue the New Joiner Notification to IT, Admin, Line Manager, Marketing, Accounts and PRO — stating name, standard job title, department, start date, reporting line, access profile, and whether the hire is experienced or new to the industry.

RecruitmentSame day · min Day −3

Send the Employee Personal Information Form to the candidate and chase until returned complete.

RecruitmentSame day

Validate the returned form — passport, Emirates ID, visa status, IBAN and emergency contact — and file it to the Bitrix24 employee record.

RecruitmentDay −3

→

Day −2Stage 2

Equipment

Check the Asset Register for an available device matching the role specification.

Admin1 working day

If stock is available, allocate the device and mark it reserved against the joiner's name.

AdminSame day

If no stock is available, raise a purchase request under the Procurement SOP.

AdminSame day

Confirm desk, seating location and any additional equipment required for the role.

AdminDay −2

Release the device to External IT for build no later than the morning of Day −1.

AdminDay −1 · 09:00

→

Day −2Stage 3

Procurement

Place the equipment order where procurement was triggered, allowing a minimum of three working days for delivery.

Admin3 working days

Order the company SIM card and mobile handset where the role requires one.

AdminDay −2

Escalate to the Managing Director if delivery cannot be met before the start date, and agree a documented temporary device.

AdminImmediate

Update the Asset Register with the order reference, serial number and expected delivery date.

AdminOn receipt

Day −1Stage 4

Core accounts

Create the Microsoft 365 account using the standard naming convention and assign the licence.

External ITDay −1 · 12:00

Create the Bitrix24 user, assign the department, reporting line and role permission set.

External ITDay −1 · 12:00

Grant shared drive and document system access with role-appropriate folder permissions.

External ITDay −1 · 15:00

Enrol multi-factor authentication and issue first-login credentials to HR by secure channel — never to a personal email.

External ITDay −1 · 15:00

Create the HR record in Bitrix24 and enrol the employee in the company structure.

PRO / HRDay −1

→

Day −1Stage 5

Role systems

Add the joiner to the correct distribution lists, Bitrix24 workgroups and internal communication groups.

External ITDay −1 · 15:00

Provision role systems from the Access Matrix — property system, portals, telephony, design or accounting tools.

External ITDay −1 · 15:00

Prepare the induction pack, contract and forms for signature on day one.

RecruitmentDay −1

Prepare the first-week plan, objectives and training schedule.

Line ManagerDay −1

Where the role requires a broker card, initiate the DLD / Trakheesi application.

PRODay −1

→

Day −1Stage 6

Build and test

Install and configure email, Bitrix24 and role applications on the device; apply the security baseline.

External ITDay −1 · 17:00

Test every provisioned account by signing in once, then confirm readiness to HR in writing.

External ITDay −1 · 17:00

Assign a buddy from within the department for the first 30 days.

Line ManagerDay −1

HR performs the readiness check against the Day −1 checklist and signs it off.

RecruitmentDay −1 · 17:30

Continued overleaf — final preparation, joining date and verification.

SECTION 03 (CONT.)

New Joiner Readiness

SOP-HR-05 · Final preparation, day one and verification

Day −1Stage 7

Final check

Set up the physical workstation — desk, chair, monitor, peripherals and access card.

AdminDay −1 · 17:00

Place the device, welcome kit and stationery at the workstation.

AdminDay −1 · 17:00

Send the welcome email to the joiner — start time, location, dress code, parking, first-day agenda and named contact.

RecruitmentDay −1 · 15:00

Confirm the day-one schedule with the Line Manager and book the induction room.

RecruitmentDay −1

→

Joining dateStage 8

Day one

Welcome the joiner, complete contract signing and collect outstanding documents.

RecruitmentFirst 2 hrs

Hand over the device, SIM and access card against signature on the Asset Issue Form.

AdminFirst 2 hrs

Walk the joiner through first login, password reset and multi-factor authentication setup.

External ITFirst 2 hrs

Introduce the team, confirm the role and objectives, and start department training.

Line ManagerDay 1

Add the new joiner to the relevant WhatsApp and Bitrix24 chat groups.

AdminDay 1

Take headshots and run the personal branding session (sales roles only); issue the email signature.

Marketing5 working days

→

Joining dateStage 9

Verification

Record the completed asset issue and access profile against the employee file in Bitrix24.

Admin + HR2 working days

Reconcile what was actually provisioned against the Role Access Matrix and close any gap.

Recruitment2 working days

AccountsBefore first cycle

Confirm visa, labour contract and Emirates ID status and record the expiry dates.

PRO5 working days

Day-7 check-in with the joiner; log any onboarding failure as a process incident.

RecruitmentDay 7

Probation objectives confirmed in writing and logged in the HR record.

Line ManagerDay 14

Stop conditions — the joiner must not start

The Employee Personal Information Form has not been returned and validated.
Visa or right-to-work status is unconfirmed by the PRO.
No device is available and no documented temporary device has been approved by the Managing Director.
The Day −1 readiness check has not been signed off by HR.

Any stop condition is escalated to the HR Director immediately — not at the 48-hour mark.

Notification content standard

The New Joiner Notification is the single trigger for six departments. It is rejected back to Recruitment if it does not carry all of the following:

Full legal name as per passport, and preferred name.
Standard job title taken from the approved title list — not a free-text description.
Department, sub-team and reporting line.
Confirmed start date and working location.
Access profile letter from the Role Access Matrix.
Device requirement, SIM requirement and any exception approved by the Department Head.

SECTION 04

Onboarding Service Level Schedule

SOP-HR-05 · Every task, its deadline and its proof

Timing	Task	Owner	Service level	Evidence required	Escalates to
Day 0	Confirm signed offer and start date	Recruitment	4 working hours	Written confirmation on file	HR Director
Day 0	Issue New Joiner Notification	Recruitment	Same day; never later than Day −3	Notification logged in Bitrix24	HR Director
Day 0	Send employee data form to candidate	Recruitment	Same day	Form request sent	HR Director
Day −3	Return and validate employee data form	Recruitment	2 working days from issue	Validated form on employee record	HR Director
Day −2	Asset Register check and allocation	Admin	1 working day from notification	Register entry reserved	Admin Manager
Day −2	Raise purchase request where no stock	Admin	Same day as shortfall identified	PR reference recorded	Managing Director
Day −2	Order SIM and handset where required	Admin	Day −2	Order reference recorded	Admin Manager
Day −1	Release device to External IT for build	Admin	Day −1 by 09:00	Handover log signed	Admin Manager
Day −1	Microsoft 365 account and licence	External IT	Day −1 by 12:00	Account ID confirmed to HR	IT Account Manager
Day −1	Bitrix24 user and role permission set	External IT	Day −1 by 12:00	User ID and role confirmed	IT Account Manager
Day −1	Drive, groups and role systems	External IT	Day −1 by 15:00	Access list confirmed to HR	IT Account Manager
Day −1	Device build, security baseline and test	External IT	Day −1 by 17:00	Build sheet signed	IT Account Manager
Day −1	Bitrix24 HR record and structure	PRO / HR	Day −1	Employee record active	HR Director
Day −1	Induction pack and contract prepared	Recruitment	Day −1	Pack ready at workstation	HR Director
Day −1	First-week plan, objectives and buddy	Line Manager	Day −1	Plan shared with HR	Department Head
Day −1	Workstation, access card and welcome kit	Admin	Day −1 by 17:00	Workstation photo on file	Admin Manager
Day −1	Welcome email to joiner	Recruitment	Day −1 by 15:00	Email sent	HR Director
Day −1	HR readiness sign-off	Recruitment	Day −1 by 17:30	Signed Day −1 checklist	HR Director
Day 1	Contract signing and document collection	Recruitment	First 2 hours	Signed contract	HR Director
Day 1	Asset handover against signature	Admin	First 2 hours	Asset Issue Form	Admin Manager
Day 1	First login, password and MFA walkthrough	External IT	First 2 hours	Successful login logged	IT Account Manager
Day 1	Team introduction and objectives	Line Manager	Day 1	Objectives logged	Department Head
Day 1–5	Headshots, branding and email signature	Marketing	5 working days	Signature deployed	Marketing Manager
Day 1–2	Verification of asset and access profile	Admin + HR	2 working days	Reconciliation on file	HR Director
Day 7	Joiner check-in and incident logging	Recruitment	Day 7	Check-in note	HR Director

Readiness timeline

Offer confirmation & notification

Day 0

Employee data form collected

Day 0 → Day −3

Asset check & procurement

Day −2

SIM & handset order

Day −2

Accounts & permission sets

Day −1 · 12:00

Drive, groups & role systems

Day −1 · 15:00

Device build, baseline & test

Day −1 · 17:00

Workstation & welcome kit

Day −1

Induction pack & first-week plan

Day −1

HR readiness sign-off

Day-one induction & handover

Day 1

Branding, signature & verification

Day 1 → Day 7

Day 0Day −3Day −2Day −1Day 1Day 7

Bars are colour-coded by owner — HR / Recruitment, Admin, External IT, Line Manager, Marketing. The critical path runs through Admin releasing the device by Day −1 at 09:00; every External IT deadline on the same day depends on it.

SECTION 05

Role Access Matrix

Which systems each role is provisioned at onboarding — Bitrix24 is the system of record for CRM and HR

System / asset	Sales agent	Sales mgr	CRM officer	Marketing	Admin	Accounts	HR	Conveyancer
Company email — Microsoft 365	●	●	●	●	●	●	●	●
Bitrix24 — CRM (leads, deals, contacts)	●	●	●	●	●	○	–	●
Bitrix24 — Tasks & Projects	●	●	●	●	●	●	●	●
Bitrix24 — Drive & Documents	●	●	●	●	●	●	●	●
Bitrix24 — HR self-service & structure	●	●	●	●	●	●	●	●
Bitrix24 — HR administration & records	–	○	–	–	○	○	●	–
Bitrix24 — Telephony & call recordings	●	●	●	○	○	–	○	○
Bitrix24 — Reports & analytics	○	●	●	○	○	●	○	–
Property system — PropertyAster	●	●	●	○	●	–	–	●
Property portals — listing accounts	●	●	○	●	●	–	–	–
Shared drive / document system	●	●	●	●	●	●	●	●
Internal comms groups	●	●	●	●	●	●	●	●
Accounting system	–	–	–	–	○	●	○	–
WPS / payroll platform	–	–	–	–	○	●	●	–
goAML portal	–	–	–	–	–	●	–	–
Marketing / social tools	–	○	–	●	–	–	–	–
Design tools	○	○	–	●	○	–	–	–
DLD / Trakheesi	○	●	–	–	●	–	–	●
VPN / remote access	○	○	○	○	●	○	○	○
Company SIM / handset	●	●	○	○	○	○	○	○
Building access card	●	●	●	●	●	●	●	●

● issued as standard · ○ on request, requires Department Head approval · – not issued

Rules of the matrix

The matrix is the only authority for what gets provisioned. External IT provisions the profile named in the notification — nothing more, nothing less.
Anything marked ○ requires written Department Head approval attached to the request before the account is created.
Any access outside the matrix requires HR Director approval and is recorded as an exception with a review date.
Elevated Bitrix24 rights — administrator, export, cross-department visibility — are granted to named individuals only, reviewed quarterly.
Where a role changes, the matrix is re-applied in full: new access added and old access removed on the same request.

Bitrix24 permission principles

Sales agents see their own leads and deals only. Cross-agent visibility is a manager-level right.
Export of contact lists is disabled for agent-level roles; requests are logged and approved individually.
Every user sits in a department in the company structure with a reporting line — no orphan users.
Employee personal data — passport, Emirates ID, IBAN — is held in the Bitrix24 HR record with restricted visibility, not in shared spreadsheets.
Deactivated users are never deleted; the record is retained for audit and their deals are reassigned first.

SECTION 06

Employee Exit and Offboarding

SOP-HR-06 · Notice to final clearance

Recruitment & HR → Line Manager → Admin → IT (Outsourced) → Accounts → PRO

Notice dayStage 1

Trigger

Receive the resignation or issue the termination letter; acknowledge in writing and record the notice period and Last Working Day.

HR1 working day

Inform the HR Director and Line Manager; agree whether the exit is standard or immediate.

HRSame day

Issue the Leaver Notification to IT, Admin, Accounts, PRO, Line Manager and Marketing — stating name, LWD, exit type and reassignment manager.

HR1 working day

Open the Exit Clearance Form and circulate it to every clearing department.

HR1 working day

→

LWD −5Stage 2

Handover

Prepare the written handover plan — responsibilities, live files, deadlines and receiving owner.

Line ManagerLWD −5

Extract the leaver's live pipeline from Bitrix24 — leads, deals, contacts, open tasks and activities.

Line ManagerLWD −5

Agree the reassignment map: every deal and client is assigned to a named replacement before revocation.

Line ManagerLWD −3

Agree the client communication plan — who tells the client, when, and in what words.

Line ManagerLWD −3

→

LWD −3Stage 3

Commercial

Confirm the commission position — closed, pending, and deals in progress — against the commission policy.

AccountsLWD −3

Confirm outstanding loans, advances, salary in lieu and leave balance for the settlement calculation.

AccountsLWD −3

Prepare the visa cancellation file and check the broker card and DLD registrations to be withdrawn.

PROLWD −3

Prepare the asset recovery list from the Asset Register — device, SIM, access card, keys and peripherals.

AdminLWD −3

Identify portal listings, marketing profiles and campaigns carrying the leaver's name.

MarketingLWD −3

LWD −1Stage 4

Preparation

Prepare the revocation checklist against the leaver's actual access profile and confirm it back to HR.

External ITLWD −1

Agree mailbox treatment in writing — convert to shared, delegate to a named manager, and set the forwarding period.

HR + Ext. ITLWD −1

Confirm data ownership transfer targets for drive, documents and Bitrix24 files.

External ITLWD −1

Schedule the exit interview and the asset return slot.

HRLWD −1

→

LWDStage 5

Last working day

Conduct the exit interview and record the reason for leaving and any risk raised.

HRDuring LWD

Recover the device, SIM, access card, keys and all company property against signature on the Clearance Form.

AdminDuring LWD

Execute the pipeline reassignment in Bitrix24 and confirm zero records remain owned by the leaver.

Line ManagerBefore final logout

Collect signatures on the Exit Clearance Form from every clearing department.

HRDuring LWD

Issue the instruction to revoke to External IT at the end of the final shift.

HREnd of LWD

→

LWD +0Stage 6

Revocation

Disable Microsoft 365 sign-in, reset the password, revoke MFA and terminate all active sessions.

External ITWithin 2 hrs

Deactivate the Bitrix24 user, remove all permission sets, and preserve the record for audit.

External ITWithin 2 hrs

Convert the mailbox to shared, apply the agreed delegation, and remove all licences.

External ITWithin 4 hrs

Transfer drive and document ownership, then remove from all groups, portals and distribution lists.

External ITWithin 4 hrs

Remove from WhatsApp and internal chat groups; withdraw building access card rights.

AdminWithin 4 hrs

Issue the signed Access Revocation Certificate to HR listing every system and the time revoked.

External IT1 working day

Continued overleaf — post-exit closure, settlement and audit.

SECTION 07

Offboarding Closure

SOP-HR-06 · Post-exit obligations, government formalities and audit

LWD +1Stage 7

Government & payroll

File the visa cancellation and labour contract cancellation with the authorities.

PROPer statutory timeline

Withdraw the broker card, DLD and Trakheesi registrations attached to the leaver.

PRO5 working days

Finalise the settlement calculation — salary, leave balance, commission, gratuity and deductions.

AccountsPer statutory timeline

Remove the leaver from the WPS file and the next payroll cycle.

AccountsBefore next cycle

Issue the experience certificate and any required letters on request.

HR5 working days

→

LWD +7Stage 8

Assets & systems

Wipe, re-image and re-enter the device into the Asset Register as available stock.

External IT + Admin5 working days

Cancel or reassign the company SIM and close the mobile line.

Admin5 working days

Reclaim and reassign all software licences; confirm the saving to Accounts.

External IT5 working days

Reassign or withdraw portal listings and remove the leaver from marketing material.

Marketing5 working days

Confirm the Asset Register and access profile show a clean, closed record.

Admin7 working days

→

LWD +30Stage 9

Audit & retention

Review the shared mailbox, end the forwarding arrangement, and archive under the retention policy.

External IT30 days

Verify no residual access exists — run the access review across every system on the matrix.

External IT30 days

Close the employee file, retain the record per policy, and log the exit reason for analytics.

HR30 days

Report exit trend data to the HR Director — reason, tenure, department and time-to-clear.

HRMonthly

Confirm settlement paid and the file is financially closed.

Accounts30 days

SECTION 07 (CONT.)

Exit Controls and Service Levels

SOP-HR-06 · Immediate-exit protocol and the offboarding SLA schedule

Immediate exit protocol — gross misconduct, security concern or hostile departure

Where the HR Director determines an immediate exit, the sequence inverts: access is removed before the individual is informed, not after.

T−15 min — HR Director instructs External IT by phone and confirms in writing. No other department is told.
T−0 — All sign-ins disabled, sessions killed, MFA revoked, Bitrix24 deactivated, device remotely locked.
T+0 — The notification meeting takes place with HR and a witness present.
T+30 min — Assets recovered, access card withdrawn, escorted departure.
T+2 hrs — Pipeline reassigned by the Line Manager; mailbox delegated to a named manager.
T+1 day — Access Revocation Certificate and a written incident record issued to the HR Director.

Statutory notice, settlement and cancellation obligations continue to apply regardless of exit type and are confirmed with the PRO and the company's legal adviser before action.

Offboarding service levels

Stage	Owner	Service level
Acknowledge resignation / issue letter	HR	1 working day
Issue Leaver Notification	HR	1 working day
Handover plan prepared	Line Manager	LWD −5
Pipeline reassignment map agreed	Line Manager	LWD −3
Commission and settlement inputs	Accounts	LWD −3
Revocation checklist confirmed	External IT	LWD −1
Asset recovery against signature	Admin	During LWD
Reassignment executed in Bitrix24	Line Manager	Before final logout
Identity and CRM revocation	External IT	2 hours from instruction
Mailbox, drive and group handling	External IT	4 hours from instruction
Access Revocation Certificate	External IT	1 working day
Device wiped and returned to stock	External IT + Admin	5 working days
Licence reclaim confirmed	External IT	5 working days
Residual access review	External IT	30 days
Employee file closed	HR	30 days

Where an exit is declared immediate, every service level above collapses to the immediate exit protocol timings on the left.

SECTION 08

Master Service Level and Escalation Matrix

Applies to every department and to the outsourced IT service

Priority definitions

Priority	Definition	Examples	Response	Resolution target	Update cadence
P1 Critical	Company-wide loss of a core service, or a confirmed or suspected security incident.	CRM unavailable to all users; company email down; suspected data breach or account compromise; leaver revocation instruction.	15 minutes	4 hours	Hourly
P2 High	A department or a group of users cannot work, or a joiner cannot start on time.	A team cannot access Bitrix24; portal integration broken; Day −1 provisioning not complete by 17:00.	1 working hour	8 working hours	Twice daily
P3 Medium	A single user is impaired but has a workaround.	One user cannot log in; software fault; printer failure; permission correction; password reset.	4 working hours	1 working day	Daily
P4 Service request	Planned work with a known date.	New joiner provisioning; device build; access change; role change; scheduled offboarding; reporting.	1 working day	Per SOP calendar date, or 3 working days where no date applies	On completion

Escalation matrix

Trigger	First escalation	Timing	Second escalation	Timing	Final authority
Any onboarding task at risk of missing its deadline	Department Head	Before the deadline	HR Director	Within 48 hours	Managing Director
Device or SIM cannot be delivered before the start date	Admin Manager	Immediately	Managing Director	Same day	Managing Director
Day −1 readiness check fails	HR Director	Day −1 by 17:30	Managing Director	Day −1 evening	Managing Director
External IT misses a P1 or a revocation deadline	IT Account Manager	At breach	HR Director + Managing Director	Within 2 hours	Managing Director
Leaver access still active after LWD +1	IT Account Manager	Immediately	HR Director	Same day	Managing Director
Pipeline not reassigned before revocation	Department Head	Immediately	HR Director	Same day	Managing Director
Suspected data breach or misuse of client data	HR Director	Immediately	Managing Director	Immediately	Managing Director
Repeated non-compliance by any department	HR Director	On second occurrence	Managing Director	On third occurrence	Managing Director

Non-compliance

A missed service level is recorded as a process incident against the owning department, not against an individual. The HR Director reviews all incidents monthly. Three incidents on the same task within a quarter triggers a formal process review with the Department Head and, where the task sits with the outsourced provider, a service review under Appendix B.

Measurement

Service levels are measured from the timestamp of the triggering notification, not from when a department noticed it. All triggers are issued through the agreed channel and logged in Bitrix24, which makes the start time objective and removes the argument about when the clock started.

SECTION 09

Registers, Forms, Controls and KPIs

What must exist, who holds it, and how performance is judged

Controlled documents and registers

Document / register	Owner	System of record
New Joiner Notification	Recruitment	Bitrix24 + email
Employee Personal Information Form	Recruitment	Bitrix24 HR record
Day −1 Readiness Checklist	Recruitment	Bitrix24 task
Asset Register	Admin	Controlled register
Asset Issue Form	Admin	Signed, scanned to HR record
Access Provisioning Log	External IT	Provider system + monthly report
Role Access Matrix exceptions	HR Director	Bitrix24 HR record
Leaver Notification	HR	Bitrix24 + email
Exit Clearance Form	HR	Signed, scanned to HR record
Access Revocation Certificate	External IT	Issued to HR, filed to record
Final Settlement Statement	Accounts	Accounting system
Exit Interview Record	HR	Bitrix24 HR record

Audit controls

Quarterly access review — HR and External IT reconcile every active account against the current employee list. Any account without a live employee is a finding.
Quarterly privilege review — all elevated Bitrix24 and Microsoft 365 rights are re-justified in writing or removed.
Monthly asset reconciliation — Admin confirms every device on the register against a named holder.
Annual SOP review — HR Director reviews this pack, the matrix and Appendix B.

Key performance indicators

Indicator	Definition	Target
Onboarding readiness rate	Joiners with every Day −1 item complete before the start date	≥ 95%
Day-one incident rate	Joiners reporting a missing account, device or access on day one	≤ 5%
Notification lead time	Working days between notification and start date	≥ 3 days
Data form completeness	Employee forms returned fully validated before Day −3	100%
Provisioning evidence rate	Joiners with a recorded account ID for every matrix item	100%
Revocation timeliness	Leavers fully revoked within 2 hours of instruction	100%
Revocation certificate rate	Leavers with a certificate on file within 1 working day	100%
Pipeline continuity	Leavers with zero Bitrix24 records still owned after LWD	100%
Asset recovery rate	Company property recovered by LWD +5	≥ 98%
Clearance cycle time	Working days from LWD to a closed file	≤ 7 days
SLA attainment	Tasks completed within the published service level	≥ 95%
Licence reclaim	Licences released within 5 working days of exit	100%

Reporting rhythm

Weekly — Recruitment circulates the joiner and leaver pipeline for the next fortnight so every department can plan.
Monthly — HR Director reports readiness rate, revocation timeliness, SLA attainment and open incidents to the Managing Director.
Monthly — External IT submits the service report defined in Appendix B, including the access reconciliation.
Quarterly — Combined access and privilege review, signed off by the HR Director.

APPENDIX A

Current Data Health Assessment

Findings from the Employee Personal Information Form responses — 100 records

The following was measured against the live form responses. It is included because the service levels in this pack cannot be evidenced until these four gaps are closed. None of them require new software — all four are configuration and discipline within Bitrix24.

Measured completeness

Records captured via the form

100

Email creation recorded

25%

Bitrix24 creation recorded

23%

Device requirement answered

74%

Visa status captured

100%

Bank / IBAN captured

96%

Provisioning evidence is the weakest control in the current process: for roughly three quarters of the population there is no written record that an email account or a CRM user was ever created, and therefore no record of what must be revoked when that person leaves.

Job title fragmentation

The 100 records carry 48 distinct job titles for what is operationally around twelve roles — including at least fourteen variants of the property consultant role, and titles entered as a person's first name. Because the Role Access Matrix is driven by job title, fragmented titles make correct provisioning impossible to automate and impossible to audit.

Findings and required actions

Finding	Risk	Required action	Owner
Provisioning is recorded for only about a quarter of employees	No baseline of who has access to what; leaver revocation cannot be proven complete	External IT to reconcile every active account against the employee list and publish a baseline; provisioning evidence becomes mandatory per Section 04	External IT + HR
48 free-text job titles for roughly twelve roles	Access matrix cannot be applied consistently; reporting and headcount are unreliable	Publish an approved title list, enforce it as a picklist on the form and in the Bitrix24 structure, and remap all existing records	HR Director
Passport, Emirates ID and IBAN held in an open spreadsheet	Personal and financial data exposed beyond the people who need it	Migrate to the Bitrix24 HR record with restricted visibility; retire the shared sheet and remove historic copies	HR + External IT
Device requirement blank on around a quarter of records	Procurement is triggered late, which is the most common cause of a joiner starting without a laptop	Make the field mandatory on the form and mirror it into the New Joiner Notification	Recruitment
A significant share of records show a non-employment visa status at joining	Right-to-work, broker card and payroll consequences if not tracked to conversion	Track visa status and conversion date on the HR record with an expiry alert; confirm each case with the PRO before day one	PRO + HR

Sequencing recommendation

Close the title list and the provisioning baseline first — every other control in this pack depends on those two. The data migration out of the spreadsheet should follow immediately, and should be treated as a compliance task rather than an IT convenience.

This appendix summarises operational data quality only. Visa, labour and data-protection obligations should be confirmed with the company's PRO and legal adviser before any decision is taken on an individual case.

APPENDIX B

External IT Service — Scope Reference

Issued as a separate controlled document to the outsourced provider

The outsourced IT service provider operates under a dedicated document, SOP-IT-01 — External IT Service Operating Procedure & SLA, issued separately so it can be shared with the provider without circulating internal HR, payroll and commercial content. The summary below is the internal reference for what that document commits the provider to.

Committed service windows

Obligation	Commitment
Acknowledge a New Joiner Notification	1 working day
Microsoft 365 account and licence	Day −1 by 12:00
Bitrix24 user and permission set	Day −1 by 12:00
Drive, groups and role systems	Day −1 by 15:00
Device build, baseline and test	Day −1 by 17:00
Written readiness confirmation to HR	Day −1 by 17:00
Day-one login and MFA walkthrough	First 2 hours
Leaver revocation — identity and CRM	2 hours from instruction
Leaver revocation — mailbox, drive, groups	4 hours from instruction
Access Revocation Certificate	1 working day
Device wipe and return to stock	5 working days
Monthly service and access report	By the 5th of each month

What the provider is accountable for

Identity lifecycle across Microsoft 365 and Bitrix24 — creation, change, revocation.
Applying the Role Access Matrix exactly as stated in the notification, and refusing any request that is not authorised through it.
Device build to the company security baseline, and evidence that every account was tested before handover.
Timed, evidenced revocation with a certificate that names every system and the time it was disabled.
Preservation of company data — mailbox, drive and CRM ownership transferred before any account is removed.
A monthly reconciliation between active accounts and the current employee list.

What the provider is not accountable for

Procurement, purchase decisions and physical delivery — these sit with Admin.
Approving who should receive access — that authority sits with the Department Head and HR Director.
Any delay caused by a notification issued with less than three working days' lead time, or a device released after Day −1 at 09:00. Both are recorded as client-caused and excluded from SLA measurement.

Single authorisation channel

The provider accepts provisioning and revocation instructions from named HR and Admin authorisers only, through the agreed channel. A verbal or WhatsApp request from a line manager is not an authorisation and must be refused and redirected to HR.

HR OperationsStandard Procedures

Purpose, Scope and Definitions

Purpose

Scope

Definitions

How to read the workflow pages

Card anatomy

Rule of the pack

Governance and Department Responsibilities

Recruitment & HR

Admin & Facilities

IT — Outsourced

Line Manager

Marketing

Accounts & PRO

New Joiner Readiness

New Joiner Readiness

Stop conditions — the joiner must not start

Notification content standard

Onboarding Service Level Schedule

Readiness timeline

Role Access Matrix

Rules of the matrix

Bitrix24 permission principles

Employee Exit and Offboarding

Offboarding Closure

Exit Controls and Service Levels

Immediate exit protocol — gross misconduct, security concern or hostile departure

Offboarding service levels

Master Service Level and Escalation Matrix

Priority definitions

Escalation matrix

Non-compliance

Measurement

Registers, Forms, Controls and KPIs

Controlled documents and registers

Audit controls

Key performance indicators

Reporting rhythm

Current Data Health Assessment

Measured completeness

Job title fragmentation

Findings and required actions

Sequencing recommendation

External IT Service — Scope Reference

Committed service windows

What the provider is accountable for

What the provider is not accountable for

Single authorisation channel

HR Operations
Standard Procedures