Employee Onboarding Checklist

Verify the offer letter, classification (W-2 vs 1099 — misclassifying a marketing contractor as a contractor when they're really an employee is a frequent audit finding), reporting manager, and first-day arrival format (in-office, remote, or hybrid). The role selected here drives the role-specific training track later in the workflow.

Place the order with enough lead time for MDM enrollment (Jamf or Kandji for Mac, Intune for Windows) before Day 1. Include a YubiKey or equivalent hardware MFA token for any role touching Amazon Seller Central, Shopify admin, or payment-related tools.

Create the Okta or Google Workspace identity and assign to the role-appropriate group. Group-based provisioning means access changes follow the role rather than ad-hoc grants — much easier to audit and to revoke at offboarding.

Email the new hire the building address (or remote dial-in), parking, dress code, Day 1 schedule, manager's cell, and links to the brand book and product catalog. Include tracking for the laptop shipment if remote.

Form I-9 Section 2 must be completed within 3 business days of start date — the most common HR audit miss. Run E-Verify if your state requires it. State withholding forms vary; for remote hires, withhold based on the employee's work location, not the company HQ.

Walk through medical, dental, vision, FSA/HSA, and 401(k) elections with the benefits portal (Gusto, Rippling, Justworks). Note the 30-day enrollment window — missing it pushes coverage to the next open enrollment.

Standard NDA, IP assignment, and any state-specific addenda (California prohibits non-competes; some states limit non-solicits). Store the signed PDF in the employee folder; HR audits routinely fail on missing IP assignments for engineers and creative roles.

Cover PTO, sick leave, expense policy, remote-work expectations, and the social media policy — the last one matters because employees posting about products fall under FTC endorsement disclosure rules even on personal accounts.

Amazon Seller Central requires 2SV for any user with admin or financial access — not enabling it is an Account Health flag. Shopify Plus admin accounts should use hardware MFA (YubiKey) given the storefront-takeover risk. Pair the MFA setup with the SSO login during Day 1.

Klaviyo, Gorgias, Triple Whale, Meta Business Manager, Google Ads, TikTok Ads — grant the minimum role needed (Analyst vs Admin). The frequent gotcha is granting Meta Business Manager admin to a new PPC hire; that role can remove other admins and detach the ad account.

Share only the role-scoped vault — Marketing vault, CX vault, Fulfillment vault — not the firm-wide one. Rotate any credentials that previously lived in shared docs or Slack DMs as part of onboarding hygiene.

Cover what counts as PII (email + order is PII; email alone may be PII under GDPR), where customer data lives (Shopify, Klaviyo, Gorgias), and the rule that no card numbers, CVVs, or full PANs ever go into Slack, Notion, or email. Note the GDPR/CCPA data-subject-request workflow and who owns it.

Walk through specific deliverables for each milestone — for a PPC hire, that might be "audit current Meta accounts by Day 30, propose creative testing plan by Day 60, hit -10% target CAC by Day 90." Vague onboarding plans drive 90-day attrition.

For a CX hire, shadow tickets in Gorgias for a full shift; for a fulfillment hire, shadow morning pick-pack and afternoon FBA inbound; for a PPC hire, shadow the weekly account review and creative briefing.

Read the brand book, the top-3 customer personas, and the last 50 5-star and 1-star reviews. The reviews surface what customers actually say in their own words — the raw material for both ad copy and CX macros.

Cover the FTC Endorsement Guides updated in 2023: every paid post must carry #ad or "paid partnership," affiliate links require disclosure, and reviewer-incentive arrangements must be conspicuous. Also cover Amazon's separate rule against incentivizing reviews via Buyer-Seller Messaging — violations get the brand's selling privileges suspended.

Walk through the macro library, tag taxonomy, and SLA targets (typically 4-hour first response, 24-hour resolution for non-shipping issues). Cover the escalation path for A-to-z claims, chargebacks, and product-defect reports — those each have time-bound responses with revenue consequences.

Short anonymous survey covering laptop arrival, access provisioning, manager engagement, and any blockers. The signal is most useful in aggregate across hires — track week-1 sentiment as a leading indicator of 90-day retention.

Cover progress against the 30/60/90 plan, blockers, team integration, and explicit go/no-go on the role fit. Capture the outcome and any flags so HR can act early — addressing a misfit at Day 30 is far cheaper than at Day 90.

Pin the role's headline metrics — for a PPC hire that's MER, blended CAC, and ROAS by channel; for a CX hire that's first-response time, CSAT, and FCR; for a fulfillment hire that's on-time ship rate and pick accuracy. Concrete numbers, not vague aspirations.