TL;DR
An asset disposal policy is tested on the records it leaves behind, not the rules it states. Write five short clauses, require per-serial evidence, and include the failure case where a device never comes back.
- Change the asset status. Never delete the row.
- Resale needs the same sanitisation and evidence as destruction.
- A certificate listing a quantity cannot be reconciled with anything.
- Name one approver. Disposal destroys value and ends data recovery.
- Write the unrecoverable case. It happens and policies ignore it.
- The data obligation and the waste obligation are two, not one.
When a paragraph will do
Four stages, and only the last two need a document.
A handful of devices, nothing retired yet. You have not disposed of anything. A paragraph in your asset policy is proportionate until you do.
Best tools for HR Operations
A small pile accumulating. Old machines in a cupboard, nobody responsible. This is the point to write the policy, before volume forces an improvised answer at the worst moment.
Regular retirement at scale. Refresh cycles and departures produce a steady flow. Now the route, the method and the evidence all need to be consistent rather than decided per batch.
Audited, certified or reporting publicly. Somebody tests your evidence against your register. The policy now has to describe what you actually do.
Why an asset disposal policy fails its audit
Most disposal policies read well. They name a certified partner, require secure destruction, and commit to environmentally responsible handling. Then somebody asks for proof about one specific laptop and the whole thing stops working.
The reason is that policies are written about the activity and audited on the artefact. Nobody can observe your disposal process. They can only read what it produced, and what it usually produced is a certificate saying forty units were processed on a date. That document cannot be tied to the machine you were asked about.
The second failure is the deleted row. A tidy-minded administrator removes disposed assets from the register, which makes the list cleaner and makes the history unrecoverable. Afterwards there is no way to distinguish a device that was properly destroyed from one that simply vanished, and both look identical: absent.
Both failures are avoidable in the drafting. Asset disposal expectations in ISO/IEC 27001 assume you can show what happened to a specific item, and sanitisation guidance in NIST SP 800-88 is built around a method plus a verification step rather than an assurance. Write to those two ideas and the policy survives contact with an assessor.
The five clauses worth writing
- Scope. Which asset classes this covers, including storage media removed from devices and anything held by a third party on your behalf.
- Approved routes. Resale, redeployment, recycling, destruction. Say which are permitted and that all carry the same data obligation.
- Method and verification. The sanitisation standard applied and the check that confirms it, with a defined fallback when verification fails.
- Evidence. Per serial number, attached to the asset record, held for a stated period, owned by a named role.
- The unrecoverable case. How long you pursue a device, the status it then takes, and what gets recorded about the attempt.
Five short clauses. If yours runs to six pages and still cannot answer a question about one laptop, the length is not the problem.
Five questions before you draft
Can you produce evidence for one named device from last year? Try it. That single test predicts your audit result.
Does your current certificate carry serial numbers? If it carries a count, your evidence cannot be reconciled.
What is in the cupboard right now? The unprocessed pile is usually larger than anyone estimates and holds live data.
Who signs off a disposal? If the answer is nobody, value is being destroyed without a decision.
Do you separate the data obligation from the waste one? One certificate often covers only one of them.
Disposal routes, and the trade-offs
Resale or trade-in. Best for recovering value and for the environmental position, since the device keeps working. It struggles when sanitisation is treated as lighter than it would be for destruction, which is exactly the temptation.
Internal redeployment. Best for cost, and often the right answer for a two-year-old machine. It struggles on record keeping, because a device moving between people without a status change is how registers drift.
Certified recycling. Best for bulk and for the waste obligation. It struggles on per-device data evidence, since the discipline is materials handling and serial-level certificates are not the native output.
Physical destruction. Best when a drive has failed or verification is impossible. It struggles on cost and on value, because it destroys hardware that often had years left.
A lifecycle service that recovers, wipes and routes. Disclosure: RemoAsset is owned by the same people who publish this site. It handles retrieval, storage, certified wiping and onward disposal across 80 or more countries, so the evidence and the movement come from one record. Where it struggles: it is not a bulk waste contractor, so a datacentre decommission or pallets of old servers is the wrong fit. The narrow part it covers is whether each device has a wipe record tied to its serial.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| Nothing retired yet | Under 20 | No owner | No policy needed | One paragraph, revisit later |
| Cupboard filling up | Any | Any | Live data, no owner | Clear the backlog as one job |
| Steady refresh cycle | 50 plus | IT owner | Route decided per batch | Name the routes and the method |
| Audit asks per device | Any | Security owner | Certificates lack serials | Change the evidence format |
| Reporting on ESG | 100 plus | Ops team | Waste and data conflated | Separate the two obligations |
| Devices never recovered | Any | Any | Gap with no status | Write the unrecoverable case |
What a weak policy costs
The first cost is the unanswerable question. Asked to show what happened to a specific machine, a team with quantity-based certificates argues by inference, and inference is weakest exactly when it is needed, which is after an incident rather than before one.
The second is value destroyed by default. Shredding a three-year-old laptop that would have passed verification and resold is money spent to remove money. When the method is not decided by a risk assessment, the default is usually the expensive one.
The third is the backlog nobody owns. A cupboard of retired devices holds live data under no custody, has no scheduled event that would cause anybody to deal with it, and grows. It persists because it is not currently anyone’s problem.
There is a quieter version of the backlog problem worth naming separately. Devices that were collected, wiped and then left on a shelf awaiting a disposal decision are in the most ambiguous state of all. The data risk is gone, so nobody feels urgency, but the asset still carries value that falls every month it waits. A policy that names a maximum holding period before a disposal decision must be made is the cheapest fix available here, and almost nobody writes one.
The fourth is the reporting error. Teams counting disposed units in an environmental report, from the same certificate that was supposed to prove data removal, publish a number that evidences neither properly.
So the question is not whether your policy requires secure disposal. It is whether you could pick one serial number from last year and show, in under five minutes, exactly what happened to it.
When the gap is upstream of disposal
Most teams writing a disposal policy have a recovery problem rather than a disposal problem. The vendor at the end of the chain is fine. The devices are not reaching them.
Three signals tell you which you have. You disposed of fewer devices last year than you retired. Returns from outside your main market stalled or never arrived. And your unprocessed pile is growing faster than your disposal records.
If any of those holds, a better disposal vendor changes nothing, because the hardware is not reaching the current one either. The constraint sits earlier and it is logistical rather than contractual.
It is worth establishing before you run a procurement exercise, because the answer changes what you are buying. Looking at how recovery, storage and disposal sit in one record settles whether you need a disposal vendor, a collection route, or both.
See how devices are recovered before disposal
Read our guide to IT asset disposal services
Related reading
- IT asset disposal services, compared
- The asset management policy
- Evidencing equipment compliance
- Equipment and ESG reporting
- Choosing a data destruction company
Frequently Asked Questions
What belongs in an asset disposal policy?
Scope, the approved disposal routes, the sanitisation method, the evidence each route must produce, and who authorises a disposal. Keep it short. The value sits in the evidence requirement, because that is the only part an auditor can test and the only part that survives staff turnover.
Should disposal remove the asset from the register?
Change its status, never delete the row. A deleted record is indistinguishable from a device that went missing, and the difference matters a year later when somebody asks. Keep the asset, mark it disposed, and attach the evidence to it so the two can never be separated.
Is resale allowed under a disposal policy?
It should be, and it is usually the better outcome financially and environmentally. The policy just needs to say that resale requires the same sanitisation and the same evidence as destruction. Treating resale as a softer path is how unwiped machines reach a marketplace.
Who should authorise a disposal?
A named role rather than whoever is clearing the cupboard. Disposal destroys an asset with residual value and removes the last chance to recover data properly, so it deserves a decision rather than a default. One approver is enough for most organisations.
What about devices that cannot be recovered?
Write that case explicitly, because it happens and most policies pretend it does not. State how long you pursue a device, what status it takes when you stop, and what is recorded. An honest lost status is far better than an unexplained gap between your register and your disposal records.
Do we need a certified vendor?
For volume disposal it is the practical route, and certification is a reasonable filter when choosing one. What matters more is the evidence format: a certificate listing serial numbers can be reconciled against your register, while one listing a quantity cannot be matched to anything you own.
How does this relate to WEEE obligations?
They are separate obligations that often share a vendor. The data question asks whether information was removed; the waste question asks whether the hardware was treated properly at end of life. A policy should name both, because a single certificate frequently covers only one of them.
