TL;DR
An asset management policy that nobody can evidence is a document, not a control. The register is the actual deliverable, and six fields cover most of what anybody asks. Ownership, a reconciliation schedule and recorded disposal are what keep it true.
- Write the short policy. Spend the effort on the data.
- Six fields: serial, model, holder, location, date, status.
- One named owner. Shared ownership means no ownership.
- Reconcile against something independent, not against itself.
- Storage is a status, not an absence. That pile goes missing.
- Disposal needs evidence, or it is indistinguishable from loss.
When a spreadsheet is enough
Four stages, and the first two do not need a system.
Under about twenty devices in one place. You can walk around and see them. A spreadsheet with six columns is honestly the right tool.
Best tools for HR Operations
Distributed but small. People are in several places and you no longer see the hardware. The spreadsheet still works, but it now needs a review rhythm or it decays within a quarter.
Enough movement that updates get missed. Joiners, leavers and swaps happen weekly. This is the point where manual updating fails, not because anybody is careless but because nobody is prompted.
Audited, certified or insured on the basis of the register. Somebody external will test whether the document matches reality. Now accuracy is the requirement rather than the ambition.
Why an asset management policy drifts from reality
Registers do not fail at the moment they are created. They fail gradually, through events nobody logged.
The common pattern is that the register is built carefully once, usually because somebody asked for it, and then every subsequent change happens in a conversation rather than in the record. A laptop gets swapped. Somebody takes a spare from the cupboard. A leaver returns a machine and it goes into a drawer. Each one is small and none gets written down.
The second pattern is over-specification. Somebody designs a register with twenty-five fields including purchase order number, warranty expiry, depreciation schedule and asset tag colour. Nobody can keep twenty-five fields current, so the whole thing is abandoned in favour of asking around. A sparse accurate register beats a rich stale one every time.
Asset handling expectations in ISO/IEC 27001 assume an organisation can account for what it holds and return or dispose of it properly, and media sanitisation guidance such as NIST SP 800-88 assumes you know which device was wiped. Both rest on the register. That is why it is the whole job rather than an annex to it.
The six fields that earn their place
- Serial number. The only field that uniquely identifies a physical object. Asset tags fall off; serials do not.
- Model. Enough to answer what somebody has without opening it. Keeps refresh planning possible.
- Holder. A person, not a team. A device assigned to a department is a device nobody is responsible for.
- Location. Country at minimum. It drives return logistics, customs and realistic timeframes.
- Date assigned. The basis of every age and refresh question you will be asked.
- Status. In use, in storage, in transit, awaiting disposal, disposed. This field is what makes the register honest.
Add a seventh only when you can name who will keep it current and what decision it supports. That test removes most proposed fields.
Five questions before you write it
Can you produce the current register in under five minutes? If it takes a day to assemble, it is not a register, it is a research project.
What triggers an update? An event in another system beats a person remembering, every time.
Who confirms it is accurate? One name, with a date next to their last check.
What is your evidence for a disposed device? If the answer is a row that was deleted, you have no evidence.
Do you know what is in storage right now? This is the question most registers answer worst.
How teams keep a register, and the trade-offs
A spreadsheet. Best for small, stable fleets and for getting started today. It struggles as soon as updates depend on somebody remembering, which is roughly the point you pass twenty devices.
An IT asset management tool. Best for detail, reporting and audit trails. It struggles on the input problem, because a tool does not know a laptop moved unless something tells it, and it carries real setup cost.
Device management agent data. Best for accuracy on machines that are switched on, since the device reports itself. It struggles on everything in a cupboard, in transit or already wiped, which is exactly the population that goes missing.
Finance records as the source of truth. Best for value and depreciation. It struggles on who holds what, because a purchase record says what was bought rather than where it ended up.
A lifecycle service that owns the movements. Disclosure: RemoAsset is owned by the same people who publish this site. It handles procurement, delivery, retrieval, storage and certified wiping across 80 or more countries, so the register updates as a side effect of the movement rather than through somebody filing a note. Where it struggles: it covers hardware, not software licences, and it is not a replacement for a full IT asset management suite if you need deep reporting and integrations. The narrow thing it changes is whether the record and the hardware agree without anybody maintaining both by hand.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| One office, few devices | Under 20 | No IT owner | Nothing recorded | Six column spreadsheet today |
| Distributed, low churn | 20 to 50 | Part time owner | Register decays quietly | Add a quarterly reconciliation |
| Weekly joiners and leavers | 50 plus | One IT owner | Updates depend on memory | Tie updates to the HR event |
| Several countries | 100 plus | IT team | Location unknown | Record country, then fix returns |
| Audit or certification | Any | Security owner | No disposal evidence | Attach wipe records to assets |
| Large spares pile | Any | Any | Storage untracked | Make storage a status, review it |
What an inaccurate register costs
The first cost is buying things you already own. A spares cupboard nobody can see is functionally not there, so purchasing continues as though the fleet were smaller. That is money spent twice and it is invisible in any single quarter.
The second is the audit answer you cannot give. Asked which devices hold company data and where they are, a team with a stale register has to go and find out, which takes weeks and produces a number nobody fully trusts. The question is reasonable and the inability to answer it is the finding.
The third is the one that actually bites. A leaver’s device cannot be recovered if nobody knows it exists, and a device that cannot be recovered cannot be wiped. So the register’s accuracy quietly sets the ceiling on your data protection position, which is why this document is more consequential than its length suggests.
The fourth is cumulative loss. Each unrecorded device is a small write-off. Across three years of ordinary staff turnover, a mid-sized team can lose a meaningful fraction of its fleet without any single event looking like a problem.
So the question to carry away is not whether you have an asset management policy. It is how long it would take you to prove where every laptop is, and how confident you would be in the answer.
When the policy needs a process underneath it
A policy can require accuracy. It cannot produce it. What produces it is a small number of movements being handled the same way every time.
Three signals say the process is missing rather than the wording. Your last reconciliation found a gap you could not explain. Devices returning from outside your main market take weeks or do not arrive. And the register is updated by the same person who maintains it, which means it is checked against nothing.
Those are operational problems. Rewriting the document does not touch them, and adding fields makes them worse by increasing the maintenance burden on a record that is already behind.
Worth examining before the next audit cycle, because this is the gap most likely to be discovered by somebody else first. Seeing how assignment, return and disposal work as one tracked process answers whether you need better wording or a different mechanism.
See how returns and wipe evidence are recorded
Read our guide to IT asset management software
Related reading
- IT asset management software, compared
- Evidencing equipment compliance
- The employee equipment policy
- Unreturned equipment
- Connecting the register to your HRIS
Frequently Asked Questions
What should an asset management policy contain?
Scope, ownership, the register itself, assignment and return, and disposal. Everything else is detail that belongs in a procedure. If the policy is long and the register is empty, the document is decorative, so write the shorter version and spend the effort on the data.
What fields does the register need?
Serial number, model, who holds it, where they are, when they got it and its current status. Those six answer the questions people actually ask. Fields nobody reads make the record harder to maintain, and a register that is painful to update stops being updated.
Who should own the register?
One named role, not a team and not a shared inbox. Shared ownership of a dataset reliably produces an unmaintained dataset. The owner does not have to do every update, but they are accountable for whether the register is accurate, which is a different thing from whether it exists.
How often should it be reconciled?
Quarterly is a reasonable default for most teams, with a full check annually. The useful version compares the register against something independent, such as device check-in data or a sample of people confirming what they hold. Comparing the register against itself proves nothing.
Does it need to cover software as well?
Usually yes, and most teams underestimate this half. Unused licences are a steady cost and departing staff often keep access to tools nobody tracked. If you are starting from nothing, do hardware first, because it is more concrete, then extend the same structure to software.
What about devices in storage?
Treat them as a status rather than an absence. Devices waiting to be reissued are real assets with real value and they go missing more often than assigned ones, because nobody is responsible for them day to day. Record the location and review the pile on a schedule.
How does disposal fit in?
The policy should require that disposal is recorded with evidence, not just that it happens. A device removed from the register with no disposal record is indistinguishable from a device that walked out of the building. Keep the wipe certificate or the disposal note attached to the asset.
