Return of assets

Plain-language summary

Making sure employees, contractors and other parties hand back every organisational asset they hold — devices, access cards, tokens, documents, and the organisation's information on their own devices — when their employment, contract or agreement changes or ends.

What the clause is really asking

Leavers walk out with more than laptops. This control requires that employees, and outsiders where relevant, hand back everything of the organisation's they hold when they leave, change role or finish a contract. That covers devices, storage media, access cards and keys, authentication tokens and paper records — and, the part most often missed, organisational information on personally owned devices or in personal cloud accounts, which must be transferred back and securely removed. Where a leaver holds knowledge that matters to ongoing operations and is not written down, capture it before they go. Role changes count too: a mover may need to return assets tied to the old role. Contractors, consultants and suppliers are in scope as much as employees. The common misunderstanding is that a laptop handback ticks the box; the asset inventory, not memory, should drive what is collected. In South Africa, the employment contract should set out the duty to return assets, and organisational personal information left on a former employee's phone remains the responsible party's problem under POPIA.

What auditors look for

Auditors ask for the leaver procedure and checklist, then take a sample of recent leavers from HR and trace each one: the checklist, the assets assigned to them according to the inventory, the assets returned, the access card deactivated, and the dates. They compare HR leaving dates with return dates. They ask how information on personal devices or personal accounts is dealt with for leavers who used their own devices. They include a contractor or supplier in the sample. The hard question: what assets are still outstanding from people who have left, and what are you doing about them?

Typical evidence

Leaver and mover procedure; exit checklist signed by HR, the line manager and IT; asset assignment records linked to the inventory; return records with dates and condition; access card and token deactivation records; confirmations of data removal from personal devices; handover notes; register of outstanding assets with follow-up; contract clauses requiring return of assets.

How to comply — recommendations

Record every asset issued against a person in the inventory, so the leaver checklist can be produced from it rather than from memory. Build one exit checklist covering devices, media, cards, keys, tokens, paper records, organisational data on personal devices and accounts, and handover of knowledge. Have HR trigger it on resignation or termination and the line manager sign it off. For personal devices, require removal of the company workspace or a selective wipe, and record it. Apply the same checklist to contractors when engagements end. Track outstanding items and escalate weekly. Check a sample of leavers each quarter against HR records.

Common nonconformities

No leaver checklist, or one covering only laptops; assets issued but not recorded against individuals; contractors and suppliers excluded from the process; organisational information left on personal devices; access cards and tokens not recovered; outstanding assets not followed up; no handover of undocumented knowledge; return dates well after leaving dates.

Resources for this clause

• ArticleISO/IEC 27001:2022 Annex A explained: the 93 controls in plain English, theme by theme, with the 114-to-93 map and the attribute tags
• ArticleThe Statement of Applicability, explained — what ISO/IEC 27001 clause 6.1.3 requires, the four ways an SoA fails Stage 1, and how to build one from the risk register
• ArticleISO/IEC 27001:2022 explained for people who already run ISO 9001: what is the same, what is new, and how to get certified
• Toolkit · $39Risk & SoA ToolkitScore your information security risks on a documented method, pick the Annex A controls that treat them, and the Statement of Applicability writes its own first draft — every justification citing the risks behind it.
• Toolkit · $29ISMS Metrics & Evidence TrackerThe three things an ISMS has to show after certification, in one workbook: measures with a live Green / Amber / Red status, management review minutes that cover every required input, and an evidence register that gives every control an owner, a rhythm and a due date.
• Free downloadAnnex A 93 Controls Quick ReferenceOne A3 page: all 93 Annex A controls in their four themes, the eleven new in 2022 flagged, and the ISO/IEC 27002:2022 attribute legend — the poster for the wall beside the Statement of Applicability.
• Free downloadISO 27001 Gap Analysis ChecklistWhere you stand against ISO/IEC 27001:2022 in one afternoon — the 30 management-system requirements and all 93 Annex A controls, scored, with owners, dates and a readiness figure that calculates itself.
• Free masterclass · ~27 minISO 27001 MasterclassYou already know four fifths of ISO 27001. Here is the other fifth — the risk method, the SoA, the 93 controls, the evidence rhythm, POPIA, and a 44-week path.
• Free appAudit ManagerPlan the programme, anchor each finding to its clause and drive the NC to closure.