Introduction
An IT asset audit is a periodic, evidence-backed check that the laptops, servers, and network hardware your records claim you own actually exist, sit where they should, belong to the right people, and reconcile to the systems that govern them. This guide gives you the tool-agnostic version, following the same principles as a fixed asset audit: a seven-step process, a free checklist you can download and adapt, frequency norms by asset class, and the reconciliation step most audits skip.
In this guide, you will learn:
- How to scope an IT asset audit, freeze the source records, and verify devices through physical and network sweeps.
- Why reconciling discovery, CMDB/ITAM, and fixed asset register data is essential and what each view can and cannot confirm.
- How to classify findings, assign remediation owners, approve record changes, and close the audit with a signed report and evidence trail.
- How to set risk-based audit frequencies, respond to common findings, and use audit evidence to support ISO 27001 asset-management controls.
What Is an IT Asset Audit?
An IT asset audit is a scheduled control event: over a defined window, a defined inventory of IT equipment is physically checked and reconciled against the records, discrepancies are investigated, and the outcome is reported and signed off. Some organizations call the same exercise an IT asset management audit. The name matters less than the three things it must produce: evidence of existence, a classified discrepancy list, and corrected records.
Two neighbouring terms cause confusion. A software licence audit reconciles entitlements against installations a different exercise with different evidence. And IT asset verification is the ongoing method how devices are matched across ITAM, CMDB and the fixed asset register day to day; the audit is the periodic event that tests whether that method is working. This page covers the event.
The IT Asset Audit Process: Seven Steps
The same seven steps work whether your organization manages 300 laptops or 30,000 devices across data centres; only the sampling and the tooling change.
- Define scope and objectives: Which asset classes, sites and value thresholds are in; whether the objective is existence only, or existence plus custody, condition and financial reconciliation. Write it down scope drift is how audits lose weeks.
- Freeze the working extracts and golden keys: One controlled extract each from ITAM, the CMDB, endpoint/discovery tooling and the fixed asset register, matched on serial number, asset tag and fixed asset ID. Nobody reconciles against a private export.
- Sweep the floor and the network: Physically sight and scan in-scope assets (serial or tag, location, custodian, condition, photo where policy requires), and pull the discovery view of what is actually live on the network the two sweeps catch different problems.
- Reconcile the three views: Match field results and discovery data against the CMDB and the fixed asset register. This is the step that turns a count into an audit and the step most processes overlook entirely.
- Classify every finding: Controlled categories, not free text: not found, wrong custodian, wrong location, unrecorded device, retired-but-active in finance, CI without an asset link, license or warranty mismatch.
- Remediate through owners and approvals: Each finding gets a named owner, a target date and for anything touching the books an approval before the record changes. Write-offs route to finance; re-assignments route through IT.
- Report and certify: A signed report covering asset base, coverage, findings by category, actions taken and open items retained with the evidence trail so next yearтАЩs audit, and any external reviewer following fixed asset audit procedures, can test it.
The Step Everyone Skips: Discovery vs CMDB vs Fixed Asset Register
Most IT audits stop at тАЬdiscovery found it, so it existsтАЭ. That proves a device is on the network not that it is the device your register says it is, held by the person finance thinks holds it. A defensible audit reconciles three independent views:
View | What its тАЬyesтАЭ actually means | What it cannot tell you |
|---|---|---|
| Endpoint / discovery | The device was alive on the network recently | Who physically holds it, or whether it is on the books |
| CMDB / ITAM | Someone recorded the device and its lifecycle state | Whether the record still matches reality |
| Fixed asset register | Finance is carrying and depreciating the device | Whether the device still exists at all |
Devices in only one or two of the three views are your findings:
- On-network but off-book: Unrecorded or shadow purchases that appear on the network but are missing from the fixed asset register.
- On-book but off-network: Devices in storage or repair, or ghost hardware that remains on the register and may still be depreciating.
- Recorded but never seen: Devices with stale lifecycle records that have not been detected during the audit.
IT Asset Audit Checklist
Phase | The checks that matter |
|---|---|
| Before fieldwork | Scope and thresholds approved ┬╖ extracts frozen from ITAM, CMDB, discovery and FAR ┬╖ golden keys agreed ┬╖ locations and custodian lists current ┬╖ discrepancy codes and approvers named |
| Physical sweep | Serial/tag captured per device ┬╖ location at the agreed level ┬╖ custodian confirmed ┬╖ condition coded ┬╖ photo where policy requires ┬╖ blocked access escalated same day |
| Network sweep | Discovery extract pulled for the same window ┬╖ last-seen thresholds agreed ┬╖ BYOD and virtual machines excluded or handled under policy |
| Reconciliation | Three-way match run on the golden keys ┬╖ every mismatch classified under a controlled code ┬╖ no free-text verdicts |
| Closeout | Every finding has an owner and date ┬╖ book changes approved before posting ┬╖ report signed ┬╖ evidence archived ┬╖ lessons fed into tagging and joiner-mover-leaver fixes |
How Often Should IT Assets Be Audited?
Annual everything is the wrong answer for IT: A server rack and a fleet of laptops do not drift at the same speed. Set cadence by mobility and risk, then let events override the calendar:
Asset class | Baseline cadence | Why |
|---|---|---|
| User-assigned laptops and mobile devices | Annual full audit + quarterly spot checks or rolling custodian confirmations | Highest movement, highest loss exposure |
| Data-centre hardware | Annual, aligned to the finance year-end where racks are capitalised | Low mobility, high value, strong audit relevance |
| Network equipment across sites | Annual or rolling 12-month cycle by site | Moderate movement, service-critical |
| Loaner and repair pools | Quarterly reconciliation of the pool log | Swap history is where serials go to get lost |
| Low-value peripherals | Sample-based, per policy threshold | Control cost should not exceed the asset value |
Calendar aside, four events should trigger an out-of-cycle audit: A merger or acquisition, an ERP or ITAM migration, an ISO 27001 certification or surveillance window, and any security incident that casts doubt on device custody.
The Findings You Should Expect
Every IT asset base produces the same five findings; what varies is the proportion. Knowing them in advance makes classification and remediation ownership faster:
- Shadow IT: Devices bought on local budgets that never touched the asset process: on the network, absent everywhere else. Remediation is onboarding plus a procurement-channel fix, not blame.
- Ghost hardware: Devices on the register (often still depreciating) that no sweep can find: disposals and losses that never reached finance. Remediation runs through investigation and approved write-off.
- Zombie licences and warranties: Support contracts and subscriptions alive for hardware that is not: a direct cost recovery, and usually the finding that pays for the audit.
- Joiner-mover-leaver drift: Devices assigned to people who changed role, site or employer; custody is wrong even though the asset exists. Remediation is a custodian sweep plus a handover-process fix.
- Disposal without evidence: Retired devices with no wipe certificate or disposal record: a data-protection exposure as much as an accounting one.
IT Asset Audits and ISO 27001
An IT asset audit is not only a finance control. ISO 27001 expects an organization to maintain an inventory of information and other associated assets, with owners, and to manage them through their lifecycle. For certified organizations, the audit cycle described here is exactly the evidence a certification or surveillance assessor asks for: a current inventory, named owners, controlled disposals with wipe evidence, and a demonstrated cadence.
AssetCues is ISO 27001 certified and follows the same standard when auditing its own assets and those of its customers. That is why the platform treats evidence trails, custody records and disposal documentation as core outputs, not just report formatting.
Where AssetCues Fits
AssetCues runs the cycle on this page end to end: register and CMDB import, field validation of existence, location, custodian and status, controlled approval of corrections, and sync back to the ERP or CMDB. For the audit event itself, the Asset Audit Co-pilot prepares exception queues and keeps every AI-flagged discrepancy behind a named reviewerтАЩs approval.
Key Takeaway
- An IT asset audit confirms that devices exist, remain with the right custodians, and match ITAM, CMDB, and finance records.
- Follow seven steps from scoping and frozen extracts through physical and network sweeps, reconciliation, remediation, and signed reporting.
- Reconcile discovery, CMDB, and the fixed asset register to uncover shadow IT, ghost hardware, stale records, and unsupported disposals.
- Set audit frequency by asset class and risk; retain evidence and approvals to support finance controls and ISO 27001.
Conclusion
A reliable IT asset audit confirms that devices exist, are correctly assigned, and match the records that govern them. Following a structured IT asset audit process and using an IT asset audit checklist helps teams identify discrepancies, assign remediation, and retain evidence for review. A well-managed IT asset management audit supports accurate records, stronger accountability, and audit readiness.
FAQs
Q1: How to perform an IT asset audit?
Ans: Define the scope and objectives, freeze one extract each from ITAM, the CMDB, discovery tooling and the fixed asset register, sweep the assets physically and on the network, reconcile the three views using serial numbers and asset tags, classify every mismatch under controlled codes, remediate through named owners and approvals, and close with a signed report.
Q2: How often should IT assets be audited?
Ans: Set the audit frequency by asset class: an annual full audit for all assets, quarterly spot checks or rolling custodian confirmations for laptops and mobile devices, and sample-based checks for low-value peripherals. Run an out-of-cycle audit after a merger, a systems migration, an ISO 27001 assessment window or a custody-related security incident.
Q3: What is the difference between an IT asset audit and IT asset verification?
Ans: Verification is the ongoing process of matching devices across ITAM, CMDB and the fixed asset register as they move through their lifecycle. The audit is the periodic event that tests whether that process is working: a defined window, a defined asset base, a classified findings list and a signed report.
Q4: Who should own an IT asset audit?
Ans: IT asset management usually runs the audit, but ownership is shared. IT maintains operational records and conducts the physical sweep, finance makes capitalisation and write-off decisions, HR provides custodian data, and internal audit or the ISO owner reviews the process design and evidence. One person must own the event from start to finish.
Q5: What should an IT asset audit report include?
Ans: The audited asset base and coverage achieved, the method and extracts used, findings classified by category with counts, the remediation log with owners and dates, approved book adjustments, open items, and sign-off. Retain the underlying evidence scans, photos, and custodian confirmations so a reviewer can test any line.
