ISO 27001 Annex A 5.11 Audit Checklist

Use this pass/fail checklist to strictly validate compliance with ISO 27001 Annex A 5.11 (Return of Assets). For a detailed methodology on how to conduct the interviews and system tests required to generate this evidence, refer to our Annex A 5.11 Audit Guide.

1. Return of Assets Policy Formally Defined

• Verification Criteria: A documented policy exists (often part of the Asset Management Policy) explicitly stating that all employees and contractors must return assets upon termination or contract change.
• Required Evidence: The “Asset Management Policy” or “Acceptable Use Policy” (Version controlled and approved).

Pass/Fail Test: If the requirement to return assets is only “implied” or verbal and not written in a formal policy, mark as Non-Compliant.

2. Employment Contract Terms Verified

• Verification Criteria: Standard employment contracts and contractor agreements contain specific clauses mandating the return of equipment and data deletion upon exit.
• Required Evidence: A sample of 3 recent employment contracts (redacted PII) showing the “Return of Property” clause.

Pass/Fail Test: If the contract mentions “confidentiality” but fails to explicitly demand the physical return of hardware (laptops, keys), mark as Non-Compliant.

3. Exit Interview Asset Reconciliation Verified

• Verification Criteria: The offboarding process includes a mandatory step where the leaver’s assigned assets (from the Asset Register) are cross-checked against what they are physically handing back.
• Required Evidence: Completed “Leaver Checklists” for the last 3 terminated employees, signed by both HR/IT and the employee.

Pass/Fail Test: If the leaver form has a generic checkbox for “Assets Returned” but does not list the specific serial numbers returned, mark as Non-Compliant.

4. Hardware Return Log Validated

• Verification Criteria: A log exists tracking the physical receipt of returned hardware, its condition, and its subsequent storage or re-assignment.
• Required Evidence: The IT Asset Management (ITAM) log showing date of return, assessor name, and status (e.g., “Returned to Stock”).

Pass/Fail Test: If a laptop was returned 3 months ago but the Asset Register still lists it as “Assigned to [Leaver Name],” mark as Non-Compliant.

5. Data Retrieval from Personal Devices Confirmed

• Verification Criteria: For BYOD environments, a process exists to confirm company data has been wiped from personal devices (e.g., email, Teams, files).
• Required Evidence: Logs from the Mobile Device Management (MDM) system showing “Remote Wipe” or “Container Removal” commands executed on leavers’ devices.

Pass/Fail Test: If the organisation relies solely on the user’s verbal promise that they deleted the data without technical verification or a signed declaration, mark as Non-Compliant.

6. Access Rights Revocation Synchronised

• Verification Criteria: The return of physical assets is synchronised with the revocation of logical access rights to prevent “zombie” accounts.
• Required Evidence: Ticket logs showing that Active Directory/SaaS accounts were disabled before or on the final day of employment.

Pass/Fail Test: If an employee left on Friday but their VPN token was still active on Monday (allowing them to copy data), mark as Non-Compliant.

7. Intellectual Property & Knowledge Transfer Verified

• Verification Criteria: Non-tangible assets (code repositories, admin passwords, documentation) are explicitly transferred back to the organisation.
• Required Evidence: A “Handover Document” or ticket showing ownership transfer of Git repositories, cloud root keys, or critical project files.

Pass/Fail Test: If a developer leaves and their code is inaccessible because it was stored on a personal GitHub account or local drive, mark as Non-Compliant.

8. External Contractor Offboarding Verified

• Verification Criteria: The return of assets process is applied equally to external contractors and third-party suppliers when their project ends.
• Required Evidence: Offboarding records for a recent contractor showing the return of building passes, tokens, and hardware.

Pass/Fail Test: If a contractor retained a building access pass “in case they are needed later” without formal re-approval, mark as Non-Compliant.

9. Non-Return / Damage Procedure Evidence Present

• Verification Criteria: A clear procedure exists for handling cases where assets are lost, damaged, or not returned (e.g., withholding salary, legal action).
• Required Evidence: Documented “Asset Loss Incident Reports” or email correspondence from HR/Legal regarding unreturned items.

Pass/Fail Test: If an asset is missing and marked “Lost” in the register but no incident report or follow-up action exists, mark as Non-Compliant.

10. Secure Storage of Returned Assets

• Verification Criteria: Returned assets are stored securely (wiped and locked away) pending re-issue or disposal, not left in open areas.
• Required Evidence: Visual inspection of the secure storage area (e.g., locked IT cupboard) and evidence of disk wiping for re-stocked laptops.

Pass/Fail Test: If returned laptops are piled in an unlocked corridor or open office shelf accessible to visitors, mark as Non-Compliant.