No Credit Card Required
Printed from checkflow.io/templates/information-technology/it-asset-management-checklist
An IT asset management checklist is the routine an IT team runs to keep its asset register true: reconcile it with what discovery tools see, tag and record new kit, track who holds each device, reclaim unused software licences, act on renewals and leases before they roll over, and check the register by hand each quarter. This template runs that routine every month in six phases, with a seventh for the quarterly audit.
IT asset management (ITAM) is not a one-off inventory. It is a cycle: find what is really out there, compare it with what the register says, fix the difference, and keep purchases, assignments, licences and contracts in step. This free IT asset management checklist gives IT managers, asset managers and service desk leads a monthly routine for hardware and software. It covers discovery reconciliation, goods-in and tagging, assignments and returns, licence compliance and reclaim, and a 90-day look-ahead at renewals, warranties and leases. A quarterly audit phase appears at each quarter end. Every run ends with a small set of KPIs and a signed-off register that finance, security and auditors can rely on.
Discovery tools, endpoint management and SaaS admin consoles show what is connected and in use right now. They do not know what you paid, which contract it sits under, who signed for it or when the lease ends. The register knows all of that, but only what people remembered to record. ITAM happens in the gap between the two. A device seen on the network but missing from the register is either unrecorded or unauthorised. A register entry nobody has seen for a month is in a drawer, lost, stolen or waiting for disposal, and each answer leads somewhere different.
ITIL 4 frames the IT asset management practice as planning and managing the full lifecycle of IT assets to maximise value, control costs and manage risk. ISO/IEC 19770-1:2017 sets the requirements for running that as a management system, including core data management, licence management, internal audit and management review. This checklist is the operating rhythm inside that system. The end of the lifecycle is a separate process: once a device is marked for disposal it moves to the IT Asset Disposal (ITAD) Checklist, and returns to the register only as a closed record with a certificate reference. A lost or stolen device goes through the Lost or Stolen Device Response Checklist, and its entry closes with the incident reference.
Sources: network discovery, endpoint management, SaaS admin consoles, DHCP logs.
Answers: is it online, what is installed, who used it last.
Blind spots: cost, contract, accountable owner, and anything switched off or in a cupboard.
Holds: asset tag, serial, owner, cost centre, purchase date, warranty and lease end, licence entitlements.
Answers: who is accountable, what it cost, when to renew, return or replace.
Blind spots: anything nobody told it about.
Six phases run every month. A seventh, the quarterly audit, switches on at each quarter end.
Assign this phase to the asset manager. It produces the exception list the rest of the month works through.
Tasks 3 and 4 appear only when the review finds unused seats.
Tasks 3 and 4 appear only when a lease ends within the next 90 days.
Shown only when the run is marked as a quarter-end review. The other eight months stay short.
IT asset management is usually described as a lifecycle, from requesting and buying kit to retiring it. This checklist does not follow one device through that lifecycle. Each month it checks every stage at once, across everything you own. The table shows which phase checks which stage.
| Lifecycle stage | What happens | Where it is checked |
|---|---|---|
| Plan and request | Kit is requested for a named user and role and approved before anything is bought. Replacements are planned from warranty and support dates. | Phase 5 feeds the refresh budget; requests run through the IT equipment request process checklist |
| Procure and receive | Deliveries are matched to purchase orders, serials recorded at goods-in and proof of entitlement filed for software. | Phase 2 |
| Tag and register | Every item gets an asset tag and a register entry before it leaves stores. | Phase 2 |
| Deploy and assign | Each device is issued to a named user with a recorded acceptance, and loans have a due date. | Phase 3; the build itself is the laptop provisioning and imaging checklist |
| Maintain and track | The register is reconciled with discovery data, licences are compared with entitlements, and warranties, support and leases are watched 90 days ahead. | Phases 1, 4 and 5 |
| Audit | Floor-to-book and book-to-floor samples, a full inventory review and a risk review of high-value assets. | Phase 7, each quarter |
| Return and redeploy | Leavers’ equipment is checked back in, and returned devices are reissued, repaired, kept as spares or marked for disposal. | Phase 3; leavers’ access and devices are in the IT offboarding checklist |
| Retire and dispose | Leased kit goes back on the lessor’s terms. Owned kit is wiped, disposed of and closed in the register with a certificate reference. | Phase 5 for leases; disposal runs in the IT asset disposal (ITAD) checklist |
The checklist checks the register; it does not replace it. These are the fields its tasks rely on, so the register needs each one. The FAQ below lists the fuller set that CIS Controls v8.1 asks for.
| Field | Why the checklist needs it | Phase |
|---|---|---|
| Asset tag | Links the physical device to its record; the quarterly audit locates devices by it | 2, 7 |
| Serial number | Recorded at goods-in; matches discovery data to the register and exposes duplicates | 1, 2 |
| Assigned user and acceptance | Every issued device has a named user who signed for it | 3 |
| Accountable owner and cost centre | Someone answers for the asset; “assets without an owner” is a monthly KPI | 2, 6 |
| Status and date last seen | In use, in storage, on loan, lost or awaiting disposal; devices not seen for 30 days are chased | 1, 3 |
| Supplier, purchase date and order reference | Ties the asset to what was paid and under which order | 2 |
| Warranty end and end of vendor support | Drives repairs and the replacement plan | 5 |
| Lease end and return conditions | Recalls leased kit in time to meet the lessor’s terms | 5 |
| Incident or disposal reference | A lost or stolen device closes with its incident reference, a disposed one with its certificate reference | 1, 3 |
| Software: product, publisher and entitlements | The licences you own, with proof of entitlement on file | 2, 4 |
| Software: assigned seats and last use | Finds seats unused beyond your threshold, ready to reclaim | 4 |
| Contract renewal date and notice period | Gives time to renew, renegotiate or cancel | 5 |
Each monthly run records its own figures in form fields: the discovery-to-register match rate, devices seen but not registered, registered devices not seen for 30 days, devices still outstanding from leavers, seats reclaimed, the budget holder’s decision on any licence shortfall and the five KPIs at sign-off. A quarter-end run adds the floor-to-book and book-to-floor sample sizes and what each one found.
If you keep the register itself in CheckFlow, a Data Set can hold it: one record per asset, with Text, Number and Date fields for the columns above and saved views such as “Spares in stores”. Link a drop-down in a template to a view, and whoever fills it in picks the device by tag from the current list; the chosen record’s fields, such as its warranty end, become dynamic values the checklist can show. A script can keep the Data Set current from your discovery or endpoint tool through the REST API or a CSV import. If you already have an ITAM tool, keep it as the register and use this checklist to run the monthly process around it.
Not everything belongs in the monthly run. Some checks need to happen weekly in operations, and some only make sense a few times a year. The matrix shows where each activity sits, who usually owns it and the reference behind it. Where a reference sets a minimum, many teams go faster.
| Activity | Cadence | Typical owner | Reference |
|---|---|---|---|
| Deal with unauthorised devices on the network | Weekly | Service desk or security operations | CIS Controls v8.1, Safeguard 1.2 |
| Check software support status and remove unauthorised software | Monthly | Asset manager with IT operations | CIS Safeguards 2.2 and 2.3 |
| Reconcile discovery with the register | Monthly | Asset manager | Phase 1 |
| Licence position and reclaim | Monthly for key products | Software asset manager | ISO/IEC 19770-1, clause 8.4 |
| Renewal, warranty and lease look-ahead | Monthly, 90 days ahead | Contract owners | Phase 5 |
| Floor-to-book and book-to-floor checks | Quarterly, sampled | Asset manager plus a second person | ICO data protection audit framework (periodic physical checks) |
| Full hardware and software inventory review | At least every six months | ITAM owner | CIS Safeguards 1.1 and 2.1 |
| Internal audit and management review of the ITAM system | At planned intervals, usually yearly | ITAM owner and IT leadership | ISO/IEC 19770-1, clauses 9.2 and 9.3 |
If you hold ISO/IEC 27001:2022 certification, the same runs double as evidence for two Annex A controls: 5.9, an inventory of information and associated assets with named owners, which Phases 1 and 2 keep current; and 5.11, return of assets when people leave or change role, which Phase 3 checks every month.
A monthly schedule creates the run on the first working day, with dynamic due dates so reconciliation finishes before the renewal look-ahead needs its numbers. One yes/no answer at the start switches on the quarterly audit phase.
Keep key software products, entitlement counts and renewal dates in a data set that fills the licence and renewal tasks. A discovery script can write its exceptions into the run through the REST API or Zapier instead of someone copying them by hand.
Every task records who completed it and when, with exports, KPI summaries and audit samples attached. When an auditor or a software vendor asks how you know the register is right, you show twelve monthly reconciliations and four quarterly audits.
ITAM only works if the cycle actually runs every month. CheckFlow’s recurring checklist software explains how schedules, assignments and due dates keep a monthly process on track when the person who set it up is on leave.
Kit enters the register through the IT Equipment Request Process Checklist and leaves a user’s hands through the Employee Offboarding Checklist. Devices that discovery shows are behind on updates belong in the Patch Management Checklist.
Software License Audit Checklist
IT Asset Disposal (ITAD) Checklist
Lost or Stolen Device Response Checklist
Hardware Lifecycle Refresh Checklist
Laptop Provisioning & Imaging Checklist
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
IT asset management (ITAM) is the practice of tracking and managing hardware, software and related contracts across their whole lifecycle, from purchase to disposal. It answers four questions at any point: what you own, where it is, who is responsible for it and what it costs. In practice it is a recurring cycle of reconciliation, licence review, renewal decisions and audit, rather than a one-off inventory project.
For hardware: asset tag, serial number, make and model, assigned user, accountable owner, department or cost centre, location, purchase date, supplier, warranty end and, for leased kit, the lease end date. CIS Safeguard 1.1 adds network and hardware addresses, machine name and whether the device is approved to connect. For software, CIS Safeguard 2.1 lists title, publisher, install date and business purpose, plus version and licence count where appropriate.
Reconcile monthly and audit physically at least quarterly. CIS Controls v8.1 asks for the full hardware and software inventories to be reviewed at least every six months and for unauthorised devices to be dealt with weekly. A sampled floor-to-book and book-to-floor check each quarter catches devices that never touch the network, such as spares in a cupboard, which discovery tools cannot see.
A CMDB records configuration items and how they relate to each other, so change and incident teams can see what a failure or a change will affect. An ITAM register records the financial and contractual side: cost, ownership, entitlements, warranties and leases. Many items appear in both, and the two should share identifiers, but they answer different questions. A spare laptop in stores matters to ITAM long before it matters to the CMDB.
Set a threshold, such as no use in 60 or 90 days, and pull the list of seats that cross it each month. Confirm with the user’s manager before removing anything, because some tools are used seasonally. Then remove the assignment and, most importantly, reduce the count at the next renewal. A seat returned to the pool saves money only if you stop buying it.
Yes, where the control applies to your risk treatment. ISO/IEC 27001:2022 Annex A 5.9 calls for an inventory of information and other associated assets, including owners, that is kept up to date, and 5.11 covers the return of assets when employment or a contract changes or ends. A monthly reconciliation with sign-off is a straightforward way to show an auditor the inventory is maintained, not just created.
Most models use five or six: plan and request, procure and receive, deploy and assign, maintain and track (including licences, warranties and leases), and retire and dispose, with audit running across all of them. The names vary between frameworks. This checklist checks every stage each month, and disposal has its own IT asset disposal checklist.
Not quite. An inventory checklist counts what you have at one point in time, usually for an audit. An IT asset management checklist keeps that inventory true afterwards and adds what an inventory leaves out: who is accountable, what each asset cost, licence entitlements, and when warranties, leases and contracts end. Phases 1, 2 and 7 of this template are the inventory work; Phases 3 to 6 are the management around it.
Yes. Use “Print this checklist” on this page to print the seven phases with a tick box beside every task, or choose Save as PDF in your browser’s print dialog. To run it rather than print it, use the template free in CheckFlow: each monthly run keeps who completed every task and when, with the exports, KPIs and sign-off attached.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS hosting, EU on request
