IT Asset Management Process: How to Set It Up

An IT asset management process can be set up as a build order that one named owner runs. Agree the scope, fix the fields, name the owner, feed the register from your device tools and purchases, count the spares, tie staff changes and repairs to the record, then compare it with device data and report.

Here, the process means the steps, owners and checks that keep a record of every device current. The register holds one row per device, showing who has it, where it sits and its condition. Device management is the practice of enrolling laptops and phones in a central console so IT can set and check their settings; see how device management works. Equipment at every site is in scope here, while software licenses are left out. If you want to know why asset records fall behind first, start there. Day-to-day IT asset tracking then runs on the steps below.

IT Asset Management Process Steps in Build Order

The build has nine steps, and each of these IT asset management process steps leans on the one before it. Two points in that order need care. The fields come before the first import, because changing them later means cleaning every row twice. The owner comes before the sources, which gives someone the right to decide when two sources disagree.

The nine steps run in this order:

Steps 8 and 9 then repeat on a schedule for as long as the register exists.

Decide What the Register Covers and Who Owns It

The first three steps happen before any data moves. They settle what goes in, what each row holds and who answers for the whole record.

IT Asset Management Process, Step 1: Set the Scope

Decide which devices go in first. A sensible first group is laptops, desktops, phones and tablets, since staff carry them and they may hold company data. Monitors, docks and headsets can wait for a second pass. Personal devices that staff use for work can wait as well, because they raise policy questions of their own.

Then name the sites: head office, every branch, warehouses and any shared office where your staff sit. A firm with offices in Bengaluru, Riyadh and Dubai, for example, lists all three from the start, even if the count at one of them begins later.

Software licenses follow different rules and renewal dates, and license and renewal tracking covers them.

Agree, too, what counts as one asset. A laptop and its dock can be one row or two, and the same goes for a phone and its SIM card. Either choice works, as long as every site follows the same one.

Step 2: Fix the Fields and Status Values Before Import

Keep the field list short. A workable set is the serial number, model, current holder, site, cost center, status, purchase date and the date the device was last seen on the network. Each extra field is one more thing someone has to fill in at every hand-over.

Next, fix the status values so that everyone uses the same words:

• in use
• spare
• in transit
• in repair
• awaiting disposal
• disposed
• lost

Agree all of this before anyone imports a single old spreadsheet. Then clean the old sheets. Merge rows that share a serial number, and send any row with a blank holder back to its site for a name. Typed notes in the status column, such as “with Ravi” or “probably at Pune”, move into the right field or come out.

The cleaning is slow work, but it happens once. Left until after the import, it has to be done again in the live register while people are using it.

Step 3: Name One Owner and Give Each Team Its Part

Name one person who answers for the register as a whole. That person settles disputes between sources, approves any change to the fields and signs off each scheduled comparison in Step 8.

Then give each team the one part it feeds:

• Purchasing adds the order, the serial number and the purchase date when a delivery arrives.
• IT sets the holder and status at each hand-over and updates them after repairs.
• HR tells the owner about each join, move and exit before the date.
• Finance holds the cost center and purchase value. Together with the owner, it also approves write-offs for lost or scrapped devices.

At each branch, someone receives devices and counts the spare store. Step 5 and the last FAQ answer come back to that role.

With these parts on paper, the owner knows whom to ask when a row is wrong. Put the names, with a deputy for each, at the top of the register, where anyone updating a row can see them.

Fill the Register From Records You Already Keep

The register is filled first from records the firm already holds, and then from what is sitting in store rooms. Steps 4 and 5 cover both.

Step 4: Feed It From Device Tools, Discovery and Purchases

Four sources feed the register: purchase records, the device management console, network discovery and the resource lists in each cloud account.

In its advice on drawing asset data from several sources, the UK’s National Cyber Security Centre (NCSC) names three existing sources: configuration management tools, mobile device management systems and procurement records. It says a combination of sources helps build an accurate view. It also suggests discovery tools to help find unknown assets.

Match records across sources on the serial number. The serial is printed on the device, while names and asset tags can be retyped by hand and drift apart.

Set one rule at the start: a device gets its purchase record before the register shows it as ready to hand out. A laptop that reaches a branch with no purchase record goes back to purchasing for one.

Any device that appears in only one source goes to the owner’s list to resolve. A phone in the console with no purchase record is one example, and a laptop seen on the network but missing from the console is another.

For cloud accounts, take the list of running servers and other resources from whatever list or export each account provides. Record them in a separate section, against the account they belong to.

Step 5: Load Spare and Stored Devices With Their State

Count the store rooms at head office and at each branch, including the cupboard where returned laptops wait. For each device, record its state: working, needs repair, wiped and ready, or not yet wiped. The state then decides what happens next.

Have one person at each site sign the count, with the date. Devices that nobody can match to a purchase record go on the owner’s list from Step 4, like any other one-source device.

With spares in the register, a new hire at a branch can also take a laptop from the shelf there, instead of waiting for one to arrive from head office.

Link Daily Changes to the IT Asset Management Process

Once the register is full, daily events either keep it right or let it slide. Steps 6 and 7 tie hand-overs, exits, repairs and moves to the record.

Step 6: Open a Record on Day One and Close It at Exit

When a new hire receives a device, set the holder in the register at the hand-over, with the date, before the person walks away with it. A signed hand-over note, on paper or on screen, goes with the record.

When someone leaves, change the status on the day the device comes back, and clear the holder field. If a branch sends the laptop to head office by courier, record it as in transit with the courier reference. Then change the status again when it arrives.

Moves between teams or sites change the holder, the site and the cost center on the same day. For a long leave, decide in advance whether the device stays with the person or comes back to the store. Then record whichever you choose.

Everything else in an exit, such as removing accounts and checking access, belongs to the full exit routine for staff. This step covers the register entry only.

Step 7: Log Repairs, Swaps, Moves and Disposal

Repairs and swaps change the facts in a row. When a device goes to an outside repair firm, set its status to in repair and note the firm and the date. Also ask the firm to send back the serial of any replacement unit.

A warranty swap gives the holder a new device with a new serial. Close the old row and open a new one, with a note linking the two.

When a device moves between sites, update the site and the team that week, not at the next count.

At retirement, the NCSC guidance asks for data removal and disabled accounts as part of decommissioning. Record the wipe date and who did it. Refresh timing and disposal routes sit with refresh and disposal planning for laptops.

Keep the IT Asset Management Process Current

A register starts to age on the day it goes live. Two habits hold that back: checking the register against device data, and reporting what the check finds. Both keep the IT asset management process running after the first import.

Step 8: Compare the Register With Device Data on a Schedule

Put the comparison dates in the calendar for the year, and name the person who runs each one. On each date, compare the register with the device management console and the latest discovery data.

Every mismatch goes on an exception list, and each entry gets an owner and a date by which it closes. A device seen on the network but missing from the register is one kind of entry. A register row whose device has not appeared for weeks is another.

The NCSC also asks firms to have a plan to validate the asset system, for example by testing that unauthorized devices can be detected. Build that test into the schedule. At one branch, connect a test device and check that the comparison flags it.

How frequently to compare is the firm’s choice; pick dates the checker can keep. In the IT asset management process, this is the step that repeats, and the exception list from one date is the first thing checked on the next.

Step 9: Send Short Reports to the People Who Use Them

Send each reader a short report built for them. Finance gets device counts by site and cost center, with purchase dates for refresh planning. Security gets the devices that appear in discovery but not in device management, as well as any marked lost. Leaders get the number of open exceptions and the age of the oldest one.

Keep each report to one page, and send it on the same day after each comparison. A reader who gets the same layout each time can spot a change at a glance, while a new format each round has to be read from the top.

NIST’s CSF 2.0 inventory outcomes include ID.AM-01 on hardware inventories and ID.AM-08 on life cycle management. A firm that reviews itself against those two outcomes can use these three reports as records for the review.

IT Asset Management Process Roles and Responsibilities

Each step below has a named doer, and you can swap in the names of your own teams. This split is a Signisys suggestion, and no standard sets it. For firms that use NIST CSF 2.0 as their framework, it also gives each inventory outcome a named person.

Five Slips That Leave the Register Out of Date

Check the build against these five before the register goes live:

• Changing the fields after the import. Every row then needs cleaning a second time, and old and new rows disagree in the meantime. Settle the list in Step 2 and hold it for the first year.
• Ownership shared by a committee. Disputes then wait for the next meeting, and nobody signs off the comparison.
• Spares left for later. The store room stays outside the count, and devices in it can go missing from the shelf and the record together. Count the store rooms in the same week as the first import.
• A comparison with no date and no named checker. It slips behind other work, and after a while it stops.
• Devices marked ready before the purchase is recorded. A laptop then goes into use with no purchase date, cost center or warranty record behind it. Branches that buy locally need the same rule as head office.

Outside Help for an IT Asset Management Process

Outside help can suit a firm with sites in several countries, or one whose branches buy devices locally without going through IT. It can also help where more than one device management tool is in use, or where an audit date is close and the register has to be right soon.

Scored checks for an existing register are a separate subject. Choosing a tool for the register is another.

Signisys provides consulting and managed IT services and asset and license management support, so this guide comes from a firm with an interest in the work. For a second view on the build order across your sites, ask for a review of your device register. No charge, with a fixed scope.

IT Asset Management Process FAQ