Control A.5.11Return of assets

Personnel and other interested parties must return all the organisation’s assets in their possession upon change or termination of their employment, contract or agreement.

Simple in principle, and the control that most often turns up incomplete in an audit sample. Assets include the obvious hardware, and also credentials, tokens, access cards, keys, documents, and information held on personally owned equipment where that has been permitted.

The trigger is change as well as termination. An internal move leaves people holding access and equipment for a role they have left, which is how access accumulates and how A.5.18’s review finds rights nobody can justify.

The control depends on the inventory in A.5.9 knowing what was issued. Where issuance is tracked informally, return cannot be verified, and the process closes on an assurance rather than a check. For remote staff and contractors, the practical answer has to be decided in advance rather than improvised at the point somebody leaves.