Control A.5.11Return of assets
Personnel and other interested parties must return all the organisation’s assets in their possession upon change or termination of their employment, contract or agreement.
Simple in principle, and the control that most often turns up incomplete in an audit sample. Assets include the obvious hardware, and also credentials, tokens, access cards, keys, documents, and information held on personally owned equipment where that has been permitted.
The trigger is change as well as termination. An internal move leaves people holding access and equipment for a role they have left, which is how access accumulates and how A.5.18’s review finds rights nobody can justify.
The control depends on the inventory in A.5.9 knowing what was issued. Where issuance is tracked informally, return cannot be verified, and the process closes on an assurance rather than a check. For remote staff and contractors, the practical answer has to be decided in advance rather than improvised at the point somebody leaves.
How to put this in place
When someone leaves or a contract ends, information and access can walk out with them. Handling return as a routine step closes that gap and shows the inventory is being used.
- Add asset return to the leaver and contract-end checklists.
- Generate each person's list of assets from the inventory, so there is something to check against.
- Cover information on personal devices and assets held by suppliers.
- Have HR or the line manager confirm return before the last day.
- Record any unreturned asset and the action taken; see also A.5.18 for access removal.
Evidence an auditor usually looks for: leaver checklists for a sample of leavers matched to the asset inventory, and records for any unreturned assets.
What is in the packs for this
From ISO 27001 Implementation & Certification Readiness. Each one helps with this requirement.
Annex A Control Implementation LibraryExcel
Its row in the Control Library: what it is for, practical steps, what an auditor samples, the usual owner, common mistakes and whether it usually applies.
Statement of Applicability TemplateExcel
Has its own row on the Statement of Applicability sheet, where you record whether it applies, why and how far it is implemented.