The IT Asset Audit Checklist for SOC 2 and ISO 27001 Evidence

Auditors rarely start with your firewall. They start with a list of laptops and a simple question: show me what happened to these devices over the last twelve months. If the list is incomplete, the leaver’s laptop has no wipe record, or the MDM count and the inventory count disagree, the rest of the audit gets slower and more skeptical.

This checklist is built for IT and security teams preparing SOC 2 or ISO 27001 evidence for physical and endpoint assets. It covers what auditors test, which controls apply, a step-by-step audit you can run internally, the evidence to save for each step and the findings that come up most often.

Key Takeaways

• Auditors test three things: that you know every asset, that each one is controlled, and that you can prove what happened to it.
• SOC 2 Type II and ISO 27001 surveillance audits look at a period, so records must be continuous, not a snapshot taken the week before.
• The most common gaps are mismatched inventory and MDM counts, leaver devices without return or wipe records, and unowned assets.
• Save evidence as you work. Rebuilding it later is slow and rarely complete.
• Confirm control mappings with your auditor, because firms interpret some criteria differently.

What auditors test in an IT asset audit

An IT asset audit for compliance is not a physical count for its own sake. It checks whether your controls over devices work in practice, and it does that by sampling. An auditor picks devices, people and events from your records and asks you to show the trail for each one.

Three questions sit behind nearly every request:

• Completeness: is the inventory a full and current list of in-scope assets? Auditors often compare it with another source, such as the MDM, the identity provider or purchase records, and ask about any gap.
• Control: is each asset assigned, configured to policy and monitored? Encryption, patching, screen lock and endpoint protection are the usual checks.
• Lifecycle: can you reconstruct what happened from purchase to disposal? That covers who held the device, when it was returned, how data was erased and where it went.

The period matters. A SOC 2 Type I report looks at design at a point in time. A Type II report, and ISO 27001 surveillance and recertification audits, test whether controls operated across a stretch of months. A tidy spreadsheet built the week before the audit proves very little for either. Auditors reconstruct what happened across the whole window, which is why continuous records beat a one-off clean-up.

Which SOC 2 and ISO 27001 controls cover IT assets

SOC 2 is organized around the Trust Services Criteria, and ISO 27001:2022 around Annex A controls selected through your risk assessment and Statement of Applicability. Neither is a literal device checklist, so mapping is interpretive. Use the table as a working guide and confirm it with your auditor.

“`

A few notes on reading it. SOC 2 CC6.5 addresses discontinuing logical and physical protections over assets once they are no longer needed, which is why wipe and destruction evidence lands there. Sources differ on how CC6.7, which concerns restricting the movement and removal of information, applies to devices. Annex A is a reference set, so only the controls your Statement of Applicability marks as relevant will be tested. Finally, ISO 27001 requires documented information and review of how controls perform, so a policy without records will not carry you through an audit.

Before you start: scope, owners and audit window

Settle five things before you inspect a single device. Skipping them is the usual reason internal audits turn into arguments.

1. Define the asset scope. List what counts: company laptops, desktops, phones, tablets, servers, network gear, removable media, security keys and any personal devices that touch company data. Decide how contractors and loaner devices are treated.
2. Name an owner for each control. One person is accountable for the inventory, one for endpoint configuration, one for offboarding and one for disposal. Auditors will ask who, and “IT” is not an answer.
3. Fix the audit window. Match your SOC 2 observation period or ISO 27001 audit cycle, so you test the same dates the auditor will.
4. Choose your reference sources. Decide which systems are authoritative: inventory, MDM, identity provider, HR system and purchase records. You will reconcile between them.
5. Set up the evidence folder. Use a consistent structure by control and month, with file names that include dates and serial numbers, so retrieval takes minutes. A clear device lifecycle policy gives every later step something to be tested against.

The IT asset audit checklist

Run the eight checks below in order. Each lists what to verify and the evidence to keep.

1. Inventory completeness

The inventory is the foundation. Everything else is tested against it, and it is the first thing a sampling auditor opens.

Verify:

• Every in-scope device appears once, with serial number, model, purchase date, status and location.
• The inventory reconciles with the MDM, the identity provider’s device list and purchase or invoice records. If the MDM shows 283 enrolled devices and the inventory shows 247, you need a written explanation for the 36 before the auditor finds the gap.
• Devices in storage, in transit and awaiting disposal are tracked, not just those in use.
• No ghost assets: records for devices that were sold, lost or retired, and no unrecorded devices in the field.
• New devices are added at receipt, not weeks later.

Evidence: inventory export with a date, reconciliation report across sources with exceptions explained, and purchase-to-inventory match for a sample of orders.

A single IT asset tracking record per device, updated by the events that change it, is far easier to defend than one reassembled from three spreadsheets. This is where a platform such as ZenAdmin earns its place for a compliance-focused team: its inventory management ties each device to a person, a location and a status, so the list auditors sample is the same list your team works from.

2. Ownership and assignment

An asset nobody owns is an asset nobody secures.

Verify:

• Each device is assigned to a named, active employee or a named team for shared equipment.
• Assignments match HR records, so devices are not held by people who have left.
• Reassignments are logged with date and approver.
• Employees have acknowledged the acceptable use policy when they received the device, which supports ISO 27001 control 5.10.

Evidence: assignment history for a sample of devices, signed or recorded acknowledgments, and an HR-to-inventory reconciliation showing no active devices assigned to leavers.

3. Configuration and endpoint security baseline

This is where “controlled” is proved. Auditors want to see that the policy you wrote is actually enforced on devices.

Verify:

• Full-disk encryption is enabled on every laptop and phone, and the recovery key is escrowed.
• Screen lock, password or biometric requirements and OS update policies are enforced centrally.
• Endpoint protection is installed and reporting.
• Patch status is current, with exceptions documented and time-boxed.
• Devices are enrolled in management at provisioning, not left until someone remembers. The differences between MDM, UEM and EMM affect what you can enforce and report.
• Non-compliant devices are flagged and remediated, or blocked from company resources.

Evidence: MDM compliance report for the whole fleet, encryption status export, patch report, and records of remediation for non-compliant devices. Screenshots of a settings page prove less than a dated export.

Remote workforces make this harder, because the device is rarely where IT can see it. Our guide to endpoint management for remote teams covers how to enforce baselines at distance.

4. Access and identity linkage

Devices and accounts are two halves of the same control. Auditors test both in one trail: when someone leaves, are their device and their access dealt with on time?

Verify:

• New devices are provisioned at the same time as access, and access is role-based.
• Device certificates, VPN profiles and tokens are tied to the device and revoked when it is retired.
• Joiner, mover and leaver events trigger device and access actions, and the timing meets your policy.
• Access reviews include which devices are authorized to reach sensitive systems. Tools for user access reviews can produce the sign-off evidence.

Evidence: joiner and leaver tickets or workflow logs with timestamps for a sample, access review records, and revocation logs for certificates and tokens.

5. Software and SaaS assets

SOC 2 and ISO 27001 both treat information assets broadly, and auditors increasingly ask about software licenses and SaaS accounts alongside hardware.

Verify:

• A list of approved applications and an owner for each.
• Software installed on endpoints matches policy, and unapproved tools are detected.
• SaaS accounts are tied to active employees and removed on exit.
• Shadow IT is discovered and either approved or retired. The risks of unmanaged SaaS show up in audits as ownerless accounts and untracked data stores.

Evidence: application inventory with owners, license and account reconciliation against the HR roster, and records of shadow IT reviews and decisions.

6. Remote, off-premises and personal devices

If your team works from home or abroad, auditors will test the controls that make that safe.

Verify:

• A policy states which devices may access company data and under what conditions.
• Company-owned laptops used off-site meet the same baseline as office devices.
• Personal devices, if allowed, are enrolled in a managed profile that separates and can wipe company data.
• Lost or stolen device procedures exist, and incidents were reported and handled within policy time.
• Devices that cross borders are tracked for location and custody.

Evidence: remote work and BYOD policies, MDM profile configuration, lost device incident tickets with remote lock or wipe confirmation, and shipping or custody records for devices sent to employees. The wider picture is covered in IT security for remote teams.

7. Return, retrieval and offboarding

This step produces more findings than any other, because it depends on people outside IT.

Verify:

• A return process starts automatically when an exit is confirmed.
• Returns are tracked from request to receipt, with a deadline and escalation for devices that do not come back.
• Received devices are logged, inspected and moved to a defined status.
• Devices that are never returned are locked, wiped if possible, escalated and recorded as lost with the date and reason.
• Offboarding steps for access and devices are completed in the order and timeframe your policy sets.

Evidence: offboarding checklists completed for a sample of leavers, courier or receipt confirmations, lock or wipe logs for unreturned devices, and the HR exit date matched to the access removal and device return dates. Our IT offboarding checklist and the guide to device offboarding compliance risks go deeper on this stage.

8. Secure wipe, disposal and governance

The last check closes the lifecycle and tests the governance wrapped around it. It maps to SOC 2 CC6.5 and ISO 27001 controls 7.14 and 8.10.

Verify:

• Every retired device has a recorded wipe or destruction outcome, matched to its serial number.
• The method follows a recognized standard. NIST SP 800-88 Rev. 2 is the common reference, and cryptographic erase is widely used for encrypted SSDs.
• Third-party recyclers or resellers provide itemized certificates, and the serial numbers on them match your records.
• Chain of custody is documented from collection to final handover.
• Reuse is allowed only after a verified wipe and re-enrollment.
• The inventory status moves to “disposed” with a date, and the device record is retired, along with any certificates.
• Governance basics are in place: a current asset policy, a risk assessment that includes devices, an annual review of the process, and documented exceptions with an owner and an end date.

Evidence: wipe reports or certificates per device, certificates of destruction or recycling, chain-of-custody manifest, inventory status change log, and the policy review record. Reconcile the count of devices retired against the count of certificates, since a mismatch is a classic finding. Retirement practices are laid out in our guide to IT asset retrieval and decommissioning.

The evidence pack

Auditors ask for the same artifacts again and again. Prepare them as a standing pack, not a scramble.

Control area	Artifact	Source	Refresh
Inventory	Dated inventory export and cross-source reconciliation	Inventory, MDM, identity provider, purchasing	Monthly
Ownership	Assignment history and policy acknowledgments	Inventory, HR system	On change Reviewed quarterly
Endpoint baseline	Encryption, patch and protection compliance report	MDM, endpoint tools	Monthly
Access linkage	Joiner and leaver logs, access review sign-offs	Identity provider, ticketing	Quarterly Review
Software and SaaS	Application list with owners, license reconciliation	SaaS management, MDM	Quarterly
Remote devices	Remote work policy, lost device tickets and lock logs	Policy library, MDM, ticketing	On event
Offboarding	Completed checklists, return confirmations	Ticketing, courier records	Per leaver
Disposal	Wipe reports, destruction certificates, custody manifest	Wipe tool, recycler, inventory	Per disposal
Governance	Policy, risk assessment, review minutes, exceptions log	Policy library, GRC tool	Annually

“`

Two habits make the pack credible. Store each artifact with the date it was generated, because an undated screenshot is easy to challenge. And keep the sampling trail: when an auditor picks a serial number, you should be able to produce its purchase record, assignment history, compliance status and disposal certificate within minutes.

How auditors sample your devices

Understanding sampling helps you test yourself the way they will. For a Type II period, an auditor typically asks for the full population, such as every device purchased, assigned, returned or retired in the window, then picks a sample from it. Larger populations get larger samples.

For each sampled device, expect to be asked for the same trail:

• Purchase or receipt record, with the serial number.
• Assignment history, showing who held it and when.
• Compliance status at points during the period, such as encryption and patching.
• For leavers, the exit date, return confirmation and access removal date.
• For retired devices, the wipe or destruction certificate and the inventory status change.

The population is the weak point. If you hand over a list that omits devices, the sample is drawn from the wrong set and the finding is about completeness, not about any one laptop. That is why reconciliation in step one comes first.

Common audit findings and how to avoid them

1. Inventory and MDM counts do not match.

Fix: reconcile monthly and document every exception with a reason and a resolution date.

2. Leaver devices without return or wipe records.

Fix: tie the return process to the HR exit event, track it to receipt and escalate overdue returns on a schedule.

3. Wipe done, evidence missing.

Fix: make the certificate or report a required field before a device can move to “disposed”.

4. Unowned or shared devices.

Fix: assign every device to a person or team, and review unassigned assets each quarter.

5. Encryption or patch exceptions with no end date.

Fix: log each exception with an owner, a reason and an expiry, and review the list monthly.

6. Policy and practice differ.

Fix: write procedures you actually follow. If the policy says devices are returned in five days and the average is twenty, change one or the other.

The theme running through all six is that auditors test consistency. A small, well-documented process that runs every time beats an elaborate one that works only when someone remembers.

How to keep audit evidence continuously

A compliance audit of devices becomes painful when evidence is collected only for the auditor. The alternative is to generate it as a by-product of normal operations.

Four practices make that practical:

• Let events create records. A purchase creates an asset, an assignment creates a custody entry, a return updates status, a wipe attaches a certificate. Nobody types it in afterward.
• Review on a calendar. Monthly reconciliation, quarterly access and software review, annual policy and risk review. Record each review with a date and a name.
• Use one source of truth. The more places device facts live, the more reconciliation work you inherit. Consolidating inventory, enrollment, offboarding and disposal into one workflow removes most of it. ZenAdmin’s IT asset disposal and lifecycle records work this way, keeping erasure certificates attached to the device history so the audit trail is already assembled when requested.
• Test yourself first. Run a mock sample every quarter: pick ten devices at random and produce their full trail. Whatever you cannot produce in ten minutes is your gap list.

For a view across the full device journey, the broader guide to IT asset lifecycle management shows where each of these records originates.

Conclusion

A good IT asset audit comes down to a short list of questions asked in a fixed order: is the inventory complete, is each device owned and configured, is access tied to the device, are returns and offboarding tracked, and can you prove that every retired device was wiped. If the answers produce dated evidence, SOC 2 and ISO 27001 auditors have little to dig into.

Start with the reconciliation in step one, because it exposes the gaps that every later check inherits. Then run the mock sample above, fix what it finds and repeat each quarter. By audit time, the evidence pack is already built.

Frequently Asked Questions

What is an IT asset audit for SOC 2?

It is a review of how you inventory, configure, assign, retrieve and dispose of devices and other assets, with evidence that the controls operated during the audit period. Auditors sample devices and ask you to show each one’s trail, mainly under the common criteria on logical access and the discontinuation of protections.

Which ISO 27001 controls cover IT assets?

The main ones are 5.9 (inventory of information and associated assets), 5.10 (acceptable use), 5.11 (return of assets), 7.9 (security of assets off-premises), 7.10 (storage media), 7.14 (secure disposal or re-use of equipment), 8.1 (user endpoint devices) and 8.10 (information deletion). Which ones apply depends on your Statement of Applicability.

What evidence do auditors want for device disposal?

A wipe report or certificate per device, a certificate of destruction or recycling listing serial numbers, a chain-of-custody record and an inventory entry showing the device as disposed with a date. Auditors compare the number of retired devices with the number of certificates, so reconcile them first.

How often should we reconcile the asset inventory?

Monthly is a sound default, with a lighter weekly check for high-turnover teams. Reconcile against the MDM, the identity provider and purchase records, and document each exception with an owner and a resolution date.

Do personal devices need to be in the asset inventory?

If they access company data, yes, at least as enrolled or registered endpoints. Auditors will ask how personal devices are controlled, so keep the policy, the managed profile configuration and the list of enrolled devices.

Is a spreadsheet enough for SOC 2 asset evidence?

It can be, for a small fleet, if it is accurate, dated and reconciled regularly. As headcount and countries grow, spreadsheets struggle with change history and custody, which Type II audits depend on. A system that records events as they happen is easier to defend.