Many London SMEs can name the laptops and servers their business relies on, yet few hold an accurate list of every device, licence and account that stores company data. The gap becomes visible when a leaver keeps a laptop, when an operating system reaches end of support, or when a client asks where its records are held. IT asset management (ITAM) closes that gap by recording what the business owns, who uses it, how it is secured, and how it is retired. This guide sets out a practical approach for small and medium-sized businesses in London.
Table of Contents
- Quick Takeaways
- Building a Complete Asset Register
- Securing Devices and Data
- Offboarding and Device Recovery
- Retiring Hardware and Data Safely
- Comparing Asset Management Approaches
- Hardware Lifecycle Planning
- Reporting Asset Data for Budget Decisions
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| The asset register underpins every other control | Patching, licence renewals and disposal all depend on knowing which devices exist and who holds them. |
| Record serial numbers, not only device names | Serial numbers support warranty claims, insurance records and theft reports. |
| Assign a named owner to every asset | Each device should have a user or department, reviewed whenever roles change. |
| Agree the offboarding checklist before the next leaver | Equipment return, account disablement and data handover should be completed on the same working day. |
| Track end-of-support dates in the register | Hardware and software past vendor support stop receiving security updates, which increases exposure. |
| Erase or destroy storage before any device leaves your control | Deleting files or reformatting a drive does not reliably remove data, so erasure should be verified and documented. |
Building a Complete Asset Register
An asset register is a single, current record of hardware, software licences, cloud subscriptions and the accounts that access them. In practice, registers fail when they exist in several places, such as a finance spreadsheet, a supplier portal and one administrator’s memory. One authoritative list, updated at each purchase, move and disposal, prevents that drift.
The National Archives guidance on identifying information assets notes that recording information in a spreadsheet may be viable for a smaller number of assets with limited resources. For most London SMEs this is a sensible starting point, provided the fields are fixed and the file has a named owner. The minimum useful fields are asset type, make and model, serial number, purchase date, warranty end date, assigned user, location and status.
Fields That Matter in Practice
Serial numbers and asset tags are the fields most often missing. Without them, a warranty claim or a theft report takes longer to prepare, and insurers may request proof of ownership. Purchase invoices should be linked to each record so that the cost is available at disposal.
When a Spreadsheet Stops Being Enough
A spreadsheet becomes unreliable once staff work across several sites, equipment is bought from multiple suppliers, or devices operate outside the office network. At that point, dedicated asset software or a managed service with asset reporting is more appropriate. Asset ownership should remain with a named person in either case.
Pro tip: Reconcile the register each quarter against directory accounts and device management reports. Differences usually reveal unrecorded equipment or accounts that should have been disabled.
Securing Devices and Data
Every recorded asset should meet a baseline standard before it is issued. For most London SMEs, that means full disk encryption, automatic updates, a supported operating system and multi-factor authentication on the accounts used to sign in. Devices that do not meet the baseline should not access company email or files.
The NCSC asset management guidance states that asset management can help organisations identify when systems will reach end of support and plan ahead. Treating end-of-support dates as scheduled events keeps security updates flowing and avoids unplanned spending.
Baseline Controls for Each Device
Set the baseline in your device management tool so that compliance is checked automatically. A device that falls out of compliance should be flagged against its register entry, not discovered during an annual review. Record the date each control was last verified.
Managing Personal and Unmanaged Devices
Staff often read email on personal phones or home computers. A written policy should state which devices may access company data, which controls apply, and what happens if a device is lost. Where personal devices are permitted, access should be limited to approved applications, and those devices should appear in the register.
Offboarding and Device Recovery
Offboarding is where most asset losses occur. A leaver may keep a laptop, a monitor or a mobile phone, and an active account may remain open for weeks. A documented checklist covering equipment return, account disablement, mailbox handling and licence reassignment closes these gaps.
Ownership of the process should be explicit. In many SMEs, IT, HR and the line manager each hold part of the task, and gaps appear where no one is named. IT should confirm device return and account removal, HR should trigger the process, and the line manager should confirm handover of work files.
Sequencing the Leaver Process
Disable sign-in access at the agreed time rather than after the final day. Retrieve devices on the last working day where possible, and record each return against the register. If a device is not returned, the register should show the open item and the escalation date.
Pro tip: Book equipment collection in advance, before the leaver’s notice period ends. This avoids devices being kept at home for weeks after the final day.
Handling Mailboxes and Shared Data
Email and files should be transferred to a manager or retained under the company’s retention policy before the account is removed. Licences released by a leaver should be reassigned or cancelled, so that cost records remain accurate.
Retiring Hardware and Data Safely
Retirement is the final stage of the asset lifecycle and the one most often rushed. Equipment is stored in cupboards, passed to staff or sold without a record, and data remains on drives. A retirement procedure should require a status change in the register before any device leaves the premises.
Data erasure must be completed and recorded before disposal or resale. Physical destruction of storage media is the more reliable choice when drives are damaged or hold sensitive information. Certificates of erasure or destruction should be kept with the asset record.
Choosing a Disposal Route
Options include certified resale, recycling through a licensed electronics recycler, and donation. Each route requires a documented chain of custody. Request written confirmation of collection, processing and final disposal from the collector.
Recording Disposal for Accounting and Audit
Remove disposed assets from the register, record the disposal date and method, and update the fixed asset schedule with your accountant. This keeps depreciation figures accurate and provides evidence if an audit or insurance claim requires it.
Comparing Asset Management Approaches
Three approaches cover most London SMEs. The right choice depends on device numbers, the number of sites, and how much time the business owner or office manager can give to IT administration. The table below compares them on the criteria that usually decide the outcome.
| Approach | Best suited to | Main limitation |
|---|---|---|
| Spreadsheet register maintained in-house | Single-site businesses with a small device count and stable staffing | Depends on manual updates, and gaps appear quickly without regular reconciliation |
| Dedicated asset management software | Multi-site businesses with complex licensing and an internal IT lead | Requires configuration, training and ongoing administration |
| Managed IT service with asset reporting | Businesses without in-house IT staff that want monitoring, offboarding and reporting handled together | Responsibilities must be written into the service agreement to be enforced |
An asset register is only as reliable as the process that keeps it current, so discipline matters more than the choice of tool.
iTO.London operates as an outsourced IT department for London SMEs, maintaining the register, monitoring device compliance and running offboarding and disposal steps as part of its managed IT services. Businesses that prefer to keep these tasks in-house can apply the same controls using the approaches above.
Hardware Lifecycle Planning
A hardware lifecycle plan sets an expected service life for each device category and schedules replacement before failure or loss of vendor support. For most offices, laptops and mobile devices follow a fixed refresh cycle, while network equipment and servers are reviewed against vendor support dates. The plan should be reviewed alongside the annual budget.
Setting Replacement Triggers
Replacement should be triggered by a combination of age, warranty status, support end date and repair history. A device that has needed repeated repairs within its warranty period should be flagged for early replacement, even if it is not yet due.
Planning Budgets Around Refresh Cycles
Spreading replacements across financial years avoids a single large capital cost. Recording purchase dates and expected service life in the register makes forecasting straightforward and gives directors a clear basis for approval.
Reporting Asset Data for Budget Decisions
An asset register becomes more useful when it informs spending. A short quarterly report showing device age, warranty expiry, outstanding returns and devices past end of support gives directors a basis for approving replacements. The report should use the same fields as the register so that figures reconcile.
Keep the report consistent from quarter to quarter. Three to five measures are usually enough, such as active devices by category, devices out of support, open offboarding items and disposals completed. Trends across periods matter more than any single figure.
Frequently Asked Questions
How often should an SME review its IT asset register?
A full reconciliation each quarter is a practical minimum for most London SMEs, with updates recorded at every purchase, move and departure. Businesses with high staff turnover may benefit from monthly checks.
Do I need specialist software to manage IT assets?
No. A well-maintained spreadsheet can serve a small office with a limited number of devices. Dedicated software becomes worthwhile when the business runs several sites, complex licences or devices outside the office network.
What should an asset record contain?
At minimum, record the asset type, make and model, serial number, purchase date, warranty end date, assigned user, location and status. Link purchase invoices where possible so that cost information is available at disposal.
How should a business dispose of old laptops that held client data?
Erase storage using a verified method and keep a record of the erasure. Where drives are damaged or the data is sensitive, physical destruction is more reliable. Obtain written confirmation from the collector.
Who should be responsible for IT asset management in a small business?
Responsibility should sit with a named individual, such as the IT lead, office manager or an outsourced IT provider. HR and line managers should support the offboarding steps. The essential requirement is that one person owns the register and its review.
We would welcome your experience of asset tracking or offboarding in your own business, so please share which step has proved hardest to maintain.
We would love your feedback and any insights you would share with others. What perspective would you add?