ISO 27001 A.5.11: Recover Assets When Roles or Contracts Change
An exit process can collect the laptop and still leave important information or equipment outside the organisation’s control. ISO 27001 control A.5.11 addresses returning organisational assets when employment, contracts or agreements change or end. The practical task is to establish what should come back, who receives it and how gaps are resolved.
What A.5.11 requires in practice
Annex A control A.5.11 asks that personnel, and other interested parties where appropriate, return all of the organisation’s assets in their possession when their employment, contract or agreement changes or ends. The word all is deliberate: it reaches beyond laptops and phones to items such as access cards, tokens, documents, storage media and, in some cases, information held on personal equipment.
The trigger is any change, not only departure. Someone moving to a different role, a contractor finishing a project or a supplier ending an agreement may all hold assets they no longer need. Interested parties as appropriate means the principle extends to suppliers and partners, to the degree their arrangement involved the organisation’s assets.
The control does not describe the form of the process, a checklist or who must sign. It relies on the asset inventory and on clear agreements. The expected result is that nothing of value stays with someone who should no longer have it, and that the organisation can show it checked.
Determine the expected return before the last working day
Use the asset inventory, issue records and actual role knowledge to establish the expected handover. Include relevant information and non-obvious physical items, such as equipment held at a client site or documents retained away from the office. A standard laptop-and-badge list may not cover the person’s real responsibilities.
Role changes matter as well as departures. Someone moving between client operations may need to return or transfer assets associated with the former role while remaining employed. Define what the new role genuinely requires rather than allowing every previously issued item and information copy to remain by default.
Coordinate collection with information continuity
Identify who needs the business information and operational knowledge before the current holder loses access. Preserve necessary records through an authorised process and arrange a usable handover. Copying an entire personal workspace without assessing content may create avoidable privacy or information-management problems.
Where information sits on an approved personal device or a third-party service, use the agreed arrangements to recover or transfer relevant material and address remaining copies. Do not assume the organisation owns the device or can inspect it without limits. Escalate uncertain rights or technical constraints through competent internal and specialist channels.
Keep return, access removal and continuing duties distinct
Physical possession does not establish whether access has ended. A returned token may still have associated accounts or sessions, while a remotely disabled account does not recover a printed file. Coordinate return with access-rights management, using evidence appropriate to each activity.
Confidentiality and other duties may continue after the handover. Communicate those through responsibilities after termination or change. A signed return statement should describe what was reconciled; it should not be treated as proof that every possible copy has disappeared or every ongoing obligation has been fulfilled.
Why getting assets back matters to the business
Unreturned devices, keys and data are a direct route to loss of information, cost and embarrassment. A leaver with a company laptop or a copy of customer records is an obvious risk, and so is a contractor whose arrangement ended but whose access cards still work.
A reliable return routine also protects people. It records what was handed back, avoids later disputes about missing equipment and treats departures consistently. Customers who entrust data to a business expect it to know where its assets are. Sound handling at the end of a relationship is one of the simplest ways to show that expectation is met.
How to implement A.5.11
Make return part of the same handover that already happens when roles change or contracts close, and tie it to your asset inventory. Plan for departures that happen suddenly, because the least convenient cases are the ones that reveal gaps.
- Use the inventory to see which assets are assigned to each person, supplier or contractor.
- State the return expectation in employment terms, contracts and supplier agreements, so it is known in advance.
- Add return to the checklist that leavers, movers and finishing contractors already go through, owned by a named function.
- Cover less obvious items such as tokens, keys, paper files, removable media and information on personal equipment.
- Decide how information on personal devices will be dealt with when business use ends, and confirm it was done.
- Record what was returned, by whom and when, and follow up on anything missing.
- Coordinate with access removal, so retrieving assets and ending access happen together.
Evidence an auditor expects for A.5.11
Auditors usually follow a few real departures or role changes from start to finish. Useful evidence includes: Auditors also look at what happens when an asset cannot be recovered, since that reveals how seriously the risk is treated.
- records of assets returned by leavers, movers and contractors, matched to the inventory;
- examples of follow-up when an item was not returned;
- contract or agreement wording that sets out the return expectation;
- interviews with HR, IT and line managers about how the handover works;
- confirmation that access was ended at the same time as assets were recovered.
- evidence that unreturned or lost items led to access removal or a risk decision.
Common nonconformities with A.5.11
Findings tend to cluster around groups the routine does not reach, or around items nobody thinks of.
- Leavers are covered, but contractors and supplier staff are not asked to return anything.
- Items such as access cards, tokens or removable media are missing from the handover record.
- Staff changing roles keep equipment and information that no longer relates to their work.
- Missing assets are noted, but nobody follows up or assesses the risk.
- The process relies on managers remembering and has no consistent trigger from HR or procurement.
Illustrative software example: an external developer leaves
A hypothetical software supplier ends a developer’s contract. The developer returns company equipment, but a project review identifies a separate test device and an unfinished technical handover. The contract owner coordinates the additional return and assigns a permanent owner to the relevant project information.
IT independently confirms removal of the developer’s access through the established process. The company records the expected items, what arrived and how the outstanding device was resolved. It avoids closing the whole exit simply because the first equipment delivery was received.
Illustrative manufacturing example: a field engineer transfers
A hypothetical manufacturer transfers a field engineer to a new regional role. The engineer holds a service laptop, specialised diagnostic equipment and customer maintenance records associated with the former territory. Management identifies which assets need returning and which can be formally reassigned.
The receiving team checks the equipment and obtains the operational information needed to support existing customers. Any data-retention or deletion decision follows the relevant requirements and authority. The example shows a controlled change of responsibility, rather than assuming that an internal transfer creates no security handover.
Close discrepancies with an owner and a decision
For remote returns, choose suitable packaging, transport and receipt arrangements according to the asset and risk. Establish when responsibility transfers and what happens if an item is delayed, damaged or missing. A courier tracking result may show delivery without confirming that the expected device or storage medium was inside.
Reconcile actual receipt with the expected inventory and record unresolved items. Assess whether a missing item creates an information security event requiring further action. Operational urgency or a payroll deadline should not silently convert “not received” into “returned”. Where equipment is transferred to personal ownership, handle information and software appropriately before release.
A.5.11 does not prescribe a specific clearance form. Useful evidence includes issue records, handover decisions, receipt and reconciliation, reassignment and actions on discrepancies. Common failures include no owner for remote collection, access closure mistaken for asset recovery and deleting necessary business information while preparing equipment for reuse.
Frequently asked questions
Does the control apply to internal transfers?
Yes, changes can require return or reassignment of assets. Review what belongs to the previous role and what is needed for the new one instead of relying solely on employment status.
Is a courier receipt enough to close an equipment return?
It provides delivery evidence. Check that the expected asset was received and record any discrepancy or condition requiring action. Match the verification to the asset’s significance.
What if an asset cannot be recovered promptly?
Assign responsibility, assess the security exposure and act through the appropriate process. Record the unresolved position and decision. Do not mark the return complete simply because a request was sent.
Make departures and transfers easier to control
Request a consultation on asset-return and handover gaps. Sterling can align responsibilities, documentation and scoped Effivity ISO & GRC automation software with employee learning. Review Information Security Essentials for staff handling information and equipment. An agreed wider programme can add authorised scanning and findings review and continuing certification preparation; an independent body decides certification. Return to organisational controls.