What evidence do auditors ask for on A.5.11 Return of assets?

Signed asset return checklist; Manager sign‑off sheet; Returned equipment receipt; IT asset return form; Exit interview minutes; Employee acknowledgment of asset return.

What is the most common gap auditors find on A.5.11?

Missing signatures on return forms

ISO/IEC 27001:2022 · Organizational controls

`A.5.11` Return of assets

Recover all organizational assets on exit or role change.

artefacts

held by a system

at each review

moderate

to go live

SIEM / log platform

where the evidence lives

teal = a system already holds it · olive = produced at each review

system holds itEvidence a system already holds

System asset tracking log showing status change · SIEM / log platform
Change management ticket for asset status update · Ticketing / ITSM
Audit trail of inventory adjustment · SIEM / log platform
Disposal certificate · Data governance / DLP tooling

periodic reviewEvidence produced at each review

Signed asset return checklist · Document repository
Exit interview minutes · Policy repository / GRC workspace

governing documentDocuments that govern the control

Manager sign‑off sheet · Document repository
Returned equipment receipt · Document repository
IT asset return form · Document repository
Employee acknowledgment of asset return · HR system / LMS
HR exit questionnaire · HR system / LMS
Termination letter referencing assets · HR system / LMS
Updated asset register entry · Policy repository / GRC workspace
Decommission request form · Policy repository / GRC workspace
Approval email from asset owner · Document repository
Data sanitization report · Policy repository / GRC workspace

First move

Start with the 4 of 16 artefacts that already live in a system (SIEM / log platform); keep the periodic reviews but log each one as a dated record with a named reviewer.

Common gaps auditors find

Missing signatures on return forms
Failure to update inventory promptly
Inconsistent handling of data‑bearing devices
No documented approval for asset disposal

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

A.5.10 Acceptable use of information and other associated assets · A.5.12 Classification of information