What evidence do auditors commonly ask for on 5.11 Return of assets?

The leaver and mover procedure with an asset return step and a checklist of assets issued to each person; Signed asset return records reconciled against the asset inventory; Records of information transferred from and securely wiped on personally owned or purchased devices; Knowledge transfer or handover documentation for departing staff holding operationally important knowledge; Evidence of monitoring or technical restrictions on copying data during notice periods; Return records for authentication hardware such as keys, tokens and smartcards.

What is the most common gap auditors find on 5.11?

Asset return is not reconciled against what was issued, so missing items go unnoticed

ISO/IEC 27002:2022 · Organizational controls

`5.11` Return of assets

When their employment, contract or agreement changes or ends, staff and, where relevant, other interested parties are to hand back every organizational asset they hold. Purpose: protect the organization's assets during the change or termination process. Guidance: the change or exit process should formally include recovery of all physical and electronic assets issued to the person, whether the organization owns them or holds them in trust. Where people buy organizational equipment or used their own devices, procedures should make sure relevant information is traced, moved to the organization and securely wiped from the device (7.14). Knowledge held by the person that matters for ongoing operations should be documented and handed over. During the notice period and afterwards the organization should stop people who are leaving from copying relevant information, such as intellectual property, without authorization. The assets to be returned should be identified and documented, and can include user endpoint devices, portable storage, specialist equipment, authentication hardware for systems, sites and archives (keys, tokens, smartcards) and paper copies of information. Other information: information on assets the organization does not own is hard to recover, so its use should be limited through other measures, for instance managing access rights (5.18) or cryptography (8.24).

Source: ISO/IEC 27002:2022, 5.11. The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open ISO/IEC 27002:2022 in the compliance library.

ISO/IEC 27002 is guidance on the Annex A controls; certification is against ISO/IEC 27001. Use this set when your sheet follows the 27002 numbering.

artefacts

held by a system

at each review

hard

to go live

Identity provider / directory

where the evidence lives

teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

Evidence of monitoring or technical restrictions on copying data during notice periods · Identity provider / directory

periodic reviewEvidence produced at each review

Signed asset return records reconciled against the asset inventory · Identity provider / directory
Records of information transferred from and securely wiped on personally owned or purchased devices · Endpoint management (MDM / EDR)
Return records for authentication hardware such as keys, tokens and smartcards · Identity provider / directory

governing documentDocuments that govern the control

The leaver and mover procedure with an asset return step and a checklist of assets issued to each person · Policy repository / GRC workspace
Knowledge transfer or handover documentation for departing staff holding operationally important knowledge · Policy repository / GRC workspace

First move

Mostly documents and reviews. Pull the 1 system-held artefact from your Identity provider / directory on a schedule; put the documents under version control with an owner and review date, and log each review as a dated record with a named reviewer.

Common gaps auditors find

Asset return is not reconciled against what was issued, so missing items go unnoticed
BYOD devices of leavers still hold organizational data
Nothing prevents bulk downloads by staff under notice
Contractors and third-party staff are excluded from the return process

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

5.10 Acceptable use of information and other associated assets · 5.12 Classification of information