Return of Assets

There should be a Return of Assets Policy in place that governs the process in which employees return company owned assets.

Control Type: Administrative

Control Function: Preventive

Description: Organizations must have a process in place to ensure that employees return company-owned assets in a timely and appropriate fashion. A Return of Assets Policy outlines these expectations. The policy may apply to both employee transfer and termination scenarios. The policy must explicitly address any nuances between scenarios.

The policy will not eliminate personnel-related security risks outright, but it will act as a deterrent or reminder. An employee may leave on a bad note and delay returning their company-owned mobile device out of spite. An employee may forget to return their laptop charger and flash drives during the process of moving to a new department. The Return of Assets Policy can help lower the risk of occurrence for these events.

The Return of Assets Policy should address the following points:

• What is an Asset? Definition of an asset as it applies to employees of the organization. Generally, such a policy refers to IT tangible assets issued to employees to perform their job. These may include laptops, chargers, keyboards, mice, docking stations, monitors, external webcams, and removable storage.
• Expectations for the condition of returned assets Assets should be returned in close to perfect condition. They should be free of dirt and debris, with all components functioning properly. If they have been permitted, customizations such as laptop stickers should be removed before return. The policy should also describe the consequences of returning assets in poor condition.
• Pretexts for the return of assets. The most common reasons are termination or departure from the organization. However, many organizations require employees to switch to new devices as part of a role transition or a general refresh cycle.
• Drop-off Procedure This should state the location to drop off the assets at, who the return needs to be confirmed by, and any forms that should be completed. The policy should also specify procedures for the receiving party to follow to confirm the return.
• Deadline for Return. The policy should define the grace period for returning the assets.
• Consequences for Late Return. Common practice is to specify consequences arranged in a hierarchy. This could start with financial penalties for late returns, escalating to law enforcement involvement for refusal to return.
• Roles, Responsibilities, and Procedures for Confirming and Validating Returns. The organization should clearly specify who will handle each step of the return process, from drop off confirmation, to condition validation, to asset rotation and un-assignment.