IT Asset Management Audit Checklist

SOP-ITAM-001: IT Asset Management (ITAM) Audit Procedure

---

1. Document Control Block

---

2. Executive Summary & Purpose

The purpose of this SOP is to establish a rigorous, repeatable framework for auditing IT infrastructure assets. This audit ensures 100% reconciliation between the physical inventory, the CMDB (Configuration Management Database), and the financial ledger. Failure to adhere to these standards results in compliance gaps, security vulnerabilities, and fiscal inaccuracy.

---

3. Scope & Prerequisites

Scope: All physical hardware (Servers, Laptops, Networking Gear), virtualized instances, and perpetual/SaaS software licenses owned or leased by Template Registry. Prerequisites:

• Tools: RFID/Barcode scanner, physical audit logs, privileged access to the CMDB (e.g., ServiceNow/Device42).
• Software: Network discovery agents (e.g., Lansweeper, Nmap), endpoint management consoles (Intune/JAMF).
• PPE: ESD-safe grounding equipment (if inspecting server internals), appropriate site-access badges.

---

4. Roles & Responsibilities (RACI)

---

5. Step-by-Step Procedure

Phase 1: Pre-Audit Preparation

• Freeze all non-emergency asset movements (Moves/Adds/Changes).
• Export current "Gold Standard" inventory report from the CMDB.
• Notify all site leads of audit window and required physical access.

Phase 2: Physical/Logical Discovery

• Conduct physical wall-to-wall sweep using scanners.
• Run network discovery agents to detect "ghost" devices (unregistered MAC addresses).
• Capture serial numbers, asset tags, and location metadata for every device identified.

Phase 3: Reconciliation & Variance Analysis

• Map discovered assets against the CMDB snapshot.
• Categorize discrepancies: Missing, Unauthorized, or Misclassified.
• Verify license entitlement vs. actual deployment counts.

Phase 4: Remediation & Reporting

• Update CMDB status for all reconciled assets (e.g., 'In Use', 'Retired', 'Missing').
• Initiate decommissioning protocols for EOL (End-of-Life) hardware found in production.
• Generate a final "Audit Variance Report" for the CTO.

---

6. Quality Assurance & Pro-Tips

• Metric Threshold: Variance rate must remain <0.5%. If >0.5%, a full site re-audit is mandatory.
• Pro-Tip 1: Always verify physical asset tags against the system-reported serial number. Software-based discovery often misreports serials on virtualized platforms.
• Pro-Tip 2: Leverage PoE (Power over Ethernet) logs from managed switches as a secondary verification layer for "silent" network devices (IoT/Sensors).
• Common Pitfall: Failing to account for "Shadow IT"—unmanaged hardware brought into the network by end-users.

---

7. Frequently Asked Questions

Q: What is the procedure if a serialized device is found but has no asset tag? A: Immediately assign a new tracking ID, document the serial number, and flag it in the CMDB as "Newly Discovered." Notify Security to perform a malware/vulnerability scan before re-provisioning.

Q: How do we handle hardware that is physically present but not in the CMDB? A: Record the MAC address and location. Research the acquisition/procurement date. If no record exists, move the asset to a quarantine VLAN until ownership is verified or the device is wiped and decommissioned.

---

End of Document. Authorized for use by Template Registry Infrastructure Team.