IT asset and configuration management audit program.
How to audit whether hardware, software, cloud resources and information assets are recorded completely, assigned to owners and kept current together with their dependencies.
Last updated: 13 October 2026 · Sample, not legal advice
Download the sample as PDF 8 pages, no sign-up
Download as Excel template with columns for result and notes, no sign-up
Audit objective
The audit assesses whether the organisation keeps a complete and current inventory of its information assets and IT components, assigns an owner to each asset and documents criticality, configuration and dependencies in a traceable way. It also assesses whether inventory and configuration management are linked to the change process and whether retired devices are wiped securely.
Scope
- Servers, clients, network components, mobile devices, software and cloud resources of the organisation
- Inventory and configuration management database (CMDB), including the processes for maintenance and reconciliation
- Disposal, return and re-use of devices and storage media
- Out of scope: fixed asset accounting, unless it serves as a source for the inventory
Audit program
| No. | Criterion | Reference | Audit procedure | Expected evidence |
|---|---|---|---|---|
| 1 | A policy defines which assets are to be inventoried, who maintains the inventory and how often it is reviewed. | ISO/IEC 27001:2022 Annex A 5.9; NIS2 Directive Art. 21(2)(i) | Read the policy, establish approval and currency, and compare the defined asset classes with actual practice. | Asset management policy with approval note, role description |
| 2 | The inventory is complete and also covers devices at remote sites, mobile devices, network resources and cloud resources. | ISO/IEC 27001:2022 Annex A 5.9; DORA Art. 8(4) | Sample in both directions: find ten devices on site in the inventory and have ten inventory entries evidenced physically or technically. | Inventory extract, reconciliation record of the sample |
| 3 | Each asset has an accountable owner who knows its protection needs and use. | ISO/IEC 27001:2022 Annex A 5.9 | For the sample, check that an owner is recorded and ask three owners about their role. | Inventory extract with owner field, interview notes |
| 4 | Assets are classified by criticality and protection needs; critical assets are flagged. | ISO/IEC 27001:2022 Annex A 5.12; DORA Art. 8(1) and (4) | Review the classification scheme and trace for five assets whether the classification is justified and current. | Classification scheme, protection needs assessment, inventory extract |
| 5 | Configurations and dependencies between systems, services and business processes are mapped in configuration management. | ISO/IEC 27001:2022 Annex A 8.9; DORA Art. 8(4) | For one essential business process, trace the dependency chain in the CMDB and confirm it with operations. | CMDB extract with relationships, architecture overview |
| 6 | Inventory and configuration management are updated promptly after changes and reviewed regularly. | DORA Art. 8(6); ISO/IEC 27001:2022 Annex A 8.32 | Select five completed changes and check whether the CMDB shows the new state; review evidence of the last review. | Change tickets, CMDB change history, review record |
| 7 | Unknown devices on the network are detected automatically, reconciled with the inventory and resolved. | BSI NET.3.4 | Have the network discovery explained and check the deviation list of the last three months for follow-up. | Discovery tool reports, deviation list with resolution notes |
| 8 | Documented security configurations exist for each system class, and compliance with them is monitored. | ISO/IEC 27001:2022 Annex A 8.9 | Read the configuration baselines for two system classes and analyse reports on deviations from the baseline. | Configuration baselines, compliance reports from configuration monitoring |
| 9 | Rules for acceptable use are known, and assets are returned on leaving or changing role. | ISO/IEC 27001:2022 Annex A 5.10 and 5.11 | For five leavers in the last six months, trace the return of the assigned devices. | Acceptable use policy, leaver checklists, return records |
| 10 | Retired devices and storage media are demonstrably wiped or destroyed before disposal or re-use. | ISO/IEC 27001:2022 Annex A 7.14 and 8.10; BSI CON.6 | Review the disposal process and request wiping or destruction evidence for five retired devices. | Disposal list, wiping logs, destruction certificates from the service provider |
| 11 | Dependencies on ICT third-party providers are recorded, especially for critical or important functions. | DORA Art. 8(5) | Check whether the CMDB or the provider register shows which assets depend on which provider. | Provider register, links between services and providers in the CMDB |
| 12 | Legacy systems are flagged as such, and their risks are assessed regularly. | DORA Art. 8(7) | Request the list of legacy systems and review the last risk assessment and the planned measures. | List of legacy systems, risk assessment, replacement plan |
Documents to request
- Asset and configuration management policy
- Current inventory extract with owner and classification
- Classification scheme and protection needs assessment
- CMDB extract with relationships for one essential business process
- Network discovery reports and deviation list
- Configuration baselines per system class
- Disposal list with wiping and destruction evidence
- List of legacy systems with risk assessment
Typical findings
- Several inventories are kept in parallel and contradict each other.
- Cloud resources and mobile devices are missing from the inventory.
- Owners are not recorded or have left the organisation.
- The CMDB does not map dependencies and is not maintained after changes.
- There is no wiping evidence for retired storage media.
- Legacy systems are known, but their risks have never been assessed.
Note on references
The references point to laws, regulations and standards so that you can read the requirement in the original. No normative text is reproduced. Criteria and procedures are original wording and replace neither the text of the provisions nor legal advice. Whether and to what extent a provision applies to your organisation should be clarified before the audit.
The complete package
This sample shows the objective, the audit steps and the document list on one page. For your own audit topic, ProAuditMap creates the complete package: audit plan, audit program per audit dimension, document request list, interview guides, schedule, communication and report template. You review the draft, approve it and export to Excel and Word.
Create account View a complete sample package View pricing