Lost, Retired, and Unassigned Assets: What Evidence to Keep

For lost, retired, and unassigned assets, the evidence to keep is simple but specific: the status the asset is in, the date it changed, the person who actioned it, and a short note explaining what happened. A laptop marked "retired — wiped and recycled via vendor on 2026-05-12" is evidence; a device that silently disappears from a spreadsheet is the opposite. The exceptions, not the active fleet, are what a reviewer actually asks about.

This guide is the lifecycle companion to what an IT assets register is and the hardware field guide. Those cover the steady state; this one covers what to record when a device goes missing, reaches end of life, comes back unowned, or breaks.

What Evidence to Keep for Lost, Retired, and Unassigned Assets

Every non-active asset state deserves the same four-part record. The table below maps the states CertPilot's register supports to the evidence each one needs.

| Asset state | Evidence to record | Why it matters | Example note | |---|---|---|---| | Lost | Status "lost", date noted, last known holder, follow-up taken | Shows the loss was noticed and acted on, not ignored | "Lost in transit 2026-04-03; reported to holder's manager; reissued" | | Retired / disposed | Status "retired", date, disposal or wipe method | Proves end-of-life was handled, including data sanitization | "Retired 2026-05-12; wiped and recycled via vendor X" | | Unassigned (hardware) | No owner linked, marked as spare with a date | Distinguishes a deliberate spare from a missing record | "Returned by leaver 2026-05-01; held as spare" | | Unassigned (software) | Licence status "unassigned" | Shows a paid licence is free to reassign, not lost | "Seat freed when J. Doe left; available to reassign" | | Repair / damaged | Status "repair", date, fault note | Tracks devices temporarily out of service | "Screen cracked 2026-05-20; sent to repair" |

Why Asset State Evidence Matters

A register that shows only active assets is quietly suspicious. Real fleets lose devices, retire them, send them for repair, and accumulate spares. When a record never reflects any of that, a reader's reasonable conclusion is that the register is not actually maintained.

The opposite is also true: an honest record of exceptions is the strongest signal that a register is alive. It is the difference between "everything is fine" — which proves nothing — and "here is the device we lost, when we noticed, and what we did." Insurers, leadership, and clients asking about asset control are really asking how exceptions are handled, because that is where control either exists or doesn't.

Lost Asset Evidence

When a device goes missing, the record matters more than usual, because "lost" is the state most likely to be quietly deleted. Mark the asset with the lost status and record:

• When it was noticed missing.
• Who last held it (the assigned person from the record).
• What follow-up happened — reported to a manager, reissued, claimed on insurance, a remote action requested from whatever tool actually manages the device.

A point worth being precise about: the register records that a device is lost. It does not detect the loss, locate the device, or wipe it. Any remote wipe or lock happens in a device-management tool, not in CertPilot — the register is where you keep the dated note that it was done. Treating the record as the evidence, and the action as something that happens elsewhere, is what keeps the claim honest.

Retired Asset Evidence

Retirement is end of life: the device is withdrawn from service, disposed of, or recycled. Mark it retired and record the date and, in the notes, the method — wiped and recycled, returned to a leasing vendor, donated after sanitization. The disposal detail is the part that matters, because the real question behind "did you retire it?" is usually "was the data dealt with?"

CertPilot's register has no separate "disposed" status; retired plus a dated note is how you record disposal. That is deliberate — a free-text note captures the method far better than another rigid status would. Keep the note specific enough that, a year later, it answers the question without anyone having to remember.

Unassigned Asset Evidence

"Unassigned" means two different things depending on the asset:

• For hardware, unassigned is the absence of an owner. The risk is ambiguity: is this a deliberate spare, or a device whose record was never updated? Resolve it by marking genuine spares with the spare status and a date, so an empty owner field always means "needs attention," never "probably fine."
• For software, the register has a literal unassigned licence status. Use it when a seat is freed — typically when its holder leaves — so the licence is visibly available to reassign rather than silently wasted or lost.

In both cases the evidence is the same idea: a clear record that an item without a current owner is known to be without one, not merely forgotten. Tying this to your People & Accounts register is what makes leaver-driven unassignment a tidy handoff instead of a slow leak.

Damaged or Repair Asset Evidence

A device out for repair is in a temporary state worth recording so it is not mistaken for lost or quietly written off. Mark it repair, note the fault and the date, and update the record when it returns to service or is retired instead. The maintenance-notes field is the natural home for the running history — "screen replaced 2026-03; battery swelling 2026-05." The register tracks that a device is in repair and why, not the technician's bench notes.

What Not to Claim or Store

Lifecycle records invite a few specific overclaims and oversharing risks — avoid all of them:

• Do not claim detection. The register does not detect that a device is lost or stolen, locate it, or sense its condition. You record the state; the knowledge comes from your team.
• Do not claim remote action. No remote wipe, lock, or control happens in the register. Record that such an action was taken elsewhere; do not imply the register performed it.
• Do not store secrets. Disposal notes should not contain passwords or full licence keys. A masked hint at most.
• Do not over-record personal data. "Returned by leaver" is enough; the register is not the place for HR detail about why someone left.

How This Supports Management-Ready Evidence

The exception states are exactly what makes asset data useful to management. A snapshot that says "210 active, 6 spare, 3 retired this quarter, 1 lost and reissued" tells a leader the fleet is being actively managed — far more than a flat count of devices. In CertPilot today, these states surface as summary counts in the Governance Evidence Pack, alongside your other registers; there is no dedicated Assets PDF, so the detailed record lives in the register and a CSV export. For how to frame any of this for a leadership audience, see management-ready IT evidence reports; the evidence reports module describes how each report is assembled, and the sample reports gallery shows the report artifacts.

How CertPilot Fits — With Strict Boundaries

CertPilot's Assets Register records asset lifecycle states as a customer-maintained, manual-first register with CSV import and export. The boundaries hold exactly as they do elsewhere in the product:

• It records an asset's status; it does not discover, detect, or locate assets.
• It is not MDM, runs no endpoint agent, and reads no telemetry.
• It does not monitor endpoints, scan for vulnerabilities, or patch devices.
• It cannot remote wipe, lock, or control a device — those actions, if taken, happen in another tool.
• It is not a CMDB replacement and not an accounting or depreciation system.
• It is not a certification or an audit guarantee — it supports internal governance routines and evidence preparation.

The register's job is to be the dated, owned place where you record what happened to an asset — not to be the system that made it happen. For the full picture of where CertPilot's lines are drawn, see what CertPilot is — and what it is not.

A Practical First Version for a Lean IT Team

You can put exception-state evidence in place in an afternoon:

1. Sweep for ghosts. Go through your current list and mark anything not genuinely in use as spare, repair, retired, or lost. Stop guessing about ambiguous rows — decide each one.
2. Write the disposal notes you remember. For recently retired devices, capture the wipe/disposal method now while you recall it.
3. Resolve the unassigned. Every ownerless device becomes a deliberate spare or a flagged gap; free unused software seats to the unassigned status.
4. Set the habit. Whenever a device is lost, retired, repaired, or returned, update the status and add a one-line dated note in the moment — that is the whole discipline.
5. Export a snapshot. A dated CSV (or the Governance Evidence Pack counts) turns today's cleanup into a record you can point back to. The prove-it-without-spreadsheets routine shows how this becomes a habit rather than a one-off.

In Short

• For every exception, record status, date, who actioned it, and a short note — that is the evidence.
• Lost = noticed, last holder, follow-up; retired = disposal/wipe method in the note; repair = fault and date.
• Unassigned means a deliberate spare (hardware) or a freed seat (software) — never a silently forgotten row.
• CertPilot records these states; it does not detect, locate, wipe, or control devices, and there is no dedicated Assets PDF — states surface as Governance Evidence Pack counts.
• The exceptions, handled honestly, are what actually demonstrate the fleet is under control.

Frequently Asked Questions

What evidence should I keep for a lost laptop?

Mark it with the lost status and record when it was noticed missing, who last held it, and what follow-up happened — reported to a manager, reissued, claimed on insurance, or a remote action requested from the tool that manages the device. The record proves the loss was noticed and handled, which is the actual question behind "is this under control?"

Does CertPilot detect or locate lost devices?

No. CertPilot does not detect that a device is lost, locate it, or wipe it. The register is where you record that a device is lost and what was done about it. Any remote wipe, lock, or location action happens in a device-management tool, not in CertPilot.

How do I record a retired or disposed asset?

Set the status to retired and add a dated note describing the disposal or wipe method — for example, "wiped and recycled via vendor X on 2026-05-12." There is no separate "disposed" status; retired plus a specific note is how disposal is recorded, and the wipe detail is usually the part that matters most.

What does "unassigned" mean for an asset?

For hardware, unassigned means no owner is linked — which should always be resolved to either a deliberate spare or a flagged gap. For software, "unassigned" is an actual licence status you set when a seat is freed, so it is visibly available to reassign. The point in both cases is that an ownerless item is known to be ownerless, not forgotten.

How long should I keep retired-asset records?

Keep them as long as they might be asked about — typically aligned with your insurance, finance, or data-protection retention expectations. Because the records are lightweight (a status, a date, a note), there is little cost to keeping them, and a retired-asset history is exactly the kind of evidence that demonstrates a managed process over time.