ITIL 4 ITAM cheat sheet

ITIL 4 defines an IT asset as any financially valuable component that can contribute to the delivery of an IT product or service; an asset is a type of configuration item whose distinguishing characteristic is financial value.

Scope of ITAM: the full lifecycle of hardware, software and cloud services, plus the licence, warranty and contract entitlements attached to them. Managing the technical relationships between CIs is service configuration management, not ITAM.

Value levers: avoided over-purchase, licence compliance, audit readiness, reduced data-loss and obsolescence risk, better refresh and sourcing decisions, and reliable cost input to service financial management.

Inclusion decision rule: an item belongs in the asset register when it carries material financial value or a contractual obligation. Low-value consumables (cables, small peripherals) are normally managed as stock, not as individually identified assets.

Asset versus CI: one physical device can be both. The asset record carries cost, depreciation, warranty, ownership and contract data; the CI record carries technical attributes and relationships used for impact assessment.

Licence compliance % = licences consumed / licences entitled x 100. A result above 100% indicates an effective licence position deficit and a true-up or removal action.

Asset utilisation rate = assets actively in service / total assets owned x 100. A low rate is the trigger to redeploy or dispose rather than buy new.

ITAM enables but does not own financial management, information security, procurement and supplier management; the asset owner is accountable for value, the custodian for day-to-day data upkeep.

Common scope exclusions agreed up front: people records, intellectual property and process documentation, unless the organisation explicitly elects to treat them as assets.

Canonical states: plan, acquire, receive, deploy, in use/maintain, retire, dispose. Every state transition should write a state, date and responsible party to the asset record.

TCO = acquisition + implementation + operations + maintenance and support + training + energy + end-of-life disposal - residual value. Use TCO, not purchase price, to compare sourcing and refresh options.

Straight-line depreciation: annual charge = (acquisition cost - residual value) / useful life in years; book value = acquisition cost - accumulated depreciation. Reducing-balance applies a fixed percentage to the opening book value each year.

End-of-sale, end-of-life and end-of-support are three distinct vendor milestones. Refresh planning should target end-of-support minus the migration lead time, not the end-of-sale date.

Repair-versus-replace test: compare remaining useful life and continued vendor supportability against the cost of a like-for-like replacement; redeployment of an existing supported asset is preferred to a new purchase.

Receiving control: complete a three-way match of purchase order, delivery note and invoice before the asset is accepted into the register and payment is released.

In-use stage obligations: assignment to a user or location, warranty and contract tracking, patch and maintenance status, periodic physical verification, and reconciliation against discovery data.

Retirement requires a documented disposal decision plus evidence - sanitisation record, certificate of destruction, resale or donation note - before the record is closed.

Leaver returns: confirm physical return and condition before setting the record to in-stock. An unconfirmed return is a lost asset, and its licence entitlement stays consumed.

Sourcing options: outright purchase (capital), lease, rent, lease-to-own, subscription, hardware-as-a-service, and cloud consumption (IaaS, PaaS, SaaS). The choice shifts cost between capital and operating budgets and changes who owns end-of-life disposal.

Licence metrics must match the publisher's counting method: per device, per named user, per core, concurrent user, or consumption-based. Counting on the wrong metric invalidates the compliance calculation.

Effective licence position = entitlements - consumption, normalised per publisher and metric. Positive is surplus (a saving opportunity); negative is a deficit requiring true-up, removal or renegotiation.

Contract clauses that matter to asset managers: ownership at end of term, data return and deletion, de-installation and removal costs, tagging and audit rights, price-uplift caps, and exit or transition assistance.

Software audit response sequence: collect discovery and purchase evidence, normalise by publisher and metric, quantify the deficit, then true-up, remove or renegotiate - and record the root cause for improvement.

Cloud assets need the same discipline as hardware: named subscription owner, cost centre and mandatory tags, idle and orphaned resource review, and reserved-capacity coverage analysis.

Disposal decision hierarchy: reuse internally, then resale, then donate, then recycle or recover materials, then destroy. Sanitisation is mandatory before any option that lets the data leave organisational control.

NIST SP 800-88 sanitisation levels: clear (logical techniques where the device stays in a controlled environment), purge (resists laboratory attack), destroy (physical destruction). Choose the level from data classification and next use.

Disposal compliance: WEEE and hazardous-waste rules, data-protection obligations, and an audit trail of serialised certificates of destruction or transfer notes.

Data is recorded fact (serial number, purchase date); information is data given context so a decision can be taken, for example "42 laptops are past end-of-support, refresh spend of X falls due in Q3".

Minimum asset register attributes: unique asset ID, category, make and model, serial or service tag, owner and custodian, location, lifecycle state, cost centre, acquisition date and cost, warranty or contract reference, related CI and service.

The CMS is broader than one database: it may comprise several CMDBs, the asset register, discovery databases and other sources, linked and reconciled. The CMDB holds CIs and their relationships.

Data quality dimensions to measure: completeness, accuracy, uniqueness, consistency, timeliness and validity. Report each separately - a register can be 100% complete and 60% accurate.

Discovery is agent-based (software on the device) or agentless (network scan, SNMP, API). Agentless misses powered-off and off-network devices, so it is normally paired with agent data or manual verification.

Reconciliation rule: when discovery and the register disagree, neither is automatically correct. Investigate the cause, correct the authoritative source, and log the exception with its resolution.

Normalisation maps raw manufacturer and model strings to a controlled catalogue; without it, licence counting and reporting by model or publisher are unreliable.

Validation at the point of entry (mandatory fields, pick lists, format checks) costs less than retrospective cleansing; periodic stocktake samples physical reality against the register.

Duplicate records usually come from multiple procurement routes and from discovery creating a new record for a re-imaged device; serial number or a hardware hash is the standard match key.

Core roles: the asset owner is accountable for value and use; the custodian performs day-to-day administration and data upkeep; the IT asset manager defines and operates the practice.

Other stakeholders: service owners, configuration manager, procurement, finance and IT financial management, supplier manager, information security, HR, legal and compliance, internal audit, end users, and the CIO/CFO as budget holders.

RACI rule: exactly one accountable role per activity. Typically the asset manager is responsible for the process, the asset owner accountable for asset decisions, finance consulted on capitalisation, audit informed.

Joiner-mover-leaver events from HR trigger assignment, transfer and return of assets; the asset record evidences the return and supports licence reclamation on exit.

Incident management consumes asset data (device, warranty, location) to route and resolve; change enablement consumes CI relationships for impact assessment.

Service financial management needs acquisition cost, depreciation and contract commitments to model service cost and chargeback.

Information security needs the asset inventory for vulnerability coverage, patching scope and end-of-support exposure; an asset missing from the register is an unmanaged risk.

Supplier management owns the contract; asset management owns the entitlement and consumption evidence on which the supplier relationship and any audit depend.

Integration anti-pattern: locally maintained spreadsheets outside the register. They create a second version of the truth, obscure licence consumption and produce audit findings.

Governance sets the rules: policy, standards, procedures, delegated approval thresholds (for example purchases above a value need owner and finance approval) and segregation of duties between requesting, approving and receiving.

Compliance areas touching ITAM: software licensing, contract terms, capitalisation and financial reporting, data protection, environmental and e-waste rules, export control, health and safety, and internal audit evidence.

Principal risks: licence deficit (audit penalty), licence surplus (wasted spend), unsanitised disposal (data breach), loss or theft, shadow IT, obsolescence and end-of-support exposure, and inaccurate inventory driving bad decisions.

Control set: mandatory tagging, periodic physical verification, automated discovery, licence metering, three-way match on receipt, disposal certification, access control on the register, and audit trails on record changes.

Segregation of duties: the role approving disposal must differ from the role physically removing assets and from the role updating the register, otherwise loss can be concealed.

Risk treatment options are avoid, reduce, transfer (ITAD contract with indemnities, cyber insurance) and accept; record the chosen option and its owner in the risk register.

Audit evidence pack: reconciliation reports, licence entitlement statements, disposal and destruction certificates, approval records, stocktake results and the exception log.

Non-compliance handling: detect through audit or reconciliation, quantify the exposure, remediate (true-up, remove, procure, sanitise), then enter the root cause in the improvement register.

ITIL 4 continual improvement model, seven steps: (1) What is the vision? (2) Where are we now? (3) Where do we want to be? (4) How do we get there? (5) Take action. (6) Did we get there? (7) How do we keep the momentum going?

Step 2 requires a measured baseline: register accuracy from an independent sample audit, effective licence position, asset age profile, cost per asset and the count of open exceptions.

KPIs should be SMART. Typical set: register accuracy %, licence compliance %, assets past end-of-support, disposal cycle time, % of assets discovered automatically, and annual cost per asset.

Every improvement item needs an owner, a measure and a review date; without these the practice drifts back to its previous state after the initiative ends.

Report accuracy from an independent sample audit, not from the register's own completeness fields - self-reported accuracy is a lagging and easily gamed indicator.

Recurring incidents caused by unknown or out-of-warranty assets are a signal to widen discovery coverage and tighten receiving controls, not to add more manual checks.

Maturity progression: reactive spreadsheets, defined register and process, automated discovery with reconciliation, integrated CMS with licence and financial analytics, then predictive refresh and cost optimisation.

Metric gaming watch-list: auditing only the fields the team maintains, announcing stocktakes in advance, or excluding "unknown" records from the accuracy sample. All inflate reported quality without improving it.