IT due diligence is usually planned around systems, contracts and security posture. The questions that are hardest to answer on short notice are simpler than that: what hardware do you own, where is it, and can you prove it.
TL;DR
- Buyers ask three device questions: what you own, where it is, and what happens to it when somebody leaves.
- Most teams can answer the first approximately and the second badly.
- The gap between the register and reality is the finding, not the number itself.
- Unreturned equipment from past leavers is the most common issue raised, because it reads as a control weakness rather than a hardware one.
- Reconstructing a register under diligence timescales is close to impossible. The work has to be done beforehand.
- A clean answer takes a fortnight to produce and about an hour a quarter to maintain.
The three questions that actually get asked
What do you own? A count by asset type, with an acquisition value and a depreciation position. Finance usually holds part of this and IT usually holds a different part, and the two of them rarely agree on either the count or the value.
Where is it? Per device, who holds it and in what country. For a distributed team this is the question that exposes weak records, because the honest answer is often a location that was true two years ago.
What happens when somebody leaves? A process, a recovery rate and evidence that data was removed. This is the one treated as a formality, and it is also the one most likely to produce a finding that ends up written down.
Why the gap matters more than the number
Nobody doing diligence expects a perfect asset register. What they’re testing is whether you know how good yours is.
A team that says its register covers roughly ninety per cent of devices, explains which ten per cent is weak and why, and shows the plan to close it, reads as competent. A team that presents a register as complete and is then shown three devices that aren’t on it reads as something else entirely, and the question moves from hardware to whether other numbers were presented the same way.
That shift is the real risk. Device records aren’t usually material to a transaction. What they’re is cheap to test, which makes them a convenient proxy for how carefully the rest of the operation is run.
Unreturned equipment is the usual finding
Ask most distributed teams how many devices are held by people who no longer work there and the answer is a pause. The number is rarely zero and is frequently uncomfortable.
Forget the resale value. It matters in diligence for a reason that has very little to do with what the hardware is actually worth. A laptop held by a former employee is a device that may still hold company data, outside any control, with no record of what’s on it. That’s a data question wearing a hardware costume, and it is read as one.
What to do:
- Count devices still assigned to people who have left, by year.
- Separate those where the device was wiped remotely from those where nothing is known.
- Write down what you tried in each case, even where it failed.
- Decide which are realistically recoverable and which should be written off.
- Fix the process before the next departure, because the count grows while you argue about the old ones.
A company that fixed it in three weeks
A seventy person company entered a funding round believing its asset position was fine. The register listed 94 devices and showed a holder for each.
Sampling twenty of those holders directly found six discrepancies: two people had been issued a replacement that was never recorded, three held an additional monitor bought on expenses, and one device was assigned to somebody who left fourteen months earlier. Extrapolated, the register was wrong on roughly a quarter of entries.
The fix wasn’t a tool. It was three weeks of reconciliation, a written note of the eleven devices held by former staff and what had been attempted on each, and one process change requiring IT notification at offer acceptance. The diligence question was answered with a number and a caveat rather than a number alone, and it closed in one exchange.
What you cannot fix under time pressure
Reconciling a register takes weeks because it depends on people replying. Asking two hundred staff to confirm what hardware they hold produces a sixty per cent response rate and a fortnight of chasing, and that timeline doesn’t compress for a transaction.
Recovering devices from former employees is worse. Somebody who left eighteen months ago has no reason to engage, may have moved, and is under no commercial pressure. Recovery rates on that cohort are poor at the best of times and don’t improve because you now need the answer.
So the useful framing is that diligence doesn’t create this work. It reveals whether it was done.
Where a lifecycle platform helps, and where it does not
RemoAsset is our own product, stated plainly. Because it handles procurement and retrieval across 80+ countries and records each device through issue and return, it produces the holder-and-location answer directly rather than by reconstruction, which is the part of diligence that costs weeks. Pricing is published: the Subscription tier starts at $1,499 a year for companies with 50 to 5,000+ employees and includes a 60 per cent reduction on retrieval charges.
Its limits are directly relevant here. It has no network discovery, so it won’t find hardware you forgot you owned, and in diligence that’s exactly the category that produces findings. It has no software licence management, so the licence questions sit outside it. And only the Subscription tier publishes a figure, with the pay-as-you-go tier quoted rather than listed. It records what passed through it, which means anything bought on an expense claim three years ago is still invisible.
Workwize, Firstbase, GroWrk, allwhere and Deel IT all operate in the same space and none publishes a rate card. The live Workwize domain is goworkwize.com; the older address no longer resolves.
What good looks like on paper
| Question | Weak answer | Strong answer |
|---|---|---|
| What do you own | A spreadsheet, undated | Count by type, with the reconciliation date |
| Where is it | Assigned holder only | Holder and country, confirmed within six months |
| Leaver process | A policy document | A recovery rate with the method stated |
| Data removal | We wipe them | Evidence per device, including the failures |
| Known gaps | None | A named list with a plan |
The checklist worth keeping
Checklist:
- The register carries a date it was last reconciled against reality.
- A sample of twenty holders was confirmed within the last six months.
- Devices assigned to former employees are counted and explained.
- Wipe evidence exists per device, including where it failed.
- Known gaps are written down rather than absent.
- Someone owns the register by name.
Final Thoughts
The device section of IT due diligence is not difficult and it isn’t usually material. It is simply unforgiving of teams that have never looked, because the answers cannot be produced quickly and the gap between claimed and actual is easy to test.
Reconcile once, write down what you do not know, and keep it current. A quarter of an hour every three months is the whole of the maintenance, and it converts a bad fortnight into one email.
Frequently asked questions
What is IT due diligence?
It’s a pre-deal review. A buyer, investor or acquirer goes over your technology position before a transaction, covering systems, contracts, security and assets. The device portion asks what hardware you own, where it is and how it is controlled through joining and leaving. It is rarely material to a valuation and is frequently used as an indicator of how carefully the rest is run.
How accurate does our asset register need to be?
Accurate enough that you can state its accuracy honestly. Nobody expects a perfect record across a distributed fleet, and a team that says its register is around ninety per cent reliable and names the weak areas is in a far stronger position than one claiming completeness that is then disproved by three devices.
Why does unreturned equipment come up so often?
The data is the point. A device held by a former employee may still contain company data entirely outside your control, with no record of what is on it. That makes it a data governance question rather than a hardware one, and it is read accordingly. The count itself matters less than whether you know the number and what was attempted in each case.
Can we fix our records once diligence starts?
Partially at best. Reconciling a register depends on people replying and takes weeks regardless of urgency, and recovering devices from people who left over a year ago is slow and often unsuccessful. The realistic goal once a process has started is an honest account of what you know and do not know, rather than a corrected number.
What evidence should we keep about wiping devices?
A record per device showing what was done, when, and by what method, including the cases where it did not work. The failures matter more than the successes, because a process that reports complete success on every device is usually one that is not recording properly rather than one that never fails.
How often should we reconcile the register?
A sample check quarterly and a fuller reconciliation annually suits most teams under a few hundred devices. The sample is the valuable part: twenty holders confirmed directly gives you a reliable error rate, and an error rate you can quote is worth considerably more in any review than a total you cannot defend.
