By Russell Lawson, ISO consultant, lead auditor, and founder of The Compliance Companion - the platform helping businesses implement ISO 9001, ISO 14001, ISO 45001 and ISO 27001 using real-world templates, AI tools and guided support. Russell has worked with hundreds of UK organisations across sectors to simplify certification, and regularly audits systems to see what really works - and what doesn’t - in the field.
Let’s be honest: no one gets excited about maintaining an asset register.
It’s one of those ISO requirements that often gets pushed to the bottom of the list. I’ve seen businesses treat it as a dusty spreadsheet in a forgotten folder - or, worse, assume IT “has a list somewhere.”
But here’s the thing: an up-to-date asset register isn’t just an admin task. It’s a tool that supports the effectiveness, security and sustainability of your entire management system - and it’s a requirement across ISO 9001, ISO 14001, ISO 45001 and ISO 27001.
In this blog, I’ll explain what ISO actually expects, how businesses often get this wrong, and how I’ve helped clients build simple, useful asset registers that actually add value.
What Is an Asset Register in ISO Terms?
An asset register is a controlled list of the things your business relies on to deliver products or services - and to meet your legal, quality, environmental, safety or information security obligations.
That might include:
-
IT equipment (laptops, servers, routers)
-
Tools and machinery
-
Vehicles
-
Safety-critical equipment (fire alarms, PPE, monitoring systems)
-
Environmental controls (waste tanks, filters, compressors)
-
Information assets (data, customer records, contracts)
-
Facilities and infrastructure
And depending on the ISO standard, the scope changes slightly:
-
ISO 9001: Focus on infrastructure and monitoring/measuring equipment
-
ISO 14001: Focus on assets that interact with environmental aspects
-
ISO 45001: Focus on equipment that affects health and safety risks
-
ISO 27001: Focus on all information assets (physical and digital)
Why ISO Standards Require It
Here’s what each standard is trying to achieve by asking for a register of assets:
ISO 9001 (Clause 7.1.3 & 7.1.5)
Ensures you have the right infrastructure and calibrated resources to deliver consistent quality.
ISO 14001 (Clauses 6.1.2, 8.1)
Links environmental aspects and impacts to physical controls — like tanks, filters, and emissions equipment.
ISO 45001 (Clause 7.1.3 & 8.1.4)
Requires control over equipment and contractor tools that may affect health and safety performance.
ISO 27001 (Annex A 5.9, 5.33, 5.34)
Demands clear asset ownership, classification and protection for information assets — both physical and digital.
The common thread?
You can’t control or improve what you haven’t identified.
What I See Go Wrong in Audits
After auditing countless businesses, I can tell you the most common issue isn’t that companies don’t have assets… it’s that they haven’t documented or maintained the list in a meaningful way.
Outdated registers
I once audited a business whose asset list hadn’t been updated in 3 years - half the laptops listed were in storage or had been recycled. That’s a gap in both information security and operational awareness.
Missing asset types
In ISO 27001 audits, I often see people forget that paper records and cloud systems are still information assets - even though they’re not “owned” hardware.
No ownership assigned
An asset with no owner is an asset no one is responsible for. I’ve seen this cause delays in incident response, lost data, and confusion over calibration schedules.
Too much or too little detail
Some registers go into unnecessary depth (e.g. listing staplers), while others are so vague they’re meaningless (“printer fleet” with no breakdown, location or tracking).
What Smart Businesses Do Differently
Here’s what I’ve seen work in real businesses - from 5-person offices to multi-site contractors:
Define what counts as a key asset
Don’t list every chair - focus on equipment, systems and infrastructure that directly impact quality, safety, environmental or information controls.
Group by category
Use simple tags like IT, Vehicles, Safety Equipment, Plant/Machinery, Monitoring Tools, etc. It helps with sorting and review.
Assign clear ownership
Every asset should have someone responsible for its upkeep, usage, calibration, disposal, or protection.
Track status and location
Know where it is, what condition it’s in, and when it was last reviewed.
Make it a live document
This shouldn’t be something you dig out once a year. Smart businesses embed it into internal audits, onboarding/offboarding, project planning, and even procurement.
A Real Example: Asset Register Meets Audit Confidence
I helped a client in the IT services sector implement ISO 27001. They had plenty of controls in place, but no centralised asset register. Data was stored across multiple systems, and hardware lists were informal.
We built a simple, shared asset register in Excel with the following:
-
Asset name and ID
-
Description and location
-
Owner
-
Classification (public/internal/confidential)
-
Protection needs (e.g. encryption, backups)
-
Review date
During their audit, they flew through the asset-related controls - because they could show, clearly and confidently, what they had, who owned it, and how it was protected.
The same approach has worked for 9001, 14001 and 45001 - just with different asset categories.
Make It Easier with The Compliance Companion
Inside The Compliance Companion, you’ll find:
-
Ready-made Asset Register templates tailored to each standard
-
Embedded AI prompts to guide categorisation and ownership
-
Version control and review guidance
-
Examples of how asset registers link to legal compliance, monitoring, and risk
You don’t need a massive system - you just need a usable, consistent, and reviewable list of what matters.
👉 Explore it here: https://the-compliance-companion.co.uk/harness-the-future-of-iso