Nobody Owns It Anymore: A Retirement Ledger for UK IT Assets

Most IT plans in UK organisations are read left to right: capital request, purchase order, delivery, invoice. The reverse journey — the orderly withdrawal of an asset from service — is rarely documented with the same discipline, and that asymmetry is where a surprising amount of money and risk accumulates. Equipment that has been superseded but never formally retired does not disappear. It sits in a rack, a store room or a cupboard behind reception, quietly consuming electricity, maintenance cover, licence entitlements and management attention. Ask three people who owns it and you will usually receive three different answers.

The practical remedy is a decommissioning plan: a repeatable, evidenced process that treats retired assets as a balance-sheet and compliance item rather than a facilities chore. It is not glamorous work, but it is the kind of groundwork that prevents an audit finding, a data breach notification or a renewal invoice for equipment nobody intended to keep.

The asset nobody's name is on

The first problem is definitional. A device can be live in the configuration management database, lapsed from the fixed asset register, out of warranty, and still processing personal data. Under the Companies Act 2006 a company must keep adequate accounting records, and in practice that means a fixed asset register with acquisition date, cost and depreciation. What it does not automatically capture is operational status. An asset can be written down to nil for accounting purposes while remaining fully connected to the network.

Start, therefore, with a retirement register that sits alongside the fixed asset register rather than replacing it. For each candidate asset, record the service it supports, the data it holds or can reach, its contractual support position, and its nominated owner — accepting that "facilities" and "nobody" are both answers that require escalation. Assets that fail the ownership test on first pass are, almost without exception, the ones that will appear in a future incident review.

Evidence, not assurances: the sanitisation file

Data sanitisation is where decommissioning most often fails an inspection, because organisations tend to accept a supplier's assurance in place of a record. The Information Commissioner's Office expects personal data to be disposed of securely at end of life, and the National Cyber Security Centre publishes guidance on secure sanitisation of storage media that sets out the difference between clearing, purging and destruction. Whichever route is chosen, the file should contain a per-device record identifying the serial number, the method applied, the date, the operative and the verification step.

For physical destruction, BS EN 15713 provides the recognised UK standard for secure destruction of confidential material, and a certificate issued against it is far stronger evidence than a collection note. For media that is reused rather than destroyed, the record should show the tool used and the standard it meets — with asset-level granularity, not a single spreadsheet row asserting that forty laptops were wiped.

Encryption is a useful supporting argument, but only if key management is demonstrably sound. Where a device was encrypted and the keys were held in a managed service, document that the keys were destroyed; where the keys cannot be accounted for, treat the device as unencrypted and sanitise accordingly.

The paper trail ends where the kit leaves the yard

Waste electrical and electronic equipment from UK businesses sits largely outside the household WEEE system, which places the burden of proof on the organisation handing over the equipment. Under section 34 of the Environmental Protection Act 1990, a duty of care applies to anyone who produces, keeps or transfers controlled waste. In practice this means using an authorised treatment facility or an approved authorised treatment facility, retaining waste transfer notes, and using hazardous waste consignment notes where the waste is classified as hazardous — as batteries and some display equipment can be.

Chain of custody should be continuous and auditable: collection note referencing serial numbers, a named carrier, a receiving record, and a treatment or recycling certificate. Where an IT asset disposal partner is used, check the accreditation directly rather than accepting a logo on a proposal. The commercial temptation to let a reseller take "anything with a plug on it" is strong, but the data and environmental obligations travel with the equipment regardless of what was paid for it.

Licence true-down: the quietest saving

Software estates rarely shrink in step with hardware. Perpetual licences, subscription seats and support contracts tend to persist because nobody initiates the reduction. A decommissioning process gives you the trigger to do so deliberately.

Build a reconciliation step into retirement: for each asset leaving service, identify the software installed, the licence model, the minimum contractual commitment and the notice period. Enterprise agreements typically offer a true-down window; missing it means paying for capacity that no longer exists. Legacy database and middleware vendors are particularly well practised at maintaining support charges against deployments that were switched off months ago. The saving is usually modest per line and material in aggregate — and unlike most IT savings, it recurs every year.

The cost of keeping things plugged in

There is a category of asset that is neither live nor retired: the device that is still powered, still patched by somebody, still inside the support boundary, but no longer delivering a service. Its costs are diffuse and therefore invisible — extended support premiums, out-of-warranty hardware cover renewing automatically, rack space and cooling, monitoring licences, and the staff hours spent applying updates to a system nobody uses.

Give this category a name in your reporting. "Deferred retirement" is a useful label, because it frames the cost as a choice rather than an overhead. Quantify it: an annual figure for extended support and maintenance attached to assets past their planned end of life is a persuasive number for a finance director, and it is usually several times larger than the disposal cost that was being avoided.

A ninety-day write-off rhythm

Quarterly cadence works better than an annual purge. In the first month, refresh the retirement register and confirm ownership for every candidate. In the second, complete sanitisation, disposal and evidence collection, and instruct licence reductions with the correct notice. In the third, reconcile the fixed asset register, record the write-off with appropriate approval, and report disposal proceeds or costs against budget.

Two controls make the rhythm stick. First, no purchase order for replacement equipment is released without a corresponding retirement entry for the asset it displaces. Second, the disposal evidence pack is a named deliverable owned by a named individual, reviewed alongside the quarterly security report rather than buried in procurement files.

What the board should see

A single page is enough: the count and value of assets past end of support, the proportion of disposals with complete sanitisation and duty-of-care evidence, the annualised value of licence reductions achieved, and the residual extended-support cost still being carried. Add the sustainability line — retired equipment handled through an authorised facility contributes to the circular economy and to the carbon reporting that now accompanies most UK public sector and large corporate procurement.

None of this requires new technology. It requires the same rigour applied to buying to be applied to stopping — and a recognition that an asset nobody owns is still an asset on somebody's risk register.