Why Your Asset Register Is Wrong Right Now

Ask any IT manager whether their asset register is accurate and most of them will give you the same slightly uncomfortable answer: it is mostly right, probably. That hesitation is telling.

The asset register — the list of hardware, software licences, and devices an organisation is responsible for — is supposed to be the foundation of IT management. You cannot manage what you cannot see. You cannot secure what you do not know exists. You cannot budget for renewals on licences that are not tracked.

In practice, most asset registers are partially correct at the moment they are compiled and increasingly wrong from that moment forward.

Why asset registers drift

The problem is not that IT teams are careless. It is that asset registers require constant human input to stay accurate, and the business moves faster than the updates happen.

A laptop gets issued to a new employee and logged. That employee leaves three months later. The laptop sits in a desk drawer for two weeks, then gets handed to a contractor without going through IT. The asset register still shows it assigned to the original employee, who has left the building.

A server gets provisioned for a project in Q1. The project wraps up in Q3. The server keeps running because nobody has a decommission date in their calendar. The licence for the software on that server renews automatically in Q4. Nobody notices because the cost centre is buried in a consolidated cloud bill.

A SaaS subscription gets taken out on a team’s departmental budget. It never enters the IT asset register because the procurement did not go through IT. When the vendor is acquired and the data handling terms change, nobody knows the tool exists.

Multiply each of these scenarios across an organisation of any meaningful size and you get an asset register that is structurally incapable of being accurate through manual maintenance alone.

What it actually costs

The costs are in three places.

The first is licensing overspend. Most organisations are paying for more software than they use. Unused seats in enterprise agreements, redundant tools doing the same job as other tools, licences that auto-renewed after the project they were bought for ended. Cleaning this up typically reduces software spend by fifteen to thirty percent in the first cycle.

The second is security exposure. Assets that are not in the register are not in the patching schedule. An unmanaged device or an unmonitored application is an entry point that your security tooling is not watching. The devices most likely to be the source of a breach are the ones nobody knew about. This is why patch management starts with knowing what you have.

The third is audit and compliance exposure. POPIA requires that you can account for where personal information is stored and processed. If data is sitting in an application that is not in your asset register, you cannot account for it. That is a compliance gap with teeth.

What continuous asset management looks like

The alternative to a manual register that drifts is automated discovery that maintains a live view. Network scanning that identifies every device present. Endpoint agents that report back on installed software. Cloud integration that pulls licence and usage data from SaaS platforms.

The register is not something you compile — it is something that updates itself, with human review focused on exceptions and decisions rather than data entry. When a new device appears on the network, it gets added automatically. When a device has not been seen in 30 days, it gets flagged for review. When a SaaS subscription is added to a departmental card, cloud integration picks it up.

This is the foundation of what Claritam does. The asset visibility layer is the precondition for everything else — identity management, compliance monitoring, security posture, budget accuracy. You cannot do any of it well without a live picture of what you actually have.

The advisory side

If your organisation is dealing with the downstream effects of a drifting asset register — overspend, compliance gaps, security concerns — Greg Hay provides advisory and assessment services that can help you understand the specific exposure and what it would take to close it. The assessment gives you the picture. Claritam gives you the ongoing visibility to keep it accurate.

The South African reality

South African mid-market organisations face a particular version of this problem. Budgets are tight. IT teams are lean. The pressure to do more with less means that proactive tasks like asset management always lose to reactive tasks like keeping email working. The result is that asset registers exist on paper but do not reflect reality.

POPIA has raised the stakes. Personal information sitting in an unmanaged application is a compliance breach waiting to happen. The Information Regulator has shown it is willing to act. Organisations that cannot account for where personal information is stored are exposed, and the excuse that nobody knew about the application is not a defence.