The email lands on a Tuesday. "Please send your hardware and software inventory by the 28th." Most teams react the same way: a quiet groan, then a hunt through shared drives for whichever spreadsheet is the least wrong.
Agencies tend to get this email from a direction in-house IT teams don't: a client. An enterprise client's security review, a SOC 2 questionnaire before a new retainer, or a procurement team that wants to know which laptops hold their customer data and who can log in to their ad accounts. The checklist is the same one an IT team would use. The stakes are higher, because the answer decides whether you keep the account.
It doesn't have to be a panic week. Audit prep is mostly dull work done early, and a decent prep list turns it into a few calm afternoons.
Decide what "everything" means first
Before anyone counts a single device, agree on scope. Laptops and servers are obvious. Phones? Monitors? The conference-room webcam somebody expensed in 2022? Auditors usually care about anything that touches company data or sits above a cost threshold, so ask which rule applies and write the number down.
Half the arguments in the middle of an audit are really scope questions nobody settled at the start. Software needs the same treatment: paid licenses, subscriptions, and the tools people quietly put on a company card.
For an agency, settle one more scope question up front: do contractor and freelancer machines count? If a freelancer edits a client's videos on their own laptop, the client's auditor will usually say yes.
The hardware half of the checklist
Any workable hardware and software audit checklist starts with physical gear, because it's the easier half to verify. For each device, confirm that:
- The serial number on the machine matches the serial number in your record.
- The named owner still works there and still has it.
- The location is right, which is where remote staff usually trip things up.
- Encryption is on and the OS is patched.
- The warranty or end-of-life date is recorded.
You don't have to check all of it by hand. Pull twenty rows at random and verify those properly, by asking the person for a photo of the serial sticker if they're remote. If three of the twenty are wrong, you've learned how much to trust the rest.
Reconcile your sources, because they will disagree
Purchase records say one thing. Your device management console says another. The inventory sheet says a third. That gap isn't a failure; it's the actual work of reviewing IT assets before an audit. Every mismatch is either a device you can't account for or a record that's gone stale, and an auditor will find the same ones you do. Better that you find them first.
Doing this by hand every quarter gets old quickly. Some teams move the inventory into a tool that keeps itself current, and Bluetally.com is one example, since it syncs with the device management systems you probably already run. Then the records are already close to right when the audit notice arrives, and the reconciliation shrinks to the exceptions.
One practical tip while you reconcile: keep a column for "last verified" and fill it in as you go. It looks like a small thing. By the end you can see at a glance which records someone has actually touched and which are still running on faith, and that column is the first thing worth showing an auditor.
Ghosts and orphans
Two kinds of problems turn up in nearly every audit. A ghost is a record with no device: the spreadsheet says it exists, nobody can find it. An orphan is the reverse, a device in someone's drawer with no record at all.
Say you have 40 laptops on paper and find 36. Four ghosts. Maybe two were recycled without anyone updating the sheet, one went home with a former designer, and one is anyone's guess. Knowing that split matters, because the first group is a paperwork fix and the second is a retrieval job.
Check the software side with fresh eyes
Licenses are where the money hides. Compare seats you bought, seats assigned, and seats actually used in the last ninety days. Unused paid seats are wasted budget. More installs than licenses is a compliance headache you'd rather not explain.
Look at accounts, too. Anyone who left last quarter and still holds a login to a paid tool is both a cost and a security gap. And skim expense reports for software nobody has heard of. Shadow IT rarely announces itself.
The agency version: client access is part of your inventory
This is the part an in-house checklist leaves out, and it's the part a client auditor cares about most. Your agency doesn't only own devices and software seats. It holds access to other companies' systems: their Meta Business Manager, Google Ads, Instagram and TikTok accounts, analytics, CRM, and sometimes their payment dashboards.
Treat each of those as an asset with an owner, the same as a laptop:
- List every client system your team can log in to, and which named person holds each login. "The agency" is not an owner.
- Prefer partner or business-manager access over shared passwords. Access granted through the client's own business manager can be revoked by them in one click, and it leaves an audit trail. A shared password leaves neither.
- Offboard contractors on the same day the project ends. The freelancer who ran a campaign in spring should not still be an admin on the client's ad account in autumn.
- Keep one client's data out of another client's workspace. If your team works from shared inboxes, spreadsheets or a CRM, check that a designer on client A can't open client B's leads. Per-client workspaces with their own permissions are much easier to defend in a questionnaire than one big shared sheet.
If you can produce that list in an afternoon, most client security reviews stop being scary.
Build the evidence folder as you go
Keep one folder for the whole audit. Put the scope note in it, dated exports from each system, and a short explanation next to every discrepancy: what you found, why it happened, what you did about it.
That last part is the one people skip. An auditor will trust a messy sheet with honest notes more than a spotless one that falls apart after the first follow-up question.
Make the next audit boring
The goal is to dread this a little less each year. Tag every device the day it arrives. Spot-check ten percent of the inventory each quarter, so the full audit is just the last piece of a year-long habit. And when someone leaves, close out their equipment and their client logins the same week.
None of this needs a big budget or a dedicated project. It needs a calendar reminder, one person who owns the list, and the willingness to look at the messy parts before somebody else does.
If you only do one thing this month, run the twenty-row spot check. It takes an hour, and it will tell you more about your inventory than any amount of staring at the spreadsheet.
