ITAM Standards & Practices
How the Safekeep module maps onto the industry playbook — the standard IT asset lifecycle, the practices ISO/IEC 19770-1 and ITIL 4 describe, why acknowledgment and e-signature matter for custody, and the operating cadences that keep a register trustworthy.
What ITAM is
IT Asset Management (ITAM) is the discipline of knowing, at all times, what IT assets you own, where they are, who holds them, what condition they are in, and what they are worth — from the day a laptop is ordered to the day it is retired. Done well, it answers the questions every IT team, finance team, and auditor keeps asking: "Do we actually have this? Who has it? Can we prove they received it? What is it worth on the books today?"
Practitioners describe the ITAM lifecycle in five stages. The module's screens line up with them directly:
| Lifecycle stage | What the practice expects | Where you do it in Safekeep |
|---|---|---|
| Plan | Decide what you track and how: asset classes, naming, statuses, custody rules, depreciation policy. | The catalog tabs on the Assets page (Models, Locations) and the Categories page (Categories, Groups, Status Labels), plus Custom Fields & Fieldsets and Depreciations. |
| Procure | Every purchase enters the register with tag, serial, cost, supplier, and warranty. | The Add Asset form for one-off entries; CSV/XLSX import (including raw Snipe-IT exports) for bulk onboarding. Print QR labels from the same toolbar. |
| Deploy | Issue equipment to a named person and capture their acceptance. | The Check out asset action endorses the asset to a staff user; the assignee clicks "Confirm receipt" (with an acceptance agreement and typed e-signature when the category requires it). |
| Operate | Verify assets exist on a cadence, log service work, keep book values current. | Record audit with an automatic next-audit date; the Maintenance screen for repairs/upgrades and costs; the monthly depreciation compute feeding the Depreciation schedule report. |
| Retire | Recover the asset, record its condition, and take it out of circulation. | Check in asset records the return and condition; setting an Archived-type status label takes the asset out of the deployable pool. Every step lands in the asset's Activity log (Asset Detail & Activity). |
ISO/IEC 19770-1 — the ITAM management-system standard
ISO/IEC 19770-1 is the international standard for IT asset management systems. It began life as a software asset management (SAM) standard and, since the 2017 edition, covers the management of all IT assets. In plain language, it asks an organization to demonstrate:
- Inventory accuracy — a complete, current register of IT assets with identifying details.
- Ownership and responsibility records — who holds each asset, with evidence of issue and acceptance.
- Lifecycle control — defined, controlled processes for acquiring, deploying, moving, and retiring assets.
- Verification and audit — periodic physical verification that the register matches reality, with records kept.
- Financial and risk information — knowing what assets are worth and where value or risk concentrates.
Here is how each of those asks maps onto a shipped module capability:
| What ISO/IEC 19770-1 asks for | Module capability that supports it | Guide page |
|---|---|---|
| Inventory accuracy — a trustworthy register | The asset registry at ams/assets: every asset carries an Asset Tag (the dedupe
key on import), serial, model, category, location, and status. Bulk import/export keeps the
register reconciled with external lists. |
The Asset Registry, Import, Export & Labels |
| Ownership records — who holds what, with proof | Endorsement to a named staff user with the lifecycle Assigned → Acknowledged → Return requested → Returned; acknowledgment ("Confirm receipt") with optional acceptance agreement and typed e-signature stored against the event. | Checkout & Check-in |
| Lifecycle control — controlled state changes | Typed status labels (Deployable /
Pending / Undeployable /
Archived) with the deployable-only checkout gate; permissions
(asset_checkout, asset_audit, asset_maintenance…)
restrict who may perform each transition. |
Status Labels, Permissions & Roles |
| Verification & audit — prove the register matches reality | The "Record audit" action stamps the last-audit date and schedules the next (default +90 days); the Audit due report lists what is overdue; a weekly reminder cron notifies assignees ("An asset assigned to you is due for audit"). | Auditing Assets, Asset Reports |
| Chain of custody — an unbroken event history | Every lifecycle mutation writes one row to the asset's Activity log
(asset_events): Endorsed, Acknowledged, Return requested, Returned, Audit,
Maintenance, Checkout, Check-in. The Activity log report shows the same trail across
all assets. |
Asset Detail & Activity, Asset Reports |
| Financial information — current book values | Straight-line depreciation profiles ("Useful life (months)", "Residual / minimum value") with a monthly book-value compute and the Depreciation schedule report showing each asset's "Current value" and "Computed at". | Depreciations, Asset Reports |
ITIL 4 — the IT asset management practice
ITIL 4 defines IT asset management as the practice of planning and managing the full lifecycle of all IT assets, in order to maximize value, control costs, manage risk, support decision-making, and meet regulatory and contractual requirements. The module's endorsement model is squarely this practice: an asset is issued to a named person, that person accepts custody, and every hand-off is evidenced.
ITAM is not a CMDB — and this module is ITAM
ITIL separates two registers that are often confused:
| ITAM register (this module) | CMDB (service configuration management) | |
|---|---|---|
| Cares about | Ownership, custody, location, condition, cost, book value. | Configuration items (CIs) and the relationships between them. |
| Answers | "Who has laptop AST-0042 and what is it worth?" | "If this server fails, which services break?" |
| Unit of record | An asset with a tag, an assignee, and a value. | A CI with dependencies, versions, and service mappings. |
| Driven by | Procurement, HR issue/return, finance, physical audit. | Change management, incident/problem management, discovery tools. |
Safekeep is an ITAM register. It does not model dependencies between assets, map assets to services, or ingest discovery-tool data — so do not present it as a CMDB in an ITIL assessment. What it does model, thoroughly, is custody: at any moment the register can tell you who holds each asset, since when, whether they confirmed receipt, and when it is due back — and back it up with the event trail.
Chain of custody & acceptance
The single most valuable habit in equipment management is never issuing an asset without an acceptance record. A register that says "Juan has the laptop" is an opinion; a register where Juan clicked "Confirm receipt", ticked "I have read and accept the terms above.", and typed his full name to sign is evidence. That evidence is what settles disputes when a device goes missing, when an employee separates, or when an auditor asks who was accountable.
In Philippine workplaces this is familiar paperwork: the Property Acknowledgment Receipt (PAR) or accountability form an employee signs when issued company equipment, which HR keeps on file and clears at separation. The module's acknowledge flow is the digital equivalent of that signed form:
IT endorses the asset
An IT admin uses "Check out asset" to endorse the asset to a staff user, optionally with a "Due / return by" date. The asset's endorsement status becomes Assigned and an Endorsed event is written.
The employee confirms receipt
The assignee opens the asset and clicks "Confirm receipt". If the asset's category requires acceptance, the modal shows the acceptance-agreement text, the checkbox "I have read and accept the terms above.", and the field "Type your full name to sign". On success the toast reads "Receipt confirmed." and the status becomes Acknowledged.
The record preserves the proof
The Acknowledged event stores the acceptance timestamp — and, when the category required acceptance, the agreement text as it stood at signing and the signature ("Signed: name"). It stays in the asset's Activity timeline and the Activity log report — the chain of custody is never edited, only appended to.
Return closes the loop
The assignee can click "Request return"; IT records the hand-back with "Check in asset", capturing the return date and condition (Returned). Accountability transfers back to stock — the digital equivalent of clearing the PAR.
require_acceptance) and hold its text (eula_text) are not
editable from the Categories form — they can currently only be set directly in the database.
Without them, "Confirm receipt" still works and still writes the Acknowledged event; it just
skips the agreement and signature step. See Categories for the full
caveat.
Recommended operating cadences
A register decays without a rhythm. These cadences are industry-typical, and the module's own defaults and reminder crons are tuned to match:
| Cadence | Practice | How the module backs it up |
|---|---|---|
| Quarterly | Physical audit. Sight each asset (or a rotating sample), confirm holder, location, and condition. | Recording an audit schedules the next one +90 days out by default ("Schedule next audit in (days)"); the Audit due report lists what is due, and the audit-due reminder cron runs weekly (Mondays, 08:00) notifying assignees. See Auditing Assets. |
| Monthly | Warranty and return review. Check what warranties are about to lapse and which endorsed assets are past their due date. | The warranty-expiry reminder cron runs daily at 07:30 and the return-due cron daily at 07:00 ("An asset's warranty is about to expire" / "An asset assigned to you is due to be returned"); the "Assets needing attention" dashboard widget surfaces the same items. See Widgets, Reminders & Settings. |
| Monthly (automatic) | Book-value refresh. Keep current values reasonably fresh for reporting. | The depreciation compute cron runs on the 1st of each month at 01:10, updating each asset's "Current value". Book values are therefore at most a month old — plan around that. See Depreciations. |
| Before fiscal year-end | Finance reconciliation. Reconcile the IT register against the fixed-asset ledger before closing the books — costs, disposals, and depreciation. | Export the register to XLSX (Import, Export & Labels) and hand finance the Depreciation schedule report; resolve any assets that were retired physically but never checked in or archived in the register. |
| On every issue/return | Custody events, same day. Never let a hand-off go unrecorded. | Checkout, acknowledge, request-return, and check-in each write their event immediately — the SOPs in Workflows & SOPs give the click-by-click procedures for each role. |
asset_audit_cadence_days setting, falling back to 90 days when it is unset —
but that setting currently has no settings screen; it can only be changed in the database.
You can always override the number of days per audit in the modal itself.
Fixed-asset register vs IT-asset register
Companies typically keep two asset registers, and it pays to be clear which one this is. The fixed-asset register lives with finance: it is the authoritative source for capitalized cost, accumulated depreciation, tax treatment, and the figures that appear in financial statements (and, in the Philippines, in BIR-facing books). The IT-asset register — this module — lives with IT: it is authoritative for custody, condition, location, and lifecycle.