You Can’t Claim What You Can’t List

And you will answer it from memory. Standing in the car park, running on no sleep, you'll try to reconstruct the contents of your own business - every computer, every tool, every licence, every box of stock - off the top of your head, at the precise moment your head has never been less reliable. Whatever you forget, you paid for twice: once when you bought it, and again when you didn't claim it.

The least glamorous document in this series

The fix is an asset register - an asset list, in plainer clothes - and I'll grant you up front that it's the least exciting thing I will ever ask you to build. It's also one of those rare jobs where the entire requirement fits in a sentence: write down what you own, what it's worth, and prove it.

The practical version, for a small business, is an afternoon's work. A spreadsheet: item, serial number where it has one, rough purchase date, rough replacement cost. Then the part that does most of the heavy lifting - walk every room with your phone and film it. Open the cupboards. Open the drawers. Narrate as you go. Twenty minutes of slow video is an inventory, a valuation aid and an evidence file in one, and it captures the hundred small things no list ever remembers: the cables, the chairs, the test gear, the printer nobody loves.

The government's own continuity guidance asks for exactly this discipline - business.gov.au's emergency management plan template has you record how business information is protected and attach copies of the records that matter, insurance policies included (business.gov.au, Develop an emergency management plan, 2026). The template is free. The thinking it forces is the value.

The folder that leaves the building

Now widen the lens, because equipment is the easy half. The harder question after a disaster is documents: the trust deed, the company paperwork, the lease, the vehicle registrations, the insurance policies themselves - including, with a certain dark comedy, the policy you'd need to read to make the claim. Identity documents for the directors. The licence that lets you trade.

Every one of those should exist as a copy somewhere the disaster can't reach: scanned, and stored alongside your run book in the off-site places it already lives. The original deed in the filing cabinet next to the server is one fire away from being part of the same claim it's needed to support. Paper burns and drives drown together when they share a room - separation, not technology, is the safeguard.

While you're scanning: the ATO expects your business records kept for years regardless (ATO, Record keeping for small business, 2026) - so the same afternoon quietly improves your tax posture too. Nobody has ever regretted having too many copies of the trust deed.

Yes, this is a security column

I can hear it: what does any of this have to do with cyber? Directly - because security was never only about hackers. The definition has three parts: your information stays private, stays correct, and stays available. A fire that takes the only copy of your records is an availability disaster as total as any ransomware crew could engineer, and rather more common in this country. The discipline is identical too: know what you have, keep copies beyond the blast radius, test that the copies work.

Thirty years of ICT taught me that organisations discover what they owned in exactly two ways: from the register, calmly, or from the wreckage, expensively. The mine sites and data centres I worked on all chose the register - not because engineers are tidy people, but because someone once did the arithmetic on choosing wrong. A five-person business gets the same choice with a thinner margin for the expensive path.

So: one afternoon. A spreadsheet, a slow walk with a camera, a scanning session, and copies lodged where the building isn't. Then a calendar note to refresh it yearly, because the list you made in 2026 won't describe the office of 2029.

The assessor's question is already written on the form, waiting. What's your answer going to be built from - a document, or a memory of a room that no longer exists?

---

Sources

• Australian Government, business.gov.au, Develop an emergency management plan - retrieved 13 June 2026
• Australian Taxation Office, Record keeping for small business - retrieved 13 June 2026
• Red Bridge Cyber, perspective: The Third Word in the Definition of Security
• Red Bridge Cyber, perspective: A Backup You Haven't Restored Is a Hope, Not a Backup
• Red Bridge Cyber, perspective: Write the Run Book Before You Need It