No enterprise ITAD programme fails at destruction. Destruction is the part vendors are good at and the part that gets all the attention. The failures happen upstream, and there are only three of them.
The first is the invisible estate. Assets that were never on the register cannot be disposed of correctly because nobody knows they exist. They accumulate from predictable sources: devices issued outside the standard process, equipment inherited through an acquisition that was never fully integrated, spares held locally, hardware bought on a departmental card. The consequence is not just an incomplete disposal count. It is that the organisation cannot state with confidence what data-bearing equipment it holds.
The second is the accountability gap. IT owns the devices. Procurement owns the contract. Finance owns the asset register. Security owns the data requirements. Sustainability owns the reporting. Every function owns a genuine piece and each does its piece competently. What is missing is anyone who owns the outcome, which means the gaps between the pieces belong to nobody. Value leaks in those gaps, and so does evidence.
The third is evidence that arrives too late. The devices were sanitised properly. The records were produced. And eighteen months later, when an auditor or a customer asks, the records cannot be located, or they can be located but do not reconcile to the asset register. The disposal was fine. The proof is not.
This playbook is designed against all three. It is written for estates above roughly five hundred devices, which is where the arithmetic changes and good habits stop being enough.
Four decision gates structure the operational core: is the asset on the register, is it classified, has retention expired, does the evidence reconcile. Each has a defined consequence when the answer is no, and an explicit warning that a gate which can be waived under time pressure is not a gate.
The vendor selection section argues that most processes test capability thoroughly and evidence barely at all, which is the wrong way round because capability rarely fails and evidence frequently does. It includes an evidence test that predicts the relationship: ask a candidate provider for three real destruction records with client details removed, and what comes back tells you what your audit evidence will look like in two years.
The business case section is honest about where the money is. Resale value disappoints, consistently, and a value waterfall shows why. The durable case is avoided risk, released storage, consolidated ad hoc spend and evidence you currently cannot produce, at a net cost close to zero once residual value is applied. That framing survives a bad market for used hardware, which the revenue framing does not.
It also corrects something widely misreported. A great deal of commentary is telling enterprises they face an October 2026 Digital Waste Tracking deadline. They do not. Phase 1 obligations sit with permitted waste receiving sites, not with waste producers, and there is no published mandatory date for producers at all. Your duty of care does mean your disposal partner has to be able to meet theirs, so the correct action is to ask them now and record the answer.
The maturity model states plainly that most enterprises are at level two while believing they are at level four, and advises against targeting level five, because a programme designed for a maturity nobody will resource decays back to level two with additional paperwork. Level three, held reliably, is a good outcome.
Seven appendices: a RACI with exactly one accountable party per row, a full RFP requirement set, an SLA schedule, metric definitions, an eighteen-statement maturity self-assessment, a ninety-day implementation plan and a glossary.