Device Damage and Loss: What the Policy Should Say

TL;DR

• Device damage liability is the clause most equipment policies leave vague, and the vagueness surfaces at the worst possible moment.
• Separate three cases that get conflated: accidental damage, loss or theft, and damage through clear misuse. They need different answers.
• What a company may lawfully require of an employee differs by jurisdiction and by circumstance. Take local advice rather than copying a policy.
• Insurance usually covers less than people assume, and the excess is frequently larger than a replacement laptop.
• A policy that threatens recovery it will never pursue is worse than one that says the company absorbs ordinary accidents.
• The practical goal is that people report damage immediately rather than hiding it, and a punitive policy achieves the opposite.

The Cracked Screen Nobody Reported

The laptop had been working with a cracked screen for five weeks. The engineer had dropped it on a Saturday, decided it was his fault, and said nothing because the equipment policy contained a sentence about employees being responsible for company property.

What that sentence cost was not the screen. It was five weeks of somebody working badly on a damaged machine, and then an urgent replacement when the display finally failed during a customer call. The repair, had it been reported on the Monday, would have been straightforward and cheap. The outcome was a rushed purchase and a week of reduced productivity.

He had read the policy correctly. The policy said he was responsible, offered no definition of what responsible meant, and described no process for reporting an accident. Faced with an undefined liability, he chose silence, which is what most people choose.

Recommended Tools

Best tools for HR Operations

B BambooHR HR management system R Rippling HR & IT automation W Workday Enterprise HRIS

View all recommended tools

The real issue is not who pays for a broken laptop. It is whether your policy makes people tell you.

Device Damage Liability: the Three Cases That Get Conflated

Almost every problem in this area comes from treating these as one thing.

Accidental damage. A drop, a spill, a bag that got crushed. Ordinary, foreseeable, and the overwhelming majority of incidents. Any policy that treats this as a fault question will suppress reporting.

Loss or theft. A laptop left on a train, a bag stolen from a car. The hardware question is secondary here, because the data question is urgent and the response has to be immediate.

Damage through clear misuse. Rare, and genuinely different. A device used contrary to explicit instruction, or damaged in circumstances nobody would describe as an accident.

Those three want different treatment, different reporting routes and different consequences. A single sentence saying employees are responsible for company equipment covers all three badly.

An Important Boundary on What This Article Can Tell You

Worth stating plainly before going further, because this is an area where confident generic advice does real harm.

What a company may require of an employee regarding damaged or lost property differs by jurisdiction and by circumstance. Whether any deduction from pay is permissible, whether any agreement to that effect is enforceable, what notice or consent might be needed, and what happens when employment ends all depend on where the person works, the terms in place and the specific facts.

We are not going to tell you what the law requires, permits or prohibits anywhere, because the honest answer is that it varies and because a policy copied from an article written for a different jurisdiction is a liability rather than a safeguard.

What this article covers instead is the structure of a clear policy, the questions to put to somebody qualified, how insurance actually behaves, and the operational design that gets damage reported. Those are the parts that transfer.

So the one instruction worth following absolutely: before you publish any clause about recovering costs from an employee, have it reviewed by somebody qualified in each jurisdiction where you employ people. That review is cheaper than the alternative and it is the step teams most often skip when adapting a template.

What People Actually Need to Know

What do I do in the first hour? The only question that matters for loss or theft, and most policies answer it nowhere. One number or one channel, available out of hours.

Will I be charged? People assume the worst in the absence of a clear answer, and the assumption drives the behaviour. If the answer is that ordinary accidents are absorbed, say so in those words.

Will this go on my record? A genuine fear and usually unfounded. Saying explicitly that a reported accident is not a conduct matter removes most of the hesitation.

What if it was partly my fault? Almost all accidents are partly somebody's fault, which is what accidental means. A policy that invites this calculation produces non-reporting.

What happens while it is being fixed? A loan device, a temporary arrangement, or nothing. People will work on a broken machine rather than ask, unless the answer is published.

Writing the Device Damage Liability Policy: Five Clauses

Clause one: report immediately, and here is how. Lead with this. A channel, a timeframe and an explicit statement that reporting promptly is what the company wants. Everything else in the policy is secondary to this behaviour.

Clause two: what the company absorbs. Name it. Ordinary accidental damage, normal wear, hardware failure. The clearer this is, the less hesitation there is.

Clause three: loss and theft procedure. Immediate report, access revoked, a record made. Separate from the damage route because the urgency is different and because the data question dominates.

The wording for this clause should be unusually short and unusually specific, because it will be read by somebody who has just discovered their bag is gone. Three sentences: contact this channel now, including out of hours; we will disable your access immediately; we will tell you within 48 hours whether we need anything from you for an insurance claim. Everything else about the incident can be handled later and does not belong in the clause the person reads at the moment it happens.

Clause four: the exception, carefully worded and locally reviewed. If your policy contemplates any recovery of cost in cases of clear misuse, this is where it sits, and it is the clause that needs qualified review in every jurisdiction. Keep it narrow and keep it about conduct rather than about accidents.

Clause five: what you provide meanwhile. Loan device, timeframe, who arranges it. Small, practical, and it removes the incentive to limp along. Name an actual timeframe rather than saying as soon as possible, because an unspecified wait is indistinguishable from no arrangement and people will simply carry on with the broken machine instead of asking.

What to do: write clause one and clause two first, publish them, and take advice on clause four before publishing that. A policy with a clear reporting route and a clear absorption statement is already better than most, even while the exception clause is still with a lawyer.

What Insurance Actually Covers

This is where expectations and reality diverge most, and the detail is worth establishing before you rely on it.

Check whether portable electronics away from premises are covered at all. A general contents policy frequently covers equipment at a business address and not a laptop in somebody's home or in transit. For a distributed workforce that distinction is the whole question.

Check the excess against the cost of a laptop. Excesses in the range of a few hundred to a thousand are common, which means a single claim for a mid-range machine may recover little or nothing. An insurance route that never pays out in practice is not a route.

Check whether a claim requires a police report. For theft, often yes, and the practical consequence is that the person who lost the device has to do something within a window. If your policy does not tell them that, the claim fails on process.

Check the aggregate and the claim count. Several small claims in a year may affect renewal in a way that costs more than the devices.

What to do: ask your broker three specific questions rather than reading a summary. Are laptops covered away from business premises, what is the excess per claim, and does a theft claim require a police report. If the answers mean you will never claim, the honest policy position is that the company absorbs these costs, and that is a legitimate choice.

The Loss Procedure, Minute by Minute

Device damage liability questions can wait a day. A lost laptop cannot, and the difference is worth building into the policy explicitly.

Minute zero to fifteen: revoke access. The single action that converts an incident into a hardware loss. Disable the account, invalidate active sessions, revoke tokens. This is within your control and it does not depend on recovering anything.

Within the hour: lock or wipe the device if you can. This requires a management platform rather than an asset register, because the asset register knows the laptop exists and cannot reach it.

Hexnode publishes $2.20, $3.20 and $4.70 per device per month across its tiers, which is the cheapest published route to a remote lock capability.

Jamf publishes Jamf for Mac at $12.50 per macOS device per month, and that figure covers a bundle of several products rather than its management tool alone, so attach it carefully in any comparison.

Same day: record what happened and what you concluded. Device, serial, holder, time reported, what was revoked and when, whether disk encryption was on, what category of data it likely held. Eight fields, one note, dated.

Within 48 hours: the police report if you will ever claim. Most theft claims require one and most people do not know that, which is how a claim fails on process rather than on merit. If your policy expects a claim, the policy has to say this.

Within a week: the replacement. Not later. A person without a working machine is a person not working, and the delay is a far larger cost than the hardware.

The point of writing it as windows is that it removes judgement from a moment when the person involved is flustered and whoever picks up the report may be junior. Five rows, no decisions.

Encryption Changes the Whole Conversation

Worth separating because it is the single technical control that determines how serious a loss actually is.

A lost laptop with full-disk encryption and a revoked account is, in practical terms, a hardware write-off. The same laptop unencrypted, or encrypted but left logged in with the screen never secured, is a different category of problem entirely.

So the honest priority order is: encrypt everything, then worry about liability. A policy debating who pays for a lost device while a meaningful share of the fleet is unencrypted is optimising the wrong variable by a wide margin.

Confirm it rather than assuming it. Encryption being enabled by policy and encryption being confirmed on a specific device are different claims, and only the second one helps you after a loss. This is the evidence question covered in equipment compliance evidence, and it is the same export.

Report the number. Devices confirmed encrypted, as a share of devices owned. If that figure is below about 95 per cent, the gap is the thing to fix before refining any policy wording, because the unconfirmed machines are the ones that turn an ordinary loss into a disclosure question.

What to do: run the export this week. Teams who have never checked typically find somewhere between 5 and 20 per cent of the fleet unconfirmed, usually older machines or ones that were set up by hand before a standard build existed.

Why a Punitive Policy Costs More

The economics here are counter-intuitive enough to be worth setting out, because the instinct to deter damage is strong.

Take a company of 200 people with a four-year refresh cycle. Suppose 6 devices a year suffer accidental damage, which is a plausible rate, and that a repair or replacement averages a few hundred to a thousand depending on the machine. That is a known, modest, budgetable number.

Now suppose a punitive policy suppresses half of those reports. You do not avoid the cost; you defer it and make it worse. Three devices get worked on in a damaged state, degrade further, and are replaced rather than repaired. At least one fails at an inconvenient moment and produces an emergency purchase at full price with expedited shipping. And somebody spends five weeks at reduced output, which at any professional salary dwarfs the hardware entirely.

The suppressed-report cost exceeds the deterred-damage saving in essentially every scenario we have modelled, because accidental damage is not actually deterrable. People do not drop laptops because the policy permits it. They drop laptops because laptops get dropped.

The one case where deterrence has a role is genuine misuse, which is rare and which belongs in a conduct process rather than in an equipment policy. Designing the whole policy around the rare case is what produces the suppression in the common one.

The Reporting Design That Actually Works

Everything above matters less than this, because a policy that is never invoked is a policy that does not exist.

Make the first step trivially small. One message to one channel. Not a form, not an incident report, not an email to a shared inbox nobody watches. The person who has just broken something expensive is already uncomfortable and every additional step is an opportunity to put it off.

Respond without asking how it happened. At least not first. The first response should be about getting them working again. The cause can be established later and usually does not need establishing at all.

Say thank you. Genuinely. A team where reporting damage produces a helpful response will report damage. A team where it produces an investigation will not, and you will find out about the cracked screens five weeks later. This sounds like a soft recommendation and it is the one with the clearest measurable effect, because the entire cost model in this article turns on whether people tell you in week one or week six.

Publish the outcome pattern, not individual cases. Something like: we handled fourteen accidental damage reports last year and charged nobody. That single sentence does more to encourage reporting than any policy wording.

Separate the conduct route entirely. The rare misuse case should not travel through the same channel as the ordinary accident, because the existence of a shared channel contaminates the ordinary case with the implication of fault. Two channels, described differently, owned by different people where you can manage it. The cost of maintaining the separation is near zero and the behavioural difference it produces is the whole point of the policy.

The Numbers Worth Knowing

Not to set a policy by, but to size the problem honestly before deciding how much process it deserves.

Count your actual incidents. Over the last two years, how many devices were damaged, lost or stolen. Most teams find the number is lower than the policy's severity implies, which is an argument for a simpler policy rather than a stricter one. A fleet of 200 machines producing 6 incidents a year is normal; the same fleet producing 40 is telling you something about the hardware or the environment rather than about the people holding it.

Cost the real exposure. Incidents multiplied by replacement cost. For many companies this lands somewhere between trivial and the cost of a single hire, which puts the whole question in proportion.

Compare it against the cost of suppression. Five weeks of somebody working on a damaged machine, plus an emergency replacement, plus the week of reduced output. One suppressed report can cost more than several reported ones.

Then decide. If the exposure is small and the suppression risk is real, absorbing ordinary damage is the economically rational position as well as the humane one. If the exposure is genuinely large, that is usually a signal about the devices or the environment rather than about the people.

Remote Workers, Travel and the Home Office

A distributed workforce changes the device damage liability picture in three specific ways, and a policy written for an office does not account for any of them.

Devices spend their lives outside your premises. Which affects insurance, as covered above, and also changes the realistic damage profile. Office laptops sit on desks. Home laptops get moved between rooms, used on sofas, and share space with children and pets. The incident rate is genuinely higher and it is not anybody's fault.

Transit is the highest-risk period. Most loss and a disproportionate share of serious damage happens while a device is moving: commuting, travelling, in checked luggage. A policy that says anything about transit should say the one useful thing, which is never put a laptop in checked luggage, and should supply a bag if that is the constraint.

Repair logistics are the real cost. In an office, a damaged machine is swapped from a cupboard the same morning. For somebody three time zones away the same incident is a shipment out, a shipment back, and a week without a working computer unless you hold local stock or have a route that can deliver quickly.

What to do: stop treating the damage question as primarily financial for a distributed team. The money is modest and predictable. The downtime is the cost, and it is decided by how fast you can get a working machine to somebody, which is a logistics question rather than a policy one. We covered the shipping side in equipping a first hire in a new market.

And set the expectation about timeframes honestly. If a replacement to a particular country takes nine days, say nine days. People plan around a known answer and resent an optimistic one.

Loan Stock, Which Removes Most of the Pain

The single operational change that does most to reduce the cost of damage is holding spare machines, and it is rarely treated as part of this policy.

Decide the ratio deliberately. Somewhere between 2 and 5 per cent of fleet size is a common holding, and the right number depends on your incident rate and your replacement lead time. A team of 200 with slow shipping needs more spares than a team of 200 in one city.

Keep them ready, not merely present. A spare is only a spare if it is wiped, updated and enrolled. A cupboard of machines in unknown states is not loan stock, it is storage, and discovering that distinction during an incident is the worst time.

Distribute it if your people are distributed. Spares in one office serve one office. For a genuinely remote team the equivalent is a supplier who can ship quickly into the regions you employ in, which is a different arrangement and worth establishing before you need it.

Track loans as loans. A device issued temporarily and never recorded as such becomes an untracked machine in the register, which is one of the four failure modes behind register inaccuracy. Give loans an expected return date even if it slips.

RemoAsset is one option where the distributed-spares problem is the binding constraint, and disclosure matters: RemoAsset is owned by the same people who publish this site. It holds and ships devices into the markets you employ in and retrieves them afterwards, which addresses the replacement-speed half of this problem rather than the policy half. Where it struggles, stated plainly: pricing is quote-based and requires a demo, so it cannot be compared against alternatives on cost without a call; and it is a newer platform with a smaller footprint than the legacy global resellers, so ask specifically about your own markets. It has nothing to say about liability wording, which is the subject of this article and is a matter for your own policy and local advice.

How to Choose: Five Questions Before Writing Anything

Has anybody actually been charged for damage here? If not, your policy already absorbs costs in practice and the wording is just frightening people unnecessarily.

Do you know your incident count? If not, you are about to write a policy without knowing whether the problem is one device a year or thirty.

Does your insurance pay out in practice? The three broker questions above. If the answer is no, say so internally rather than leaving a route in the policy that nobody can use.

Where do you employ people? Determines how many jurisdictions need to review any cost-recovery clause, and whether a single global wording is even possible.

What do you want the behaviour to be? This is the real design question. Almost every other decision follows from whether you want immediate reporting or formal accountability, and you cannot optimise for both.

The Decision Table

What to Do When Somebody Does Damage a Device Deliberately

Rare enough that most readers will never need this, and worth having an answer for because the absence of one is why punitive clauses get written into policies aimed at accidents.

Establish the facts before characterising anything. The overwhelming majority of incidents that look deliberate at first report turn out to be accidents described badly by somebody who is embarrassed. Treat the initial description as provisional.

Route it as conduct, not as equipment. Whatever process you use for other conduct matters applies here, with the same protections and the same standard of evidence. An equipment policy is the wrong instrument because it has none of that structure.

Do not improvise a financial consequence. Whether any cost can be recovered, and by what mechanism, depends on jurisdiction, on the terms in place and on the specific facts. This is exactly the point at which to take qualified advice rather than to apply a clause somebody copied from a template.

Keep it genuinely separate from the accident route. The reason to insist on this is behavioural rather than procedural. If handling a rare deliberate case visibly flows through the same channel as a cracked screen, everybody with a cracked screen will think twice, and you are back to the five-week problem.

And resist generalising from it. One deliberate case in five years is not evidence that the policy needs tightening. It is evidence that one person behaved badly, which is what conduct processes exist for. Tightening the equipment policy in response punishes the ninety-nine people who report accidents honestly.

Reviewing Device Damage Liability When Something Changes

Three events should trigger a look at the wording, and none of them is the calendar.

A new country. The clause most affected by jurisdiction is any provision about recovering costs, and it needs review each time you start employing somewhere new rather than annually in aggregate. This is the single most common way a policy becomes quietly wrong.

A change in insurance. If a renewal alters the excess, the coverage of portable items away from premises, or the claim requirements, the policy route that depended on it may no longer work. Ask the three broker questions again at every renewal rather than assuming continuity.

An incident that the policy handled badly. The most valuable trigger. If somebody did not report, or reported late, or was confused about what would happen, that is specific evidence about the wording. Fix the clause the incident exposed rather than reviewing the whole document.

What to do: keep the policy short enough that a review is an afternoon. A two-page document gets reviewed when something changes. A twelve-page document does not, which is how organisations end up relying on provisions nobody has read since they were copied in.

One final operational note. Whoever owns this policy should also see the incident count, because the two drift apart otherwise. A policy owner who does not know whether there were 2 incidents last year or 30 cannot tell whether the wording is working, and the number is the only feedback the document ever gets.

What to Put in Writing, and What Not To

Put in writing: the reporting channel and timeframe. What the company absorbs. The loan-device arrangement. The loss-and-theft procedure including access revocation. Who to contact out of hours.

Do not put in writing any statement about what the law requires or permits regarding deductions, withholding or recovery, because that is a question for qualified local advice and a policy asserting it may be wrong in some of the places you employ people.

Be careful with any clause tying equipment costs to final pay on departure. What is possible there varies by jurisdiction and circumstance, and this is the clause most commonly copied from a template written for somewhere else. We have written about unreturned equipment and the same caution applies: the operational process transfers, the legal position does not.

And review it annually against where you now employ people, because a policy written when everybody was in one country stops matching the first time somebody is hired somewhere new.

What Getting This Wrong Costs

The expensive outcome is suppression, and it is expensive in a way that never appears as a cost.

A policy that creates undefined liability produces people working on damaged equipment, unreported losses, and devices whose condition nobody knows. The hardware cost of an accident is small and predictable. The cost of a laptop lost three weeks ago that nobody mentioned, with live access and company data on it, is neither.

The second cost is enforcement you never intended. A clause threatening cost recovery, published and then never applied, trains people that the policy is theatre, which undermines the parts of it that matter. Worse, if it is applied once, inconsistently, to one person, it becomes a fairness problem that outlives the incident.

And the third is the legal exposure of a copied template. A cost-recovery clause lifted from a policy written for another jurisdiction may be unenforceable, and relying on it may create a problem larger than the laptop. That is precisely why the one firm recommendation in this article is to get the exception clause reviewed where you employ people rather than adapting somebody else's wording.

So the question is not who should pay for a broken laptop. It is whether your current policy makes somebody with a cracked screen tell you today or in five weeks.

When You're Ready to Write It

Start with the behaviour you want, which is immediate reporting, and write the two clauses that produce it: how to report, and what the company absorbs. Those can be published this week and they will do most of the work.

Then get your actual numbers. Incident count over two years, replacement cost, and the three broker questions about what insurance really covers. Most teams discover the exposure is modest and the policy can be simpler than they feared.

And take advice on the exception clause before publishing it, in every jurisdiction where you employ people. That is the one part of this that cannot be adapted from a template, and it is the part most often adapted from a template.

A closing note on why this clause attracts so much attention relative to its importance. Device damage liability feels like a question about money and fairness, which makes it the part of an equipment policy people want to debate. In practice the financial exposure for most companies is a handful of incidents a year against a known replacement cost, which is a rounding error against payroll. The genuinely consequential variables are whether devices are confirmed encrypted, how fast you can revoke access when one goes missing, and how quickly a replacement reaches somebody three time zones away. None of those is a policy question and all three are worth more attention than the wording.

So write the short version, absorb the ordinary accidents, get the exception clause reviewed where it matters, and then spend the remaining effort on the encryption percentage and the replacement time. Those two numbers will do more for your actual risk position than any paragraph about responsibility ever will, and unlike the paragraph they can be measured.

Frequently Asked Questions