TL;DR
Equipment for non employees is the gap between your asset register and your HR system. Board members, advisors, interns and agency staff hold company devices but do not appear in joiner or leaver workflows, so nothing triggers issue, review or return. The fix is a register that keys on the device, not on payroll.
- Four populations usually sit outside: board, advisors, interns, agency staff.
- None of them generates a leaver event, so nothing asks for the device back.
- Board members often hold the most sensitive material and the least oversight.
- Fixed end dates make interns the easiest group to fix first.
- Record an end date at issue, or there will never be one.
The moment this becomes real
Say your board has six members, four of them non executive. Two years ago, somebody sensibly decided that board papers should not go to personal email, so each non executive received a company laptop with access to the board portal.
Since then, one has stepped down, one has joined another board in an adjacent market, and nobody has reviewed either arrangement. The devices do not appear in the HR system because none of these people has ever been an employee. They do not appear in the offboarding process because that process starts from a termination record.
Best tools for HR Operations
When the security questionnaire asks how many devices hold board level material and who holds them, the honest answer takes three days to assemble. The real issue is not the laptops. It is that your device controls are attached to employment status rather than to possession.
When this is lighter than you think
Four stages where this is a small job.
- Nobody outside payroll holds a device. Check before assuming. Most companies find at least one, but some genuinely have none.
- Board members use their own machines with portal access only. A common and defensible arrangement. Your controls move to the portal and the hardware question disappears.
- Interns on a fixed cohort. They all start and finish together, so one calendar entry covers the whole group.
- Agency staff on the agency’s hardware. Then it is a contractual and access question rather than an asset one.
It gets heavier when advisors accumulate over years, when board composition changes, and anywhere people are issued devices by a sponsor rather than through a process.
The five questions teams actually ask
Should non employees get company devices at all? Sometimes yes, particularly where the alternative is sensitive material on personal machines. The decision should be deliberate and recorded, rather than something a sponsor arranges informally.
Who owns the relationship? Name a sponsor for every non employee device at the point of issue. Without one, there is nobody to ask at the end, and the device sits in the register with no path to recovery.
What ends the arrangement? For an intern, a date. For an advisor, usually nothing, which is the problem. Set a review date at issue even if the engagement is open ended, so that a decision gets made rather than defaulted.
Do our policies even apply to them? Acceptable use and data handling terms are often drafted for employees. Whether they bind a non employee depends on what that person actually signed, which is worth checking with whoever papers those relationships.
How do we get the device back? The same way as anyone else, except that nobody is prompting you and there is no final pay to discuss. This is why end dates matter more here than anywhere else.
Three ways teams handle it, and where each breaks
Treat them as employees in the asset register. Add them with a type field and run the same process. Simple and effective. It breaks because the triggers still come from HR events they do not have, so issue works and return does not.
Avoid issuing hardware entirely. Give portal or browser access on their own devices, with controls at the application layer. Clean, and increasingly common for boards. It breaks when the material genuinely needs a managed endpoint, or when the person’s own machine is unsuitable.
Issue with a mandatory end date. Every non employee device gets a review or return date at the point of issue, held in the register and reported on monthly. This works. It breaks only if nobody reads the report, which is the usual way it fails.
Five questions to find your own gaps
Finding your equipment for non employees exposure takes an afternoon.
Can you list every device holder who is not on payroll? If the register has no person type field, you cannot, and that is the finding.
Who signed off each of those devices? If nobody remembers, there is no sponsor and no route to recovery.
Does any of them have an end date recorded? Interns usually do. Advisors almost never.
What access do board devices carry? Often the most sensitive in the company, under the least frequent review.
What happens when a non executive steps down? If the answer is a Companies House filing and nothing else, the device is still out.
What is actually available
Five honest options, including ours.
Add a person type to the register. Best first move for everyone. Cheap, and it makes the population visible. Struggles alone, because visibility is not recovery.
Browser only access, no hardware. Best for boards and most advisors. Removes the asset entirely. Struggles where a managed device is genuinely required, and some board portals do expect one.
A sponsor and review date at issue. Best general control. Forces a decision rather than a default. Struggles if the monthly report has no owner.
Agency or supplier provides the hardware. Best for temporary staff via an agency. Moves the asset problem to them. Struggles on access control and on what happens to data on a machine you have never seen.
RemoAsset. Best when these people are scattered and there is no office for them to drop a laptop at, which is usually the case for non executives and advisors. Chosen because retrieval from people who are not employees works the same way as from leavers, without needing an HR trigger or a final pay conversation. Where it struggles: it cannot tell you who these people are. If your register has no record that an advisor holds a device, no service can collect it. The discovery half of this problem stays yours. It also publishes an entry subscription price but no per device rates.
Where to start, by situation
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| Nobody outside payroll holds kit | Any | Any | None | Confirm it once and move on |
| Board papers on personal email | Any | No portal | Sensitive material uncontrolled | Solve it at the application layer first |
| Interns each summer | 5 to 50 | Fixed cohort | Devices stay out after they go | One calendar return date for the cohort |
| Advisors accumulated over years | Any | No sponsor recorded | Nobody knows who holds what | Audit the population before anything else |
| Non executives in several countries | Any | No office | No route to collect a device | A retrieval service such as RemoAsset |
What the gap actually costs
The hardware value is trivial. A handful of laptops across a board and a few advisors is not a budget problem, and nobody is going to notice the depreciation.
The exposure is the point. These are frequently the people with access to the most sensitive material you hold: board papers, acquisition discussions, financial results before they are public. They also have the least frequent review, because none of the controls that fire for employees fire for them.
The third cost arrives during a security review or a transaction, when somebody asks a question you cannot answer quickly. Taking three days to assemble a list of who holds company devices is not a good look in diligence, and it is a bad answer in a questionnaire. So the question is not how many devices are involved. It is whether your controls follow possession or payroll.
When a spreadsheet column is not enough
Adding a person type field solves visibility and nothing else. You can now list the population, which is genuinely the hardest part, and you still have no way to act on it.
The action problem is specific to this group. There is no last working day, no final pay, and often no office. A non executive who stepped down nine months ago has no reason to think about your laptop, and chasing them is awkward in a way that chasing a leaver is not. Collection has to be easy enough that it is not a favour you are asking.
That is where a service does something a policy cannot: packaging arrives, a courier comes, and nobody has to find a box. A laptop lifecycle management service handles the collection the same way for an advisor as for an employee. RemoAsset also publishes its approach to device security and data handling, which is the part that matters when the device held board material. None of that helps until you know who to collect from, so start with the audit.
See how device retrieval works without an HR trigger
Read our guide to the device section of a security questionnaire
Related reading
- Answering the device section of a security questionnaire
- Equipment for fixed term staff and interns
- Writing an asset management policy
- What to do about unreturned equipment
- Data protection obligations follow the data rather than the contract type. The UK ICO publishes guidance for organisations, and the NCSC device security guidance applies regardless of who holds the device.
Frequently Asked Questions
Should we issue equipment for non employees at all?
Often yes, particularly when the alternative is board papers or client data sitting on personal machines you cannot see. The important thing is that the decision is deliberate and recorded with a sponsor and a review date, rather than arranged informally by whoever asked.
Who is responsible for a board member’s laptop?
Name a sponsor at the point of issue, usually the company secretary or whoever supports the board. Without a named owner there is nobody to ask when someone steps down, and the device stays out indefinitely because no process is watching it.
How do we get a device back from somebody who was never an employee?
The same way as anyone else, except nothing prompts you and there is no final pay conversation. Make it easy rather than formal: send packaging and a prepaid label and give a date. Most non returns in this group are awkwardness and inertia rather than refusal.
Do acceptable use policies apply to advisors and board members?
It depends what they actually signed. Those policies are frequently drafted for employees and incorporated through an employment contract that a non employee does not have. Check with whoever papers those relationships, and attach the relevant terms to the device issue if they are missing.
What is the quickest win here?
Interns, because they have a fixed end date already. Put the cohort return date in a calendar at the start of the placement and the whole group closes itself. Advisors are the hard case, since there is usually no end date at all.
Should board members use their own devices instead?
Many boards do, with access through a portal and controls at the application layer rather than the endpoint. It removes the asset question entirely and is a reasonable answer where the portal supports it. Check what the portal actually expects before committing to it.
How do we find these devices in the first place?
Ask finance for hardware purchases that were not matched to a payroll record, and ask each department head who outside their team holds company kit. Neither is elegant, but between them they surface most of the population in an afternoon.
