TL;DR
An offboarding policy usually handles notice, access and final pay well, then describes equipment return in a single sentence nobody can act on. Six clauses close that gap, and the one that matters most is when the process starts.
- Start equipment return at notice, not on the last day.
- Give the trigger to the team that learns first, which is HR.
- Name a timeframe you can actually measure against.
- Write the difficult-exit sequence before you need it.
- Say explicitly whether contractors and interns are covered.
- A clause you cannot deliver is worse than one you never wrote.
When a checklist is enough
Four stages, and the first does not need a policy at all.
A handful of people, one office. Somebody leaves twice a year and hands their laptop to the person sitting next to them. A checklist in a shared doc is proportionate.
Best tools for HR Operations
Distributed, low turnover. The handover is no longer physical. You can still manage each case individually, but you will start forgetting things, and the first forgotten laptop is the signal.
Regular departures. Several a month, across locations. Individual handling fails here, not through carelessness but because nothing prompts anybody at the right moment.
Audited or certified. Somebody external will ask you to evidence that access ended and data was removed. Now the policy has to match what you actually do, and the two drift apart quickly.
Why the offboarding policy stops at the laptop
Most of offboarding is information work. Disable an account, calculate a final payment, book a conversation. All of it happens at a desk and all of it can be finished the same day.
Equipment is different because it is physical. It involves a person who no longer works for you, an address you may not hold, a courier, and in some cases a customs declaration. None of that can be completed by clicking something, and none of it is within the control of the person who owns the policy.
So the clause gets written as an obligation rather than a process. “The employee must return all company property.” True, unarguable, and it tells nobody what to do. The result is that equipment return becomes the one step in offboarding that depends on somebody remembering, which is the step most likely to fail.
There is a compliance edge to this too. Asset handling under ISO/IEC 27001 assumes an organisation can recover what it issued, and media sanitisation guidance such as NIST SP 800-88 assumes the device is in your hands before you can wipe it. A device still sitting in a former employee’s flat defeats both, and no amount of policy language changes that.
The six clauses worth writing
- The trigger. What event starts the return, and who fires it. Notice accepted, not last day, and a named role rather than a team.
- Scope. Which populations this covers: employees, contractors, interns, agency staff. The ones you leave out are the ones that slip.
- The route. How collection actually happens, by country if that differs. Naming the mechanism is what turns an obligation into a process.
- Timeframe. A target that matches what your route delivers, stated so it can be measured.
- Difficult exits. Dismissal, abandonment, a dispute. Write the sequence now so nobody improvises later.
- Evidence. What is recorded when a device comes back and is wiped, and where that record lives.
Six short paragraphs. The test for each is whether somebody new to the company could follow it without asking a question, because clauses that always need interpretation are not really policy.
Five questions to settle first
Who finds out first when somebody resigns? That is where the trigger belongs, whatever your org chart says.
Can you collect from every country you employ in? If not, the return clause is aspirational in those markets and you should know which ones.
What is your current average, in days? If you cannot answer, you have no baseline and no way to tell whether a change helped.
Does anything notify you when a contractor’s engagement ends? Usually not, and that is the single biggest population gap.
Who holds the wipe evidence? A named owner and a place, or the certificates accumulate in an inbox and prove nothing.
How teams run returns, and the trade-offs
Ask the leaver to post it. Best for simplicity and cost, and fine domestically with a prepaid label. It struggles on packaging, on batteries in air freight, and on the fact that compliance is entirely voluntary once somebody has left.
A manager collects in person. Best for small teams in one city, and the fastest when it works. It struggles the moment anybody is remote, and it quietly puts a difficult conversation on somebody with no training for it.
Courier booked case by case. Best for control over timing. It struggles on admin, since each collection is a fresh set of decisions, and on cross-border paperwork, which is where most of them stall.
Local IT partner in each market. Best where you have real density. It struggles on coverage for your long tail of one-person markets, and on consistency, because each partner records things differently.
A lifecycle service handling collection and wiping. Disclosure: RemoAsset is owned by the same people who publish this site. It handles retrieval, storage and certified wiping across 80 or more countries, which matters here because the return clause only means something where collection is possible. Where it struggles: it will not write your policy, decide your deduction position or tell you a contractor’s engagement has ended, which are the parts that stay with you. The narrow thing it changes is whether a device in another country actually comes back.
The decision table
| Situation | Scale | Setup | Primary pain | Recommended starting point |
|---|---|---|---|---|
| One office, rare exits | Under 20 | No IT owner | Barely arises | A checklist, not a policy |
| Remote, few departures | 20 to 50 | Part time owner | First forgotten laptop | Write the trigger and the route |
| Several exits a month | 50 plus | One HR owner | Depends on memory | Fire the trigger from the HR event |
| Contractors and interns | Any | Any | No leaver signal at all | Define scope, then find the signal |
| Several countries | 100 plus | HR team | Route differs per market | One route that covers the long tail |
| Audit or certification | Any | Security owner | No wipe evidence | Name the record and its owner |
What the gap costs
The first cost is the devices themselves, and it is easy to underestimate because it arrives one laptop at a time. Nothing about a single unreturned machine looks like a problem. Three years of ordinary turnover is a different number, and it sits in no budget line.
The second is the data position. A device you did not recover is a device you did not wipe, so every claim you make about removing access has a hole in it exactly where the hardware is. That hole is invisible in your identity system, which will happily report the account as disabled.
The third is inconsistency, which is the one that reaches a tribunal. Two people leave the same month, one is chased hard for a laptop and the other is not, and the difference has nothing to do with policy because there was none to apply.
The fourth is the slow one. Without a stated timeframe nobody knows what good looks like, so returns drift from two weeks to six and no single step in that drift ever looks wrong.
So the useful question is not whether your policy requires equipment back. It is how many days your last ten returns actually took, and whether you can say.
When the policy needs a route underneath it
A return clause is a promise that hardware comes back. The promise is only as good as the mechanism behind it.
Three signals say the mechanism is the weak part. You processed fewer returns last year than you had leavers. Collections from outside your main market took weeks or quietly never completed. And the process starts when somebody notices rather than when notice is given.
None of those is fixed by better wording. They are operational, and a stricter clause you cannot deliver is worse than a loose one, because it creates an expectation you then miss in front of an auditor.
Worth settling before the next policy review, since this is the clause most likely to read well and behave badly. Looking at how collection, storage and certified wiping run as one tracked process answers whether your gap is in the document or underneath it.
See how wipe certificates are issued per device
Read our guide to unreturned equipment
Related reading
- What to do about unreturned equipment
- IT asset recovery, practically
- Evidencing equipment compliance
- Deductions from final pay
- Fixed-term staff and interns
Frequently Asked Questions
What should an offboarding policy cover?
Notice handling, access revocation, knowledge handover, final pay and equipment return. The first four are well served by templates. Equipment is the one that depends on logistics you may not have, which is why it gets written vaguely or left out altogether.
Who should own the process?
One named role that sees every departure, which in most companies is HR rather than IT. IT can disable accounts, but only HR reliably knows that somebody is leaving. Giving the trigger to the team that learns last is how devices get forgotten.
When should equipment return start?
At notice, not on the last day. Arranging a collection takes days and sometimes weeks across borders, so a process that begins when somebody walks out has already lost the easiest window. The exception is a dismissal, where the sequence changes and should be written separately.
Can we withhold final pay until kit comes back?
Deductions from final pay are governed by local employment law and by what the individual agreed in writing, and the position differs by jurisdiction. Take local advice rather than copying a clause from a template. Relying on it also tends to produce disputes rather than returned laptops.
What about contractors and interns?
They are the most common gap, because the leaver trigger usually fires from the payroll or HRIS record and contractors often sit outside both. If your policy covers only employees, write a line that says which other populations it applies to, then check that something actually notifies you when their engagement ends.
How do we handle somebody leaving badly?
Write the sequence in advance, because deciding during a difficult exit looks punitive and tends to be inconsistent. State what happens to access immediately, what happens to the device, and who makes the call. The point is that nobody has to improvise on a bad day.
Should the policy name a timeframe?
Yes, and a realistic one you could actually measure against. A clause with no timeframe cannot be assessed, so nobody can tell whether three weeks is normal or a failure. Set a target that matches what your collection route actually delivers, then change the route if the number embarrasses you.
