The best way for a mid-size company to handle remote employee laptop retrieval is to build it into the offboarding workflow itself: trigger laptop retrieval the moment a departure is confirmed, lock the device through MDM but keep it enrolled, revoke access in a staged order that matches the employee’s risk profile, send a prepaid return kit or schedule a door pickup, track every custody handoff against one asset record, inspect and sanitize the device on arrival to NIST SP 800-88, and route it immediately to redeployment, storage, resale or recycling. One accountable owner and one system of record. When responsibility is split across HR, IT, Finance, local offices and couriers with nobody owning the final outcome, devices get delayed, lost or forgotten.
When an employee leaves an office, recovering their laptop can be as simple as walking it to IT. When that employee works remotely, possibly in another country, the same task becomes a coordinated logistics, security and asset-management process. This guide shows mid-market IT and People Operations teams how to build that process end to end: the four custody handoffs, the eleven-step workflow, the legal guardrails the FTC and Department of Labor put around it, what to do when a former employee goes quiet, and how to measure the program so it doesn’t drift back to ad hoc. If you want the day-by-day timeline on its own, see our 9-step remote laptop retrieval workflow; this post is the program layer above it.
Most companies do not lose laptops during offboarding. They lose them in the gap between offboarding and retrieval, when HR has closed the ticket, IT has revoked access, and nobody owns a machine sitting in a former employee’s closet in another state or another country.
Every offboarding checklist has a line that says “collect company equipment.” The problem is where that line sits: item fourteen of twenty, owned by nobody in particular, no date attached, no definition of done. That works when the employee walks past the IT desk on their way out. It stops working the moment the workforce is distributed, because the physical handoff the process assumed has disappeared.
Buyers feel this before they can name it. In GroWrk’s analysis of 3,977 customer calls recorded between April 2024 and August 2026, offboarding and retrieval was raised unprompted by the customer, before any GroWrk representative mentioned it, on 795 calls, or 22.6%. That puts it in a statistical tie with storage and MDM enrollment as the most common topic buyers bring up on their own, ahead of speed, certified wipe, HRIS integration and pricing. The pattern in those conversations is consistent: the buyer arrives with a handful of devices they cannot account for, a security team asking why a departed contractor’s laptop is still checking in, or a finance lead who noticed the fleet count and the headcount stopped matching. Retrieval is the symptom. The cause is that offboarding was designed as an access process and a paperwork process, with the physical asset bolted on at the end.
The Federal Trade Commission frames it the same way from the compliance side. Its guidance for businesses says to “have a procedure in place for making sure that workers who leave your employ or transfer to another part of the company no longer have access to sensitive information,” and to “collect keys and identification cards as part of the check-out routine.” It explicitly includes laptops, mobile devices, employees’ homes and offsite storage in a complete data inventory (FTC: Protecting Personal Information). An incomplete offboarding creates three exposures at once: security, because a former employee may retain access or locally stored data; financial, because equipment that could have been redeployed gets replaced; and operational, because inaccurate records make inventory planning, audits and the next hire harder.
The fix is to treat laptop recovery as one of three parallel tracks of employee offboarding, alongside the access track (SSO, email, SaaS, MDM) and the people track (final pay, benefits, exit interview). Each track has an owner, a trigger date and an evidence trail. The rest of this guide is the asset track.
Chain of custody is a legal term, but for an IT team it is a practical one: for every device, who had it, when it changed hands, and what proves it. For remote equipment return there are exactly four handoffs where custody moves, and each is a place a device can quietly disappear. A courier tracking number covers only one of them.
Handoff one: from the People team’s decision to IT’s action. A resignation is accepted or a termination is decided, and IT must learn about it with enough lead time to act. When this fails, IT finds out from a deprovisioning ticket on the last day and retrieval starts already behind. The evidence is a timestamped offboarding record in the HRIS or ticketing system naming the departure date, the return address on file and the assigned assets. If your HRIS integration feeds the asset system, this fires automatically; if not, it is the single highest-leverage integration to build, because it gives every other step its start date.
Handoff two: from the company to the employee. The employee has had the device for months, but this is the moment the company formally asks for it back and the employee formally acknowledges. The evidence is a written return confirmation of address, serial, accessories and return window. It is also the moment the return kit ships, so the employee never has to source a box.
Handoff three: from the employee to the carrier. This is the handoff most companies never see and where most devices stall. A prepaid label with no pickup relies on a person who has stopped being paid driving to a drop-off point on their own time. A scheduled door pickup removes that dependency. The evidence is the carrier’s acceptance scan, the first moment the device is provably out of the employee’s hands.
Handoff four: from the carrier to your warehouse or bench. Delivery is not receipt. A box arriving at an office where nobody expects it can sit for weeks. The evidence is an intake record: serial verified against the assignment, condition graded, accessories reconciled, sanitization logged with a certificate. Only when that record exists is the device recovered.
Write down who owns each handoff and what artifact proves it happened, and update the same asset record at every one. A device is never simply “with the employee” or “in transit.” It is at handoff two waiting on confirmation, or at handoff three with a label created but not scanned. That granularity is what lets you intervene at the right point instead of sending a fourth generic reminder. Creating a shipping label is not the same as recovering the laptop.
The retrieval process starts at deployment. The equipment policy should state which devices and accessories belong to the company, the employee’s duty to keep them secure, how they must be returned at separation, who pays for packaging, shipping and duties, the return timeline, what happens if equipment is damaged or unreturned, how personal information on the device will be handled, whether the company may remotely lock or wipe it, and who to contact for help. Employees acknowledge it when they receive equipment, and the asset record captures tag, serial, model, configuration, assignee, delivery address and assignment date. A template clause is at the end of this post. Do not assume the company can deduct an unreturned laptop from final wages; see the compliance section below.
HR, IT, Security, Finance and Operations all participate, but one function owns the final outcome and stays responsible until every device reaches a documented final state.
| Function | Primary responsibility |
|---|---|
| People Operations | Confirm the departure date and provide approved personal contact information |
| IT and Security | Revoke access, lock the device, confirm which assets are assigned |
| Operations or retrieval provider | Coordinate packaging, collection, transportation and delivery |
| Warehouse or service center | Receive, inspect, record, sanitize and prepare the equipment |
| Finance | Record losses, damage charges, resale proceeds or replacement costs |
| Legal | Advise on disputed returns, legal holds, investigations and local employment rules |
Every offboarding should open an equipment-recovery case automatically, ideally from the HRIS, identity provider, ITSM or device lifecycle platform. The case carries the employee’s name and personal contact details, confirmed collection address, last working day, departure type, assigned devices and serials, return deadline, device-security status, preferred return method, destination warehouse, and any legal hold or special handling requirement. Timing of employee communication follows the departure scenario: a voluntary departure usually allows the return to be arranged before the last day; an involuntary or higher-risk departure may require IT and Security to disable access before retrieval communication begins.
Digital offboarding and physical recovery are related but not interchangeable. Recovering the laptop does not revoke cloud access, and disabling accounts does not remove data stored locally on an unreturned device. Depending on the risk profile, IT disables identity-provider and SSO access, revokes sessions and tokens, removes VPN, email and application access, rotates shared credentials, confirms disk encryption is enabled, and locks the device through MDM.
The order matters, and this is where well-intentioned security policy most often sabotages retrieval. The instinct is to wipe on day zero. Don’t. A full wipe removes the MDM agent, so you lose location, the ability to lock or message the device, and the evidence trail if it never returns. It also removes your one piece of leverage: a locked device is useless to the former employee and therefore motivates a return; a wiped device is just a laptop. The sequence that works is lock-but-keep-enrolled with a lock-screen message naming the company and the return process, stage access revocation so the return portal stays reachable, send the retrieval link, and issue the full wipe on physical receipt or when the case is formally closed as unrecoverable. Disk encryption, which the FTC explicitly recommends for laptops and portable devices, means the locked device exposes nothing in the meantime.
One carve-out: a remote wipe should never be automatic. If the device is subject to litigation, an investigation, a security incident or any other legal hold, coordinate with Legal and Security before deleting anything. The FTC’s breach-response guidance is explicit that organizations should preserve forensic evidence during an investigation (FTC: Data Breach Response Guide).
Do not rely on the employee to remember what was issued. Reconcile three sources while the person is still on payroll and answering messages: what MDM says is enrolled, what the IT asset management system says is assigned, and what the original shipping record says was sent. At mid-market scale these disagree more often than anyone expects: a swapped device after a repair, a monitor never logged, a loaner that became permanent. The retrieval request then shows the employee a clear list of expected items: laptop, monitor, phone, tablet, dock, security key, external drive, specialized equipment. Decide which accessories are worth recovering. Retrieving a low-value keyboard internationally can cost more than replacing it; weigh replacement value, shipping cost, data sensitivity and employee experience.
Most departing employees are willing to return company property. Delays happen because the process demands effort or gives unclear instructions. The company pays for the return and offers the method that fits the location and the equipment: a prepaid label where the employee has packaging and a nearby carrier; a retrieval kit with protective box, materials, instructions and label delivered to their door; a courier pickup from the home; white-glove collection where a trained provider packs onsite; or drop-off at a controlled office or approved local partner.
No single method works everywhere. Across more than 10,000 devices GroWrk recovered over a recent 12-month period, roughly 40% of returns used a retrieval kit, 20% a prepaid label, 20% a courier pickup and 20% an office or local partner. A flexible process outperforms forcing every employee through the same channel.
Recovery happens at a sensitive moment. The message should be firm and professional without sounding accusatory, and it should say what must be returned, how the return works, whether packaging is provided, the deadline, how to schedule or reschedule a pickup, where to get help, and how the employee will receive confirmation. Every message references the same case number and comes from the same channel, so the employee never has to work out who is asking. Automate reminders, but don’t rely on automation alone. A practical cadence: day 0, instructions and address confirmation; day 2, reminder if unconfirmed; day 5, second approved contact channel; day 7, internal escalation to the retrieval owner and People Operations; day 10, reissue the label or change the return method if logistics are the blocker; day 15, refer unresolved cases for management or legal review under policy. Every open case always has a next action, an owner and a date.
A defensible record shows which asset was assigned, when retrieval was initiated, who confirmed the address, which return method was authorized, when and where the carrier collected, every transportation event, who received the package, which serials were physically received, the condition of each, and what happened next. Use tamper-evident packaging, trackable transport, delivery confirmation, controlled receiving locations and access logs for stored devices. Each handoff updates the same asset record so that exceptions, a missing device, a swapped serial, a damaged shipment, an incomplete return, are visible immediately.
The process is not complete when the package reaches a warehouse. Receiving photographs the package and device, verifies the serial, compares received items with the request, records cosmetic and functional condition against a consistent grading standard, identifies missing components, tests power-on, confirms activation-lock or account status, places the device in controlled storage and updates its lifecycle status. If the serial does not match the assignment, the case stays open until the discrepancy is resolved.
Deleting files or running a factory reset may not satisfy security or compliance requirements. The FTC is blunt on the distinction: deleting files “usually isn’t sufficient because the files may continue to exist on the computer’s hard drive,” and disposal should use software that overwrites the drive. Maintain a media-sanitization policy based on data sensitivity, storage media type, whether the device stays inside the company or is resold, recycled or destroyed, and contractual and regulatory requirements. NIST Special Publication 800-88 Revision 2, finalized in September 2025, is the current reference for building that program (NIST SP 800-88 Rev. 2). The record for each device identifies asset and serial, method, date, operator or provider, verification result, exceptions and certificate reference. Buyers already expect this: certified wipe, SOC 2 and destruction came up unprompted on 425 of the 3,977 calls we analyzed (12.1%). If a retrieval vendor cannot hand you a certificate per serial, they are a courier, not a recovery partner.
Recovery creates value only when the device moves to its next lifecycle stage: redeploy to the next hire, repair first if needed, store as ready inventory in the correct region, resell to recover residual value, or recycle and destroy through an approved provider with records retained. Make the decision a written rule, not a monthly conversation: devices under a certain age and above a certain grade get re-imaged and redeployed, ideally from in-country storage so they are never re-imported; devices past the redeploy threshold go to buyback; devices below resale value are recycled with a certificate of destruction. Buyback deserves more attention than it gets. It came up unprompted on 375 of 3,977 calls (10.7%), and the complaint is rarely that the option is missing. A global tech-talent company told us of their current vendor: “the buyback option they’re giving me is terrible.” A program that ends at “device received” leaves the residual value of the fleet on the table every quarter.
Two federal sources are cited in almost every serious discussion of company asset recovery. It is worth being precise about what they say rather than what people assume they say.
FTC, Protecting Personal Information. Treats offboarding as a data-security control: terminate access and collect equipment as part of check-out, encrypt “sensitive information that is stored on your computer network, laptops, or portable storage devices used by your employees,” restrict laptops to employees who need them, and wipe rather than delete on retirement. Read together, that is the legal shape of the asset track: collect at check-out, encrypt so a delay in return is not an exposure, sanitize properly on receipt.
FTC, Data Breach Response. The uncomfortable corollary is what happens when the device never comes back. The guide notes that all states, the District of Columbia, Puerto Rico and the Virgin Islands have enacted breach-notification laws covering personal information. Whether an unreturned, encrypted, locked laptop is a notifiable breach depends on the state, what was on the device and whether encryption was in place; that is a question for counsel. What is not in question is that you will have to answer it, which means being able to say what was on the device, whether it was encrypted and when it was last seen. The chain-of-custody record from the four handoffs is that answer. A company that can produce it has a defensible position; a company that cannot has a forensics engagement.
Department of Labor, FLSA. This is where People Ops needs to be in the room. The DOL’s FLSA reference guide states that deductions “for such items as cash or merchandise shortages, employer-required uniforms, and tools of the trade, are not legal to the extent that they reduce the wages of employees below the minimum rate required by the FLSA or reduce the amount of overtime pay due” (DOL: Handy Reference Guide to the FLSA). An unreturned laptop is, for these purposes, a tool of the trade. The practical rule: do not deduct unreturned equipment from a final paycheck without advance written authorization, without checking state law (several states prohibit such deductions outright or require specific consent), and never in a way that drops pay below minimum wage or reduces overtime. Withholding the entire final paycheck pending return is a separate and generally worse idea; most states set a hard deadline for final pay regardless of what the employee still holds. Outside the US, rules vary by country. Have employment counsel review the policy in every jurisdiction where you employ people.
None of this is legal advice. The point is that the levers HR reaches for instinctively carry the most legal exposure and the least evidence of working. The levers that do work, a locked device, a door pickup and a fair purchase option at market value for older hardware, carry none.
A missing laptop is an exception with a defined path, and the first job is diagnosis, not enforcement. Most non-returns are not malicious: the employee never got the instructions, the address or phone number is wrong, there is no suitable packaging, the carrier doesn’t serve the address, a pickup failed, the label expired, the employee moved, customs paperwork is missing, or they dispute which items are the company’s. Resolve operational barriers first: reissue the label, send packaging, offer a pickup, use a local collection partner.
If the employee remains unresponsive, People Operations or Legal takes over communication under policy and applicable law, while IT ensures access is revoked and the device is locked, or wiped where technically possible and legally appropriate. Three things to avoid: threatening consequences the company won’t follow through on, which trains every future departure to ignore you; letting a device sit in “pending” indefinitely, because an enrolled device nobody is chasing is still your liability and still not coming back; and running escalation through a shared inbox rather than one named owner per case through to closure.
“The Company will provide you with equipment necessary to perform your role, which remains Company property at all times. Upon separation of employment for any reason, or upon request, you agree to return all Company equipment, accessories and materials within seven (7) days using the return method the Company provides at no cost to you. You agree to keep the equipment in good condition, to notify IT promptly of loss or damage, and not to attempt to remove Company management software from any device.” Have counsel review against the states and countries you employ in.
Subject: Returning your company laptop, case [number]. Hi [name], as part of your offboarding we need the following back: [device model, serial], [accessories]. Your device has been locked but not wiped, so please don’t try to reset it. We’ve scheduled a courier to collect from [address on file] on [date]; you can change the date here: [link]. If you’d rather drop it off, a prepaid label is at the same link. Everything is at no cost to you. Questions go to [named owner] at [email]. Thank you for taking care of this.
Subject: Outstanding company equipment, final return date [date]. Hi [name], our records show the following company equipment has not been returned: [items, serials, replacement value]. Under the equipment agreement you signed on [date], this equipment must be returned within seven days of separation. Please schedule a free pickup or drop-off by [final date] here: [link]. If we don’t receive it by that date, we will [close the case and treat the device as unrecoverable / refer the matter to counsel], and the device will remain locked and unusable. If there’s a reason the return has been difficult, reply to this email and we’ll work it out. [Named owner, title]
Every published laptop retrieval process, including the ones written by retrieval vendors, quietly assumes a domestic return. That is where mid-market teams with a distributed workforce get hurt, and the failure has two shapes.
The first is customs. A laptop shipped from Brazil, India or the Philippines to a US address is an export from one country and an import into another, with declared value, HS code, duties and paperwork attached, and often a local entity required to import into. Get it wrong and the device sits in a bonded warehouse accruing storage fees until someone pays to release it or abandons it. Customs, borders and duties came up unprompted on 216 of 3,977 calls (6.1%), concentrated in a few markets. India appears in more of our customer conversations than any other country, 665 calls across 386 accounts, and one buyer’s question captures why: “US/UK is a bit simpler, but how are you going to navigate around the India e-way bills?”
The second is coverage. A buyer told us: “The issue we’re having in El Salvador and the Philippines is there’s no CDW, there’s no VARs out there that could just ship the devices. And there’s also no one to collect.” No local courier relationship, no local warehouse, no local pickup, and a domestic playbook with no branch for it.
The workflow answer is a branch at step three: if the return address is outside the country the device will be redeployed in, do not ship it home. Collect it locally, sanitize and store it in-country, and redeploy it to the next hire in that region. The device never crosses a border and never re-enters your import queue. This is why storage and warehousing, at 800 of 3,977 calls (22.8%), is the single most common topic buyers raise with us unprompted. It is the same problem as retrieval, seen from the other end.
A laptop retrieval program should be measured by outcomes, not by labels created, and an unmeasured one drifts back to ad hoc within two quarters. Report these monthly to IT, People Ops and Finance; each owns a handoff and each will see its own number move.
| Metric | What it measures |
|---|---|
| Retrieval success rate | Share of requested assets recovered, by quarter and by country |
| Request-to-contact time | How quickly the employee receives return instructions |
| Address-confirmation time | Delay before logistics can begin (handoff two) |
| Request-to-collection time | Median time to carrier scan (handoff three) |
| Request-to-warehouse time | Total recovery cycle time (handoff four) |
| First-attempt pickup success | Quality of address validation and coordination |
| Damage rate | Packaging and transportation performance |
| Serial-number match rate | Accuracy of asset records against returned equipment |
| Sanitization coverage | Share of recovered devices with a certificate on file; should be 100% |
| Cost per recovered device | Overall retrieval efficiency |
| Ready-to-redeploy time | How quickly recovered equipment becomes usable |
| Unresolved aging | Open cases beyond the target SLA |
| Residual value recovered | Redeployment savings plus resale proceeds; the number that renews the budget |
For a benchmark: GroWrk recovered 10,257 devices across 98 countries over a recent 12-month period, with a 99% retrieval success rate and a median request-to-warehouse time of 14 days. Results at that scale depend on more than shipping labels. They require persistent employee communication, multiple collection methods, local logistics coverage, chain-of-custody visibility and active exception management.
One note on how the program is paid for. Retrieval-only vendors tend to price per event; one buyer described it precisely: “Every time I want to deliver a laptop or retrieve it, I pay $85.” That is a fine price for a retrieval and a poor one for a program, because it makes every step of the lifecycle a separate purchase decision. Per-seat platforms have the opposite problem: two of the three competitors buyers name most often in our calls draw the same complaint, that they charge for every person in the HRIS whether or not that person holds a device, and offboarding is exactly the moment a departed employee with no device is still a seat until someone remembers to remove them. GroWrk pricing is per device under management, which is the unit that actually moves during retrieval.
Trigger retrieval the moment the departure is confirmed, before the final day where possible. Reconcile the assigned device and confirm the collection address, lock the device through MDM but keep it enrolled, stage access revocation so the return link still works, send a prepaid retrieval kit or schedule a door pickup, and track the device through carrier scan, receipt, inspection and sanitization against one asset record. Assign one owner to run reminders and exceptions until the device reaches a controlled facility. Wipe on receipt, not on departure.
One team is accountable for the result even though several participate. People Operations triggers the departure workflow and supplies contact details, IT and Security revoke access and confirm assigned assets, and an operations team or retrieval provider owns physical recovery through verified receipt and sanitization.
Not on day zero, and never automatically. Lock the device and keep it enrolled so you retain visibility, evidence and leverage; disk encryption covers the exposure in the meantime. Wipe when the device is physically received or the case is formally closed as unrecoverable. If the laptop is subject to a legal hold, investigation or forensic review, do not wipe without approval from Legal and Security.
Federally, the FLSA prohibits deductions for tools of the trade that reduce pay below minimum wage or cut overtime, and many states restrict or prohibit such deductions further. Get advance written authorization, check state and country law, and consult counsel. In practice the levers that work, a locked device, an easy pickup and a fair purchase option, carry none of this risk.
No. The company provides packaging and prepaid transport, or a scheduled pickup. Removing cost and logistical friction is the single biggest driver of response time and retrieval rate.
Seven days from the last day is standard, with reminders at days two and five, internal escalation at day seven and a formal notice around day fifteen. The window matters less than the friction: a scheduled pickup inside seven days beats a self-serve label with a thirty-day deadline.
Not necessarily. The method depends on storage technology, data sensitivity and intended disposition. Maintain a documented sanitization standard aligned to NIST SP 800-88 Rev. 2, verify completion and retain a certificate per serial.
Branch the workflow at the trigger. If the device will be redeployed in the same region, collect it locally, sanitize and store it in-country, and issue it to the next hire there. Shipping it across a border to headquarters, only to ship it back out again, is the slowest and most expensive option available.
Inspect and reconcile, sanitize with a certificate, then apply a written disposition rule: redeploy, repair, store in-region, resell through buyback, or recycle with a certificate of destruction. It should never sit indefinitely in an undefined warehouse status.
Remote employee laptop retrieval is not a shipping task with a security footnote. It is the reverse side of deployment and a core part of IT asset management: a workflow with four custody handoffs, an order of operations on the last day, a compliance floor set by the FTC and the FLSA, and a disposition decision that either recovers value or leaves it in a closet. The strongest programs know which employee has each asset, trigger recovery automatically, remove friction for the departing employee, preserve chain of custody, manage exceptions actively, and connect every returned device to a defined next step.
GroWrk runs that workflow as one operation across the countries our customers hire in: HRIS-triggered offboarding, MDM lock-and-hold, retrieval kits and scheduled pickup, in-country sanitization and storage, certified data destruction, buyback and resale, and per-serial chain of custody, priced per device under management. Instead of coordinating employees, couriers, warehouses and local partners separately, IT teams manage the physical device lifecycle through a single system of record.