What Happens When Your ITAD Vendor Stops Cooperating?

You may have handed your vendor control over the evidence you need to hold it accountable.

When you rent a car, you walk around it with your phone before you drive off the lot. You photograph every scratch.

You’re not worried about whether the rental company is honest. You’re worried about having to prove a scratch was already there when the rental company says it wasn’t.

Most organizations have more independent evidence protecting a $500 damage deposit than protecting 300 retired laptops full of company data.

In ITAD, the vendor collects the equipment, writes the inventory, issues the certificate, and holds the only record of what it received. That works fine, right up until something goes missing.

The call nobody plans for

You hand over 300 laptops. Your vendor records 297 and issues a certificate for 297. The paperwork agrees with itself, so nobody notices the difference.

Now suppose someone does notice. Three laptops are gone, and they could have disappeared at any of three handoffs: at your site during packing, on the truck, or on the processor’s dock. Your site contact, the carrier, and the processor each hold part of the story, and each has every reason to believe the problem happened somewhere else.

In my experience, the likeliest answer is often the least comfortable one. A few laptops can walk out of your own building during a busy pickup while the carrier is packing, and nobody would notice. I’ve uncovered employee theft during pickups more than once, and wrote about one case in Harvard Business Review. That’s why independent evidence protects an honest vendor as much as it protects you.

You call the vendor. They check their records. “We received 297.”

Now you need to establish what happened. And the only records describing what happened belong to the company whose performance is in question.

When interests diverge

This isn’t a claim about bad vendors. It’s about ordinary incentives.

Before anything goes missing, you and your vendor want the same thing. After, you need to know what happened, and the vendor needs to limit its exposure. Once a potential claim is on the table, the vendor’s response may be shaped by its insurer and its attorneys, who will reasonably advise it not to concede anything its own records don’t show.

The shift happens the moment the question changes from “Where is it?” to “Who is responsible?” From then on, the vendor’s answers are written to protect the vendor. That isn’t bad faith. It’s what any company does when it faces a potential claim, and it happens exactly when you need cooperation most.

Trust works best when nothing is at stake, which is exactly when you don’t need it.

It doesn’t take a breach

Missing equipment is the dramatic case, but it isn’t the common one. Disagreements come up in ordinary ITAD relationships: a count that doesn’t match, an invoice for more units than you sent, remarketing returns lower than expected, damage in transit, a missed deadline.

None of these requires anyone to act in bad faith. All of them come down to the same question: whose records settle it?

Your ITAD vendor isn’t your partner in the way your own team is. It’s a counterparty. Most of the time your interests line up. Your controls should be built for the times they don’t.

A vendor that promises to cooperate is making that promise while cooperation costs it nothing. Plan for disagreement, not disaster.

You handed over the evidence

A processor inventories what it receives. Its certificate describes what it handled. Both can be accurate and still say nothing about the three laptops that never made it into the inventory.

A certificate can establish what a processor says it handled. It cannot prove that nothing is missing.

So when the vendor says “we never received it,” what could you put on the table?

• An independent record of exactly what left your building?
• Identifiers the processor didn’t supply?
• Evidence of when custody transferred, and to whom?
• Proof the equipment reached the facility?

If the answer is no, you don’t really have a dispute. You have one account of what happened, it’s the vendor’s, and you have no practical way to challenge it.

The vendor doesn’t have to prove it received everything. You have to prove it received what you sent.

The incident is still yours

The vendor’s inability to find the device doesn’t transfer the problem. Your organization is still the one that has to:

• Decide whether notification obligations apply, without knowing where the device went
• Answer regulators, auditors, and the board
• Satisfy your insurer with whatever evidence you can produce
• Explain why you can’t rule out the worst case

Morgan Stanley learned this at scale. Decommissioned servers and drives left its control through vendors, some were resold online with customer data intact, and 42 servers from one project could not be accounted for. The bank paid a $60 million OCC penalty, a $35 million SEC penalty, and $60 million to settle a class action. Regulators faulted the bank, not its vendors, including for failing to monitor the vendor’s work and maintain an inventory of the data on those devices.

Your contract may give you remedies. But enforcing them depends on proving what happened, with evidence you don’t have.

What you’re actually paying for

Independent verification looks like an added cost when it’s measured against the wrong thing. It won’t prevent every loss. What it does is turn an uninvestigable problem into an investigable one, with evidence that doesn’t depend on the vendor’s account.

That evidence has one unusual property: you can investigate after an incident, but you cannot retroactively create an independent inventory or a verification hold that never existed.

Once a device is missing, no amount of money will produce a record of what was shipped or what the processor recorded before it saw your list.

So the decision isn’t whether to spend money on verification. It’s which problem you’d rather have when the count comes up short: a discrepancy you can trace, or an incident you can’t explain.

Five controls that change the equation

These don’t make loss, theft, or mistakes impossible. They make discrepancies detectable and give you evidence when questions arise.

1. Identify equipment independently. Apply unique verification tags before equipment leaves your possession, so the record of what was transferred doesn’t come from the processor.
2. Withhold the expected inventory. Don’t share your serial-number list with the processor until it has recorded its own. An inventory built without the answer key is independent evidence; one built from it is not.
3. Reconcile expected against actual. Compare what should have arrived with what the processor reports receiving. Treat unexplained differences as incidents, not paperwork.
4. Hold equipment before processing. Require authorization before anything is destroyed, disassembled, or remarketed, so discrepancies can be investigated while the evidence still exists.
5. Preserve the evidence. Keep custody records, reconciliation results, and a documented history of how each exception was resolved.

The question to ask before the first pickup

Ask your vendor: “If something goes missing and you say you never received it, how will we establish what happened?”

A vendor that welcomes independent verification is agreeing to be held to evidence outside its own control. A vendor that resists reasonable verification deserves a closer look.

Then ask yourself the harder question: if your vendor disputed receiving a missing computer, what evidence would you have that didn’t come from that vendor?

Defensible Disposition

In more than two decades in ITAD, I’ve watched routine projects turn difficult the moment the records didn’t match and nobody could explain why.

You can outsource transportation, processing, and destruction. You can’t outsource accountability. If something goes wrong, your organization is still the one expected to explain the outcome.

That’s the premise of Defensible Disposition: independent verification, segregation of duties, and evidence that doesn’t depend on the processor’s account.

Trust isn’t a control. It’s what you’re left with when you don’t have one.

Take the photos before you drive off the lot.