What should an organization do if an employee loses their laptop owned by the company. The laptop is used for business purposes, has confidential data and is also encrypted. Are there specific measures that an organization can take to minimise the impact of the asset/data loss?
Encryption is definitely the first step...was it full-disc encryption? You might want to look into being able to wipe devices remotely as well, should this happen again. This might help: http://www.rjssmartsecurity.com/How-We-Help/Data-Loss/ I'd reach out to some professionals beyond the forum if it's possible that there was really sensitive information on there.
You have three parts in the loss of the laptop: hardware loss, data loss and data theft.
For data theft, encryption is the right tool, although it would be even better if the data had not been on the laptop in the first place. Moving to a "cloudy" model might be smart: keep the data on some servers (that your company manages) and use the laptop only as a movable terminal to access sessions on the server (Web-based, or even with RDP or NX). This will make the data much safer by avoiding, to a large extent, writing the precious data on the laptop itself.
If you do need to store data on the laptop, try TrueCrypt and make sure that the system "auto-locks" after some inactivity.
For data loss, there again, the cloud model looks better. Otherwise, regular backups, e.g. syncing daily with a company server through a VPN.
For hardware loss, well, too bad, you won't get the laptop back. Hardware is not very expensive. You can make the loss lower by using cheap laptops, which again points at the could model (you need less muscle if the computing does not actually happen on the computer).
A critical point is to make sure that incidents such as a stolen laptop are reported with all the possible alacrity. Therefore, you MUST make it known that a stolen laptop will not imply corporate or financial punishment on the employee to which the laptop was entrusted.
If employees have a direct interest in not reporting laptop theft, then you will not be able to apply defensive maneuvers such as forcing password changes.
You've already taken some good steps with encrypting the device, but there are a few other general things you can do:
Your organisational policy and process should reflect the fact that confidential data should have a shelf-life after which it stops being important. You should make sure that cases where that shelf-life is long are flagged and that data not carried around. For anything else, you want to aim to keep the machine secure for at least as long as the data is valuable, and that should inform your encryption schemes and other access control measures.