It looks like you are already aware of the 1st part of this question. For most purposes any non-volatile storage which may have held he data you consider sensitive should be included (solid state drives, hard drives, EPROMS, USB keys etc) but volatile memory should not. These storage devices could be in printers, fax machines, routers, switches, any computing platform.
A key prerequisite is understanding what you consider sensitive - eg the configuration of a router may need to be protected to avoid weakening network security, or devices storing personal or account data may come under DPA in the UK, or GLB or HIPAA in the US. A general rule of thumb is to look to the organisation's data classification policy as a guide and destroy data storage which comes under data protection requirements.
The in-house/outsource question could come down to just how sensitive the data is. I recently sat in an excellent presentation on data destruction in the military, where complete outsource was not an option, and complete destruction was a requirement, so the use of grinders which could take entire hard drives down to dust was approved. For many organisations who use hard disc encryption, a provider who carries out multiple overwrites to the extent that recovery is unfeasible may be sufficient. This will depend on both the level of sensitivity and the type of agent who may be trying to recover the data. If an attacker has an electron scanning microscope, they may be able to retrieve useful data off a hard disc platter which has been broken into pieces - but that is only likely to happen if the data is known to be of extremely high value.
Either way, auditable reporting of the destruction is essential - so you can evidence you received all the devices, and destroyed them, along with the destruction mechanism and final disposal details.