You have a lot of the right ideas in your question, Chris. You need to start looking at high level policy to create a framework for 'reducing risk from computer loss'. Typically when I write policies and standards for companies I look at it from a top down and bottom up perspective:
What is the aim? ie what does the board want? Is it zero risk of confidential information getting out? Is it the reduction of physical theft numbers? Worth knowing the driver here.
Then you will have to look at what is manageable - can you mandate desktop locks for stationary PCs and Kensingtons for laptops? Will your policy for laptop users include guidance on storage etc in hotels, temporary sites, transit?
From a technical perspective it is now relatively trivial to use full disk encryption, bios passwords etc, but you need to make sure it is workable in your environment - frameworks needed for ops teams, IT, helpdesk etc. It is one of the simplest ways to remove the risk of data being leaked, but be aware the papers still report loss of encrypted hardware with the usual spiced up headlines, so reputationally you may still feel the impact.
Also think about the requirements in staff agreements around reporting loss / theft. You need to make it very easy for them to report a theft without punishing them, otherwise you won't find out in a timely fashion.