Wait until you see verification of the IT policy hitting the device if you are concerned about the data. Then call the carrier to have it marked as stolen. If you call the carrier first, the data portion will be shut down and the IT policy will not make it to the device. Same thing with removing the user from the bes, if done the kill will not go through unless it has been accepted by the network. Also, be prepared to file a police report if required.
Then call everyone and cancel the police report after the user finds it sitting in a couch or at the bar or something