01 Oct Suspected Employee Theft: How to Investigate
Suspect an employee is stealing? How to investigate without compromising the evidence
A stock discrepancy, missing cash or unusual access record can raise an uncomfortable question: is someone inside the business stealing?
Suspicion is a reason to investigate, not a finding of guilt. Acting too quickly can alert the people involved, cause records to disappear and undermine a fair employment process. The first task is to secure the information you already have and establish what actually happened.
Start with the facts, not an accusation
Record what prompted the concern. Identify the missing goods or funds, when the loss was noticed, who reported it and which records may help explain it. Keep observations separate from assumptions.
A shortage does not, by itself, identify the person responsible. An inventory error, weak access controls, incorrect transaction or activity involving a contractor may also need to be examined. Avoid discussing a suspected employee’s name widely while the facts remain unclear.
Preserve records before they disappear
Relevant records may include CCTV footage, access logs, stock movements, till transactions, delivery notes, invoices, system activity and incident reports. Some systems overwrite or delete records after a set period, so preservation should begin promptly.
Assign a responsible person to secure the material. Keep an original copy where possible, record who collected it, when it was collected and where it is stored, and limit access to people who need it for the investigation. Do not edit a recording or circulate clips in staff WhatsApp groups.
Personal information gathered during an investigation must also be handled responsibly. South Africa’s Protection of Personal Information Act requires appropriate safeguards for the integrity and confidentiality of personal information.
Look for a pattern and test other explanations
Compare the available sources rather than relying on one suspicious incident. For example, a stock shortage may need to be checked against delivery records, returns, access times and camera coverage. An unusual system login may require confirmation that the account was used by its assigned holder.
Set a clear scope for the investigation:
- What loss or conduct is being investigated?
- What period is relevant?
- Which records and witnesses may help?
- Who will review the evidence?
- How will confidential information be protected?
Documenting the scope helps keep the enquiry focused and reduces the risk of collecting irrelevant information.
Speak to witnesses carefully
Interview people who may have direct knowledge of an event or process. Ask open questions and record their answers accurately. Do not tell a witness what another person supposedly said or invite speculation about who “must have done it”.
If an employee is implicated, give them a proper opportunity to respond through the applicable workplace process. An investigation should establish facts; the decision about disciplinary action comes later. South Africa’s Code of Practice: Dismissal provides the framework for assessing the fairness of dismissal for misconduct. Employers should involve their HR or labour adviser when considering suspension, disciplinary action or dismissal.
When is an independent investigation useful?
Some cases are difficult to resolve internally. Losses may recur despite CCTV and access controls. Several employees or contractors may have access to the same goods. A manager may be implicated, or the business may suspect that people are working together.
An independent investigator can help define the enquiry, assess information from different sources and report findings without relying on workplace rumour. Where appropriate, an undercover workforce investigation may help identify recurring theft, policy breaches or security weaknesses that are not visible from records alone.
SSC Legacy’s undercover workforce investigators gather and report operational intelligence on matters including workplace theft, misconduct and security loopholes. The appropriate method depends on the concern and the organisation’s circumstances.
A practical first response
If you suspect employee theft, take these five steps:
- Record the concern and the facts that led to it.
- Secure relevant records before they are overwritten or lost.
- Restrict access to the material and document who handles it.
- Check alternative explanations and gather information objectively.
- Get specialist assistance if the matter is complex, ongoing or likely to lead to disciplinary or criminal proceedings.
A careful investigation protects the business while also protecting employees from conclusions based on incomplete information.
Discuss a confidential workplace investigation
If your organisation is dealing with unexplained losses, suspected employee theft or possible collusion, contact SSC Legacy to discuss the concern and an appropriate investigation. Early, properly scoped action can help you establish the facts and identify weaknesses that allow losses to continue.