A missing cash deposit, inventory that repeatedly falls short, or a vendor payment that does not match the work performed can put a business owner in an impossible position. Acting too quickly may expose the company to a wrongful accusation. Waiting too long may allow losses to continue. Documenting workplace theft creates a factual record that helps leadership respond with discipline, discretion, and defensible evidence rather than suspicion alone.

For California employers, the stakes are especially high. Employees have privacy rights, labor rules can affect how interviews and monitoring are handled, and a poorly managed internal inquiry can damage morale or become part of a later legal dispute. The goal is not to build a case against the person who seems most suspicious. It is to establish what happened, when it happened, who had access, and what evidence can be verified.

Start Documenting Workplace Theft Before Confronting Anyone

The first response to suspected theft should be preservation, not confrontation. A manager who accuses an employee before reviewing the facts may alert the person involved, encourage the destruction of records, or create an unnecessary employment claim. Keep the initial circle of knowledge small and limit discussions to decision-makers with a legitimate need to know.

Open a confidential incident file and record the concern in plain, objective language. State the date the issue was discovered, the person who discovered it, the item or funds involved, the estimated loss, and the business records that raised the concern. Avoid statements such as “John stole $2,000” unless there is evidence that supports that conclusion. A better entry is: “On May 14, the daily deposit report reflected $2,000 more in cash receipts than the bank deposit record.”

This distinction matters. Facts are easier to verify, and they protect the credibility of the investigation if the matter reaches counsel, law enforcement, an insurer, or a court.

Build a Clear Timeline

A timeline often reveals whether a loss is an isolated error, a process failure, or a deliberate act. Begin with the last confirmed date the asset was present or the account balanced. Then document each relevant event: shift changes, deliveries, refunds, system access, alarm activity, inventory counts, bank deposits, and communications about the discrepancy.

Use original records whenever possible. Preserve point-of-sale reports, accounting ledgers, timecards, access-control logs, delivery receipts, surveillance footage, email messages, text messages on company devices, and relevant audit trails. Note where each item came from and who collected it. If a video clip is exported, preserve the original file as well as any working copy used for review.

A gap in the timeline does not prove theft. It identifies the next question that needs to be answered. Perhaps several employees had access to a stockroom. Perhaps a software setting changed. Perhaps a cash-handling procedure was not followed. A professional inquiry considers each reasonable explanation before reaching a conclusion.

Preserve Evidence Without Crossing Legal Lines

Evidence is only useful if it was collected lawfully and can be explained later. Employers generally have more latitude to review company-owned accounts, equipment, work areas, and business records than personal devices or private communications. Even so, policies, employee notices, union agreements, and the location of the workplace can affect what is appropriate.

Do not ask a supervisor to search an employee’s purse, vehicle, locker, or personal phone without clear legal authority and a sound reason to do so. Do not install hidden recording devices in areas where privacy is expected, such as restrooms or changing rooms. California has strict privacy and recording laws, and an aggressive shortcut can compromise an otherwise valid case.

Digital evidence requires particular care. Preserve user activity logs before accounts are changed or deleted. Document the date and time of each export, the system used, and the employee or administrator who performed it. If company emails, cloud files, or security-camera footage are relevant, avoid editing originals. Screenshots can be helpful for orientation, but they should not replace complete source records.

When the potential loss is substantial, repeated, or tied to a trusted employee, vendor, or executive, it is often prudent to involve employment counsel and a licensed investigator early. That decision depends on the circumstances. A minor inventory discrepancy may be resolved through improved controls, while suspected embezzlement, payroll fraud, theft of trade secrets, or coordinated vendor fraud calls for a more formal strategy.

Separate Facts From Assumptions

The strongest workplace theft files make a clean distinction between what is known and what is inferred. If an employee’s credentials were used to issue a refund, the known fact is that the credentials processed the refund. It does not automatically establish who was physically at the keyboard. Shared passwords, unattended terminals, unauthorized access, and weak controls must be considered.

For every material event, document the supporting source. A shortage may be supported by a count sheet, a bank record, a video timestamp, and a witness statement. When those records align, the finding becomes more reliable. When they conflict, record the conflict rather than forcing the evidence to fit a preferred theory.

Witness accounts should be collected promptly, privately, and without coaching. Ask open-ended questions first: what did you observe, when did you observe it, and who else was present? Record the witness’s own words as accurately as possible. Avoid promising confidentiality that the company may not be able to maintain if litigation, an internal proceeding, or a police report follows.

Use Interviews Carefully

An interview can clarify a discrepancy, but it should not become an improvised interrogation. Before meeting with an employee, determine what records you have, what questions remain unanswered, and who should attend. In sensitive matters, have human resources, counsel, or an experienced investigator guide the process.

Remain professional and neutral. Explain the issue being reviewed and give the employee a fair opportunity to respond. Do not threaten arrest, make promises you cannot keep, or pressure someone into a statement. Depending on the workplace and employment status, additional rules may apply to interviews. Unionized employees, for example, may have representation rights.

Document the date, attendees, questions asked, and answers given. If the employee provides documents or offers an explanation, preserve it. An explanation that initially appears unlikely may still point to a control weakness or another source of loss. Fairness is not just an ethical obligation. It strengthens the integrity of the final decision.

Protect the Business While the Matter Is Under Review

A business may need to reduce risk before the investigation is complete. That can include changing access codes, requiring dual approval for refunds or payments, increasing inventory counts, separating financial duties, or temporarily reassigning responsibilities. These measures should be applied carefully and consistently, especially if they affect a particular employee.

Do not alter records to make an account balance, overwrite camera footage, or quietly dispose of items that may be evidence. Retention practices matter. If the matter could lead to a claim, preserve relevant materials beyond ordinary deletion schedules.

Communication should be measured. Broad announcements about a suspected thief can create fear and defamation risk. Tell employees only what they need to know to follow temporary procedures. If customers, vendors, insurers, or law enforcement must be notified, provide verified facts and coordinate the message through the appropriate leadership and legal channels.

When Outside Investigation Makes Sense

Internal staff may be well positioned to spot a problem, but they may not be equipped to investigate it independently. Conflicts of interest, limited experience with surveillance or digital evidence, and concerns about employee retaliation can all justify outside support. An independent investigator can review records, conduct lawful fieldwork, interview relevant parties, and prepare a clear factual report for counsel or management.

Kay & Associates Investigations approaches corporate asset protection matters with the discretion required when reputations, livelihoods, and business continuity are at stake. The objective is verified information collected through lawful, professional methods, not speculation or public embarrassment.

A carefully documented file gives leadership options. It may support a corrective action, a termination decision, an insurance claim, civil recovery, a criminal referral, or a decision that the evidence does not justify further action. Each outcome is better than reacting on instinct.

When something does not add up, preserve the record, protect the people involved, and let verified facts determine the next step.