How to Document Suspicious Employee Theft
A cash drawer that comes up short once may be an error. A pattern of shortages tied to one shift, one employee login, or one storage area is different. If you need to know how to document suspicious employee theft, the goal is not to prove guilt on instinct. The goal is to preserve facts, protect your business, and avoid turning suspicion into a legal problem of your own.
That distinction matters. Poor documentation can weaken an internal investigation, expose an employer to wrongful termination claims, and make it harder for law enforcement, counsel, or an outside investigator to determine what actually happened. Good documentation does the opposite. It creates a clean record of who noticed what, when it was noticed, and what objective evidence supports the concern.
What documentation should accomplish
When businesses first suspect theft, they often focus on the missing property. In practice, the stronger issue is usually the timeline. You need a record that shows how the loss was discovered, what facts connect it to a specific time frame, who had access, and what steps were taken after the discovery.
That record should be factual, consistent, and limited to what you can verify. It is not a place for emotional language, assumptions about motive, or personal opinions about the employee’s character. Statements like “he has always seemed dishonest” do not help. Statements like “inventory count on May 6 showed 14 units missing from locked cage B; access logs show three authorized entries between May 4 and May 6” are useful.
How to document suspicious employee theft without contaminating the record
Start as soon as the concern becomes concrete. That does not mean you launch accusations the moment a manager has a bad feeling. It means that once there is an observable issue – missing inventory, altered time records, unauthorized refunds, false vendor payments, manipulated expense reports, or unexplained cash loss – someone should open a case file and begin recording facts.
The first entry should identify the date and time the issue was discovered, the person who discovered it, and the exact nature of the discrepancy. Keep the wording plain. Note the amount missing, item numbers involved, account activity, or physical location. If the issue comes from a system alert or audit exception, preserve that source record immediately.
From there, maintain a running chronology. Each entry should include the date, time, person making the entry, action taken, and any evidence collected. If video was reviewed, note which cameras, what time window, and who reviewed the footage. If merchandise was counted, identify the count method and who participated. If a lock was found damaged, document its condition before anyone replaces it.
This is where many employers make a costly mistake. They talk first and document later. By the time they sit down to write, details have blurred, multiple people have compared notes, and the chain of events is no longer clean. Contemporaneous notes carry more weight because they show what was known at the time, not what was reconstructed after the fact.
Preserve the evidence before you pursue the employee
If theft is suspected, evidence preservation comes before confrontation. That includes physical, digital, and observational evidence.
Physical evidence may include receipts, cash count sheets, damaged packaging, stockroom logs, access cards, handwritten notes, or returned items tied to fraudulent refunds. Store originals securely and limit handling. If something is moved, opened, or collected, record who handled it and when.
Digital evidence often matters even more. Save transaction logs, point-of-sale reports, user access logs, inventory adjustments, deleted file recovery data, email records where appropriate, and time-stamped surveillance footage. Export records in a way that preserves dates and metadata when possible. A screenshot can be helpful, but it is not always enough. Original system records are stronger.
Observational evidence should also be captured carefully. If a supervisor personally observed an employee bypassing procedure, document exactly what was seen, heard, and done. Avoid conclusions. Write “Employee placed two items in backpack at 8:17 p.m. and exited through rear door without checkout” rather than “Employee stole merchandise.”
Separate facts from assumptions
One of the most important parts of how to document suspicious employee theft is knowing what not to write. Documentation should not read like a verdict. It should read like a factual record that can withstand review by HR, counsel, law enforcement, or a court.
For example, if only one employee had access to a room during a period of loss, that is a relevant fact. It is not the same as proof. There may be shared credentials, propped doors, weak controls, or accounting errors. A disciplined record leaves room for the possibility that the first explanation is not the right one.
That same caution applies to witness statements. If another employee reports suspicious behavior, document the statement with the date, time, and exact information provided. If possible, use the witness’s own words. Do not clean it up into a stronger allegation than the witness actually made.
Use a consistent internal process
The businesses that handle these situations best usually have a simple protocol. One person or one small group controls the documentation. Access to the case file is limited. Evidence is stored securely. Interviews, if any, are planned rather than improvised.
Consistency reduces risk. If five managers are texting each other, printing reports, and discussing theories in the break room, your documentation problem gets bigger fast. Sensitive internal theft matters should be handled on a need-to-know basis. Confidentiality protects the investigation, the business, and the employee until facts are established.
It also helps to create categories in the file: incident discovery, loss details, access records, surveillance review, witness information, policy violations, and next steps. That structure makes the record easier to review later and helps identify gaps before decisions are made.
Pay attention to legal and HR boundaries
Documenting suspected theft is not just an operations issue. It can quickly become an employment law issue. Employers have legitimate reasons to investigate, but those investigations still need to follow company policy, privacy rules, wage laws, and any contractual or union requirements that apply.
That means the method matters as much as the suspicion. Secretly searching personal property, recording conversations where prohibited, accessing protected personal accounts, or singling out an employee based on bias can create liability. So can defamation through careless internal communications.
It depends on the workplace, the state, and the evidence involved. In some cases, HR should lead. In others, legal counsel or an outside investigator should be involved early, especially where the loss is substantial, multiple employees may be involved, or litigation is likely.
When interviews make sense – and when they do not
Interview notes can be valuable, but timing is critical. If you interview too early, you may tip off a dishonest employee before records are preserved. If you wait too long, memories fade and opportunities to clarify discrepancies are lost.
When interviews are conducted, document who was present, the start and end time, the questions asked, and the employee’s responses. Keep notes factual. If the employee provides an explanation, record it fully, even if it seems unlikely. Selective documentation creates credibility problems later.
Do not promise outcomes you cannot control. Do not make threats. Do not push for a confession at the expense of procedure. An interview should seek information, not force a conclusion.
Know when outside help is the smart move
Some matters can be resolved internally. Others should not be. If losses are recurring, the evidence is technical, multiple people may be involved, or the business needs documentation suitable for legal review, outside investigative support can save time and reduce mistakes.
A professional investigator can help preserve surveillance, verify timelines, conduct witness interviews, identify patterns across transactions or locations, and document findings in a way that supports decision-making. For employers in Ohio and beyond, that can be especially valuable when the concern may lead to termination, insurance claims, civil recovery, or criminal referral. Firms such as Investigations America are often brought in for exactly this reason – to move the matter from suspicion to verified facts.
The record should support a decision, not replace one
Good documentation does not automatically tell you what action to take. It gives you a reliable basis for making that decision. Sometimes the evidence points clearly to theft. Sometimes it points to policy failure, poor controls, or a training problem that created the appearance of misconduct.
That is why careful documentation matters. It protects the honest employee as much as it protects the employer. It gives leadership, HR, counsel, and investigators something solid to work from instead of rumor and frustration.
If you are facing unexplained losses, slow down enough to document them properly. Facts gathered early, preserved correctly, and reviewed with discipline tend to hold up when the stakes get real.
