Employee Theft Investigation. A Practical Guide.

HTML clipboard

Here are some

suggestions regarding employee theft awareness,

investigations and prevention. All policies should be

reviewed by a Human Resource professional and a Labor

Attorney before implementation.

Policy and Procedure Development

  • HAVE a

    written policy regarding disciplinary action

    if an employee is found to be stealing.

  • Clearly define

    stealing. Sure, we know it when we see it

    but sometimes people see it as "borrowing". An

    example statement in such a policy would define theft as "The

    unauthorized removal of company assets both tangible and

    intangible". Notice it does not use the word

    theft. Theft requires intent. For

    termination purposes their intent is not an issue.

    For prosecution, it will be the crux of the allegations.

  • Communicate

    that policy beyond new hire orientation. Posters,

    newsletters, and blogs can help reinforce a gentle


  • Ensure that

    all levels of the company are tied to the policy

    including Senior Management.

  • Keep in mind

    that precedents are set with any termination.

    Ensure there is consistency in the enforcement of


  • Management

    must set the tone and lead by example regarding policy.

    If a manager borrows a laptop so his child could do a

    PowerPoint presentation in class then why can't any

    employee do that?

  • If there is

    not a formal department that conducts internal

    investigations formulate a plan (in writing) as to what

    initiates an investigation and who handles it.

  • Have a written

    policy regarding searches of vehicles, personal articles

    like backpacks, briefcases, and backpacks.

  • Have a written

    policy regarding refusal to allow a search.

Searching Employees


The ability to search someone (anyone)is

a vital right for any business but doing so should be considered very

sensitive. Put yourself in the position of the

person being searched to understand the feelings of the

process. There are many scenarios to justify

the need for search but this discussion will focus on

employees and the implementation and management of the


Bag checks are common place and should be accepted by

employees if properly positioned and concerns addressed. If

a company adopts a policy to require employees to submit to

searches the policy and procedure should be well vetted with

Human Resources, Legal, and Management. There are

five provisions that should be considered when formulating


  1. Define


  2. Searches

    should be limited to anything outside the body.

    This would include purses, backpacks, brief cases,

    computer bags, sacks, etc. NEVER

    touch someone in the process. Don't frisk or

    have them disrobe. (yes it happens).

  3. The policy is

    in place for all levels of employees including

    (especially) Management.

  4. The

    consistency of the policy. Under what

    circumstances will a search be conducted?

  5. Who has the

    authority to search?

Policies are only as good as the people implementing them.

Don't assume that a written policy created is a written

policy understood. Consistency in application is the

key. If, for instance, there is a security person at

the door and all employees are to stop and open

anything they are carrying them, even the company President

or owner should do so. There needs to be a clear

definition of how a search can be conducted. Is that

defined as allowing someone to dig through a handbag or does

it mean merely a visual inspection is allowed? This is

very important. Is a metal detector appropriate?

If so how are activations handled?

Even with the best written policy, occasionally someone

will refuse. These refusals do not necessarily

mean they are in the act of theft but they can be volatile

situations nonetheless that can escalate needlessly if handled

improperly. What disciplinary action is available

for an employee refusing to comply with company policy?

Unless there

is a very compelling reason to not allow the employee to

leave if they refuse, then allow them to leave.

First, however, a possible solution is to call a supervisor to remind

the employee of the policy. When the supervisor

arrives a discussion between the employee and the supervisor should be

taken in an area that is as private as possible which

could simply be off to one side. If the employee

still refuses to follow company policy after a calm but firm discussion with a

supervisor, then

allow the employee to leave. The individuals

attempting to perform the search should

document the incident, retrieve video if available, and

turn the matter over to those who make the disciplinary

action. If other witnesses are available, obtain

their statements as well.

More points to consider are:

What if something is actually discovered while doing the

search? Is the discovery of narcotics, such as

marijuana, or a firearm covered in the scope of the search?

How are those to be handled? What if the search

reveals something that is suspected to be of value to the

company? What are the steps to be taken?


  • Audit your own

    policies and procedures. These should be

    unannounced and conducted regularly.

  • Watch

    carefully anything that involves cash or other

    negotiable items. There should be a number of

    checks and balances in place to detect problems. Bank

    deposits are especially vulnerable.

    • How are

      deposits monitored? Is there a notification

      from the bank if a deposit is short or missing?

    • Is that

      notification going to someone other than the person

      who deposited the money?

    • Is there

      notification or deposit review to ensure deposits

      are made daily?

    • Is there a

      requirement that deposits be made during daylight

      hours only? This helps prevent employees from

      faking a robbery and stealing the money.

  • Is trash

    disposal controlled? Dumpsters are great places to

    hide property only to come back later and take it.

    How do they know which trash bag it's in? They tie

    the knot differently.

  • If a company

    asset is missing, such as a laptop, is there a record of

    the serial number and description of the device




Whether a professional investigative department is

involved, a private investigator, or simply Management

or a Supervisor, investigating an employee for any cause

is very serious business. Investigators who have

experience in internal matters should be the first

choice to conduct the investigation. There are

companies that specialize in the investigation of white collar crime

that are available.

Police Departments are generally not equipped to

properly investigate most internal thefts because they

don't have the time to learn the inner workings of a

company. They are certainly a resource to be used

however and will always be the conduit to prosecution.

  1. Conduct an

    immediate and thorough investigation if you learn of a

    theft. Document all investigative efforts.

  2. Investigations

    are "sexy" to others. Remind everyone interviewed,

    even a suspect, that the

    matter is confidential. Create a confidentiality

    agreement for signature if possible. TIP:

    Employees often claim defamation after investigations.

    Confidentiality agreements keep everyone on notice about

    the sensitive nature. There's no real way to keep

    people from discussing the investigation but as long as

    the investigators and management maintain their

    confidentiality, the risk of a successful civil action

    is low. Termination should be a possible action if

    confidentiality is broken.

    I am aware of a sexual harassment investigation where an

    entire department was interviewed based on

    highly detailed anonymous complaints. Each person

    was privately interviewed and was asked questions

    about observations or experiences with the department

    supervisor. The supervisorwas

    eventually fired

    although he made no admissions. He then brought a successful

    defamation suit against the company. His

    allegation was that people who knew nothing about the

    alleged activity now knew that he was being

    accused of

    sexual harassment and that his termination confirmed the

    allegations. Award: $17 million.

  3. Evidence is

    important. Company documents, witness statements,

    video or physical evidence must be preserved.

  4. Polygraph. Thoroughly

    understand the laws regarding the use of polygraph and

    drug tests. The use of the polygraph is governed

    by the

    Employee Polygraph Protection Act and is still a

    viable tool when

    investigating a loss. If there is cause to use a

    polygraph, my recommendation is to ask the police to do

    that. The employee may refuse which is their right

    to do so. The results of the polygraph or the

    refusal to submit to a polygraph are not grounds to

    terminate an employee. The totality of the

    investigation must be the basis for termination, not

    just solely on the results of the polygraph or a refusal

    to take the polygraph.

    My experience with polygraphs in conjunction

    investigations is considerable however the results

    are mixed at best. I have never had an employee

    refuse to submit to one however I would estimate

    that only 95% ever showed up. No one who was

    alleged to have committed a theft or who was alleged

    to have staged a robbery was ever found to be truthful.

    If a police department conducted the polygraph

    first, they could not reveal the results. However

    when I was told that they could not clear the employee


    a suspect, they, in effect, gave me the results.

    We then conducted our own polygraph and, of course, got

    same results. Termination was based on a full

    investigation. The polygraph was not the defining


    but rather was a buttress to conclusions. Failure

    to protect company assets was common verbiage for the

    reason for termination.




expanded information regarding interviews of employees.


Terminations for theft should not be handled in a manner

different from any other termination for cause.

Termination is based on established policy and procedure.

Sometimes, however, theft is judged on a sliding scale of

value. Example: A jar was set up on a desk to

collect money for a charity. An employee, needing

lunch money, stole (was going to pay back the next day)

$2.00. The money was not the property of the company

but the employee was terminated anyway. Theft of

anything causes loss of confidence and not terminating may

create a dangerous precedent.

  1. Consult with

    your Legal Department or Counsel regarding your

    investigation. Ultimately they will have to defend

    the actions of the company if it comes to that.

    Nothing can prevent someone from filing a civil suit.

    What is more important is that the actions are

    defendable in court and that the plaintiff does not


  2. Consider terminating the employee for "Violation of

    Company Policy" versus theft. It is easier to

    defend as no intent is required or suggested.

  3. Industries

    that hire young people are well aware of the

    parents' interest in the termination of their child.

    If the child is an adult (based on your State's

    definition of adult) then the parents do not have a

    right to know anything about the employer's actions.

    A minor child's parents have no "rights" that

    compels a company to discuss their child's employment or

    any actions

    taken. However,

    discretion is sometimes the better path taken and the case is discussed.

    What the parent knows is usually vastly different than

    the truth. Check with your attorney before

    releasing any information.

    Dealing with parents, guardians, spouses and other

    concerned friends is sometimes difficult. The hard


    fast rule is that a company should not discuss internal

    information with anyone. Minor children hate the

    prospect of telling their parents they were fired for

    stealing and thus the information is withheld or


    down. There are times when I have actually read

    the employee's statement to the parents over

    the phone

    and, in most cases, they are stunned and that is the end

    of the conversation. There are other

    times when

    parents are hostile and demand copies of the file,

    statements, and video and threaten to sue. I



    obligation to speak with them or reveal the contents of

    the investigation and usually simply

    responded by

    advising them to talk to their child again because they

    are not giving them all of the

    information. I have


    had any civil action taken due to my lack of

    communication with a parent.

  4. Suspension.

    Suspension prior to termination is highly recommended.

    This serves as a sort of cooling off period to gather

    all of the pieces of the investigation together for

    review. While it may be a foregone conclusion that

    termination will occur, it is still a good practice.



a percentage, few employees are actually prosecuted for

theft. There are many reasons why but frankly, there

may just not be enough evidence that would make a prosecutor

want to take the case to trial. Prosecution rarely

results in full restitution to the company and if

restitution is required, it is paid back over the lifetime

of their probation. A great deal of payroll is going

to be used to prosecute an employee. That cost needs

to be weighed. The argument is made that not

prosecuting sets a bad example. The question that

needs answering is who knows they were prosecuted and who

knows what the outcome was. Isn't the investigation


Prosecution has some worth but it is a business decision.

Consider the following carefully when making that decision.

  1. In most cases,

    calling the police immediately is not necessary. While it may

    be more dramatic, there is no need to send someone out

    the door in handcuffs. It is better

    to organize your investigation and take it to local law

    enforcement. Don't rush this part of your

    investigation. The criminal process is not

    anything like portrayed on television.

  2. Your case may

    be well documented but the prosecutor may decide to plea

    bargain the case to a lesser charge. It's out of

    your hands.

  3. Your case may

    languish in the system because it is not a priority.

  4. Losing a

    criminal case may give rise to a civil action based on

    malicious prosecution.

  5. You may have a

    confession for $1000 but you can only prove $50.

    Charges may only be accepted on the provable $50.00.

Restitution and

Civil Restitution

Restitution is an available option on any case. It is

simply the employee's agreement to repay what they stole.

Civil Restitution is available in most states. Civil

Restitution is allowed, generally through a civil statute,

that basically says a company can seek civil damages because

of the time and effort required to investigate the incident.

Every state that has enacted what is also known as civil

demand, has a range of damages that can be sought. In

Texas, for instance, damages up to $1000 can be sought

against an adult and up to $5000 against the parents of a

juvenile. The monetary value of the theft is


What is important to know is that Civil Restitution is a

separate matter from prosecution. In essence an

employer can seek prosecution, full restitution and then

file for Civil Restitution. Check with your attorney

on this and how pursue this aspect. Regardless of the

method chosen, there should be a written policy in place

to adequately cover this practice.

  1. If you

    prosecute, you will receive restitution through the

    courts and it is up to the court as to the amount (if

    any) of payment and the length of time to repay.

  2. If prosecution

    is not intended then restitution

    should be agreed to and a Promissory Note should be

    created. I recommend a term of one year with equal

    payments each month.

  3. Check with your attorney or

    HR Department and discuss how an employee can

    voluntarily forfeit final pay, vacation pay, profit

    sharing or any other source within the company for

    restitution. A document should be created that

    allows the employee to use those funds for restitution.

    The form should be signed but does not need,

    necessarily, to be notarized. This method shows

    the greatest opportunity to recover from theft.


This is the part that is frequently left out of an

investigation: root cause analysis or what happened

and why did we not catch it earlier? Prevention is the

key and plugging gaps in your current way of doing business

is an ongoing challenge. Prevention efforts will be

successful about 80% of the time. A component of

prevention is the fear of detection. It's the old

question of would you steal a million dollars if no one knew

you did it. Some people would never steal. Some

would steal if given an opportunity regardless of the chance

of detection. That middle group fears they would be

found out. That process of detection must be in place

through rigorous oversight of controls, policy and

procedures. The apprehension of an employee is the

result of a failure somewhere along the way. Keep in

mind that all procedures are written with a perfect world in mind


those procedures are never followed correctly 100% of the

time. Employees prey on systemic weakness and human

error. You can't have one without the other.

Review every piece of the chain of events regarding the

theft. Remember...you asked the employee how this

happened. Make suitable changes but try not to go

overboard and put safeguards in place that begin to hamper


Secrets to a

Successful Employee Theft Investigation

Even the most complex financial crimes come down to one

thing: some "rule" be it policy, procedure, law,

regulatory act, or note on the time clock, has been

violated. While that concept may be overly obvious, it

is significant when it comes down to the time of the

interview. Establishing that the employee understood

the correct manner to conduct their business will be the

bedrock to all subsequent actions. While feigning

ignorance may be offered, it is extremely rare that the

person did not know they were in violation especially when

it comes to theft. Investigators sometimes miss this

huge opportunity for discussion. The employee should

be emboldened by the fact that they know how things are done

properly and that they can recite that almost verbatim .

It is, however, an unknowing trap because your investigation

may have revealed that they circumvented all of the intended

safeguards. This interview method dispels any notion

of inadequate training.

The most important facet of an investigation is to learn

what you don't know. Your investigation may reveal all

kinds of damning evidence but that is what you developed and

there are likely more acts that have not been surfaced.

Too often an employee is handed a file and told "Tell me

about this". What is the next question when the answer

is "I don't know".? The fruits of the investigation

will extend far beyond what is known if the interview

process is handled properly. The smallest admission of

theft is the beginning of a successful interview that

ultimately simply confirms what you already knew. The

successful interview always gains more than is known.

The art is in knowing how to get to that information.

The notion that interviews and interrogations are stern and

overbearing is false. Professional investigators keep

it conversational and with humor. It's not about the

spoken words but more about the body language.

Investigating crime of any kind requires training and

experience. Gathering evidence is not very difficult

but the successful investigation ultimately ties the person

to the events. In cases where no admission is made,

one must be prepared to act on that very evidence. An

accusatory interview/interrogation will be a disaster if the

employee is returned to work. Don't rush into an

interview without knowing the facts.

Author:. Mr. Murphy is a Houston-Texas based Forensic Security Expert with over 35 years experience in law enforcement, security management, retail loss prevention and security consulting. Mr. Murphy provides expert witness testimony on a variety of security related issues for both plaintiff and defe... Go Deeper | Website

Have a question for J. Patrick?

carole baker
27th March 2015 12:12am
Can the bar owner that I work for make me pay back money that someone else stole from her. Her reason being im responsible since I didnt drop the money into the safe properly which gave the person who stole it access to the bank bag.

15th July 2015 11:28am
If someone stole $5000 from a business owner and was forgiven, paid back the money, and a year and a half later the owner pursued charges. How does that work?

Pat Murphy
21st July 2015 2:17pm
I'd say the owner will have a tough time getting police to file a case with the District Attorney. The owner entered into a verbal agreement to accept "restitution". (Not a legal opinion). It would have been tough to file a case the day after restitution was accepted. (not a legal opinion). I have had on two occasions where people want to clean the slate and have come in years after leaving the company to pay for what they had stolen. I accepted the cash, had it booked through ... Read More

Load More Comments

* Required information
Email Address:
(never displayed)

Your question or comment:
Human? Enter the fifth word of this sentence.
Enter answer:
Tell me when J. Patrick responds to me.
Remember my form inputs on this computer.


New Graphic
Subscriber Counter