Employee Theft Investigation. A Practical Guide.
Here are some
suggestions regarding employee theft awareness,
investigations and prevention. All policies should be
reviewed by a Human Resource professional and a Labor
Attorney before implementation.
Policy and Procedure Development
written policy regarding disciplinary action
if an employee is found to be stealing.
stealing. Sure, we know it when we see it
but sometimes people see it as "borrowing". An
example statement in such a policy would define theft as "The
unauthorized removal of company assets both tangible and
intangible". Notice it does not use the word
theft. Theft requires intent. For
termination purposes their intent is not an issue.
For prosecution, it will be the crux of the allegations.
that policy beyond new hire orientation. Posters,
newsletters, and blogs can help reinforce a gentle
all levels of the company are tied to the policy
including Senior Management.
Keep in mind
that precedents are set with any termination.
Ensure there is consistency in the enforcement of
must set the tone and lead by example regarding policy.
If a manager borrows a laptop so his child could do a
PowerPoint presentation in class then why can't any
employee do that?
If there is
not a formal department that conducts internal
investigations formulate a plan (in writing) as to what
initiates an investigation and who handles it.
Have a written
policy regarding searches of vehicles, personal articles
like backpacks, briefcases, and backpacks.
Have a written
policy regarding refusal to allow a search.
Warning! The ability to search someone (anyone)is a vital right for any business but doing so should be considered very sensitive. Put yourself in the position of the person being searched to understand the feelings of the process. There are many scenarios to justify the need for search but this discussion will focus on employees and the implementation and management of the procedure.
Bag checks are common place and should be accepted by employees if properly positioned and concerns addressed. If a company adopts a policy to require employees to submit to searches the policy and procedure should be well vetted with Human Resources, Legal, and Management. There are five provisions that should be considered when formulating policy:
should be limited to anything outside the body.
This would include purses, backpacks, brief cases,
computer bags, sacks, etc. NEVER
touch someone in the process. Don't frisk or
have them disrobe. (yes it happens).
The policy is
in place for all levels of employees including
consistency of the policy. Under what
circumstances will a search be conducted?
Who has the
authority to search?
Even with the best written policy, occasionally someone will refuse. These refusals do not necessarily mean they are in the act of theft but they can be volatile situations nonetheless that can escalate needlessly if handled improperly. What disciplinary action is available for an employee refusing to comply with company policy?
Unless there is a very compelling reason to not allow the employee to leave if they refuse, then allow them to leave. First, however, a possible solution is to call a supervisor to remind the employee of the policy. When the supervisor arrives a discussion between the employee and the supervisor should be taken in an area that is as private as possible which could simply be off to one side. If the employee still refuses to follow company policy after a calm but firm discussion with a supervisor, then allow the employee to leave. The individuals attempting to perform the search should document the incident, retrieve video if available, and turn the matter over to those who make the disciplinary action. If other witnesses are available, obtain their statements as well.
More points to consider are: What if something is actually discovered while doing the search? Is the discovery of narcotics, such as marijuana, or a firearm covered in the scope of the search? How are those to be handled? What if the search reveals something that is suspected to be of value to the company? What are the steps to be taken?
Audit your own
policies and procedures. These should be
unannounced and conducted regularly.
carefully anything that involves cash or other
negotiable items. There should be a number of
checks and balances in place to detect problems. Bank
deposits are especially vulnerable.
deposits monitored? Is there a notification
from the bank if a deposit is short or missing?
notification going to someone other than the person
who deposited the money?
notification or deposit review to ensure deposits
are made daily?
Is there a
requirement that deposits be made during daylight
hours only? This helps prevent employees from
faking a robbery and stealing the money.
- How are deposits monitored? Is there a notification from the bank if a deposit is short or missing?
disposal controlled? Dumpsters are great places to
hide property only to come back later and take it.
How do they know which trash bag it's in? They tie
the knot differently.
If a company
asset is missing, such as a laptop, is there a record of
the serial number and description of the device
Warning! Whether a professional investigative department is involved, a private investigator, or simply Management or a Supervisor, investigating an employee for any cause is very serious business. Investigators who have experience in internal matters should be the first choice to conduct the investigation. There are companies that specialize in the investigation of white collar crime that are available. Police Departments are generally not equipped to properly investigate most internal thefts because they don't have the time to learn the inner workings of a company. They are certainly a resource to be used however and will always be the conduit to prosecution.
immediate and thorough investigation if you learn of a
theft. Document all investigative efforts.
are "sexy" to others. Remind everyone interviewed,
even a suspect, that the
matter is confidential. Create a confidentiality
agreement for signature if possible. TIP:
Employees often claim defamation after investigations.
Confidentiality agreements keep everyone on notice about
the sensitive nature. There's no real way to keep
people from discussing the investigation but as long as
the investigators and management maintain their
confidentiality, the risk of a successful civil action
is low. Termination should be a possible action if
confidentiality is broken.
I am aware of a sexual harassment investigation where an entire department was interviewed based on
highly detailed anonymous complaints. Each person was privately interviewed and was asked questions
about observations or experiences with the department supervisor. The supervisorwas eventually fired
although he made no admissions. He then brought a successful defamation suit against the company. His
allegation was that people who knew nothing about the alleged activity now knew that he was being
accused of sexual harassment and that his termination confirmed the allegations. Award: $17 million.
important. Company documents, witness statements,
video or physical evidence must be preserved.
understand the laws regarding the use of polygraph and
drug tests. The use of the polygraph is governed
Employee Polygraph Protection Act and is still a
viable tool when
investigating a loss. If there is cause to use a
polygraph, my recommendation is to ask the police to do
that. The employee may refuse which is their right
to do so. The results of the polygraph or the
refusal to submit to a polygraph are not grounds to
terminate an employee. The totality of the
investigation must be the basis for termination, not
just solely on the results of the polygraph or a refusal
to take the polygraph.
My experience with polygraphs in conjunction investigations is considerable however the results
are mixed at best. I have never had an employee refuse to submit to one however I would estimate
that only 95% ever showed up. No one who was alleged to have committed a theft or who was alleged
to have staged a robbery was ever found to be truthful. If a police department conducted the polygraph
first, they could not reveal the results. However when I was told that they could not clear the employee as
a suspect, they, in effect, gave me the results. We then conducted our own polygraph and, of course, got
same results. Termination was based on a full investigation. The polygraph was not the defining moment
but rather was a buttress to conclusions. Failure to protect company assets was common verbiage for the
reason for termination.
Click here for expanded information regarding interviews of employees.
Terminations for theft should not be handled in a manner different from any other termination for cause. Termination is based on established policy and procedure. Sometimes, however, theft is judged on a sliding scale of value. Example: A jar was set up on a desk to collect money for a charity. An employee, needing lunch money, stole (was going to pay back the next day) $2.00. The money was not the property of the company but the employee was terminated anyway. Theft of anything causes loss of confidence and not terminating may create a dangerous precedent.
your Legal Department or Counsel regarding your
investigation. Ultimately they will have to defend
the actions of the company if it comes to that.
Nothing can prevent someone from filing a civil suit.
What is more important is that the actions are
defendable in court and that the plaintiff does not
Consider terminating the employee for "Violation of
Company Policy" versus theft. It is easier to
defend as no intent is required or suggested.
that hire young people are well aware of the
parents' interest in the termination of their child.
If the child is an adult (based on your State's
definition of adult) then the parents do not have a
right to know anything about the employer's actions.
A minor child's parents have no "rights" that
compels a company to discuss their child's employment or
discretion is sometimes the better path taken and the case is discussed.
What the parent knows is usually vastly different than
the truth. Check with your attorney before
releasing any information.
Dealing with parents, guardians, spouses and other concerned friends is sometimes difficult. The hard fast
fast rule is that a company should not discuss internal information with anyone. Minor children hate the
prospect of telling their parents they were fired for stealing and thus the information is withheld or
watered down. There are times when I have actually read the employee's statement to the parents over
the phone and, in most cases, they are stunned and that is the end of the conversation. There are other
times when parents are hostile and demand copies of the file, statements, and video and threaten to sue. I
have no obligation to speak with them or reveal the contents of the investigation and usually simply
responded by advising them to talk to their child again because they are not giving them all of the
information. I have never had any civil action taken due to my lack of communication with a parent.
Suspension prior to termination is highly recommended.
This serves as a sort of cooling off period to gather
all of the pieces of the investigation together for
review. While it may be a foregone conclusion that
termination will occur, it is still a good practice.
As a percentage, few employees are actually prosecuted for theft. There are many reasons why but frankly, there may just not be enough evidence that would make a prosecutor want to take the case to trial. Prosecution rarely results in full restitution to the company and if restitution is required, it is paid back over the lifetime of their probation. A great deal of payroll is going to be used to prosecute an employee. That cost needs to be weighed. The argument is made that not prosecuting sets a bad example. The question that needs answering is who knows they were prosecuted and who knows what the outcome was. Isn't the investigation confidential?
Prosecution has some worth but it is a business decision. Consider the following carefully when making that decision.
In most cases,
calling the police immediately is not necessary. While it may
be more dramatic, there is no need to send someone out
the door in handcuffs. It is better
to organize your investigation and take it to local law
enforcement. Don't rush this part of your
investigation. The criminal process is not
anything like portrayed on television.
Your case may
be well documented but the prosecutor may decide to plea
bargain the case to a lesser charge. It's out of
Your case may
languish in the system because it is not a priority.
criminal case may give rise to a civil action based on
You may have a
confession for $1000 but you can only prove $50.
Charges may only be accepted on the provable $50.00.
Restitution is an available option on any case. It is simply the employee's agreement to repay what they stole. Civil Restitution is available in most states. Civil Restitution is allowed, generally through a civil statute, that basically says a company can seek civil damages because of the time and effort required to investigate the incident. Every state that has enacted what is also known as civil demand, has a range of damages that can be sought. In Texas, for instance, damages up to $1000 can be sought against an adult and up to $5000 against the parents of a juvenile. The monetary value of the theft is irrelevant. What is important to know is that Civil Restitution is a separate matter from prosecution. In essence an employer can seek prosecution, full restitution and then file for Civil Restitution. Check with your attorney on this and how pursue this aspect. Regardless of the method chosen, there should be a written policy in place to adequately cover this practice.
prosecute, you will receive restitution through the
courts and it is up to the court as to the amount (if
any) of payment and the length of time to repay.
is not intended then restitution
should be agreed to and a Promissory Note should be
created. I recommend a term of one year with equal
payments each month.
Check with your attorney or
HR Department and discuss how an employee can
voluntarily forfeit final pay, vacation pay, profit
sharing or any other source within the company for
restitution. A document should be created that
allows the employee to use those funds for restitution.
The form should be signed but does not need,
necessarily, to be notarized. This method shows
the greatest opportunity to recover from theft.
This is the part that is frequently left out of an investigation: root cause analysis or what happened and why did we not catch it earlier? Prevention is the key and plugging gaps in your current way of doing business is an ongoing challenge. Prevention efforts will be successful about 80% of the time. A component of prevention is the fear of detection. It's the old question of would you steal a million dollars if no one knew you did it. Some people would never steal. Some would steal if given an opportunity regardless of the chance of detection. That middle group fears they would be found out. That process of detection must be in place through rigorous oversight of controls, policy and procedures. The apprehension of an employee is the result of a failure somewhere along the way. Keep in mind that all procedures are written with a perfect world in mind but those procedures are never followed correctly 100% of the time. Employees prey on systemic weakness and human error. You can't have one without the other.
Review every piece of the chain of events regarding the theft. Remember...you asked the employee how this happened. Make suitable changes but try not to go overboard and put safeguards in place that begin to hamper business.
Secrets to a Successful Employee Theft Investigation
Even the most complex financial crimes come down to one thing: some "rule" be it policy, procedure, law, regulatory act, or note on the time clock, has been violated. While that concept may be overly obvious, it is significant when it comes down to the time of the interview. Establishing that the employee understood the correct manner to conduct their business will be the bedrock to all subsequent actions. While feigning ignorance may be offered, it is extremely rare that the person did not know they were in violation especially when it comes to theft. Investigators sometimes miss this huge opportunity for discussion. The employee should be emboldened by the fact that they know how things are done properly and that they can recite that almost verbatim . It is, however, an unknowing trap because your investigation may have revealed that they circumvented all of the intended safeguards. This interview method dispels any notion of inadequate training.
The most important facet of an investigation is to learn what you don't know. Your investigation may reveal all kinds of damning evidence but that is what you developed and there are likely more acts that have not been surfaced. Too often an employee is handed a file and told "Tell me about this". What is the next question when the answer is "I don't know".? The fruits of the investigation will extend far beyond what is known if the interview process is handled properly. The smallest admission of theft is the beginning of a successful interview that ultimately simply confirms what you already knew. The successful interview always gains more than is known. The art is in knowing how to get to that information.
The notion that interviews and interrogations are stern and overbearing is false. Professional investigators keep it conversational and with humor. It's not about the spoken words but more about the body language. Investigating crime of any kind requires training and experience. Gathering evidence is not very difficult but the successful investigation ultimately ties the person to the events. In cases where no admission is made, one must be prepared to act on that very evidence. An accusatory interview/interrogation will be a disaster if the employee is returned to work. Don't rush into an interview without knowing the facts.