Stock is missing. A fuel account shows unexplained transactions. Equipment cannot be located, or a customer says they paid an invoice that still appears outstanding.
For a business owner, the possibility that an employee has stolen from the business can feel personal. The temptation is to confront someone immediately and demand an explanation.
The first response matters. Acting without a plan can compromise evidence, spread accusations and make it harder to establish what actually happened.
A suspected employee theft investigation should begin with a clear record of the concern, preservation of relevant evidence and an open mind about possible explanations.
Establish what you actually know
Start by separating facts from assumptions.
“Ten items are missing from the stock count” describes a discrepancy. “The afternoon shift stole ten items” attributes responsibility before the cause has been established.
Record what was discovered, when it was discovered, who identified it and which records support the concern. Identify the period during which the loss could have occurred.
Useful initial questions include:
What property, money or stock appears to be missing?
When was it last reliably accounted for?
How was the discrepancy calculated?
Who had access, including contractors and other authorised people?
Could a transfer, return, recording error or authorised use explain it?
These questions help define the investigation and identify evidence that may otherwise be overlooked.
Preserve evidence before it disappears
Some records have a short lifespan. CCTV may be overwritten, system logs may expire and relevant messages may be deleted during ordinary business operations.
Identify the records at risk and arrange for their preservation by someone authorised and competent to do so.
Depending on the concern, relevant material may include CCTV footage, stock movement reports, access records, delivery dockets, invoices, transaction histories, rosters and business communications.
Keep original records intact wherever possible. Record who collected each item, when it was collected and where it came from. Use separate working copies for review.
Preserve enough context to understand the event. A brief video clip of someone carrying a box may mean very little without footage showing where the box came from, where it went and whether the movement was authorised.
Where digital evidence is complex, obtain specialist assistance before accessing or altering devices.
Control immediate risks carefully
A business may need to protect stock, funds or systems while the facts are examined.
Consider proportionate controls, such as a second approval for payments, closer stock reconciliation or more secure storage. Record the reasons for any temporary measures and review them as the investigation develops.
Decisions about changing an employee’s duties, restricting access or suspending employment require consideration of the applicable employment arrangements and circumstances. Obtain appropriate employment advice before taking those steps.
Temporary controls should not be presented to colleagues as proof that someone has committed theft.
Keep the matter within an appropriate group
Discussing suspicions widely can damage reputations and affect the reliability of witness accounts.
Nominate the people responsible for managing the response. Give them clear responsibilities for preserving records, communicating with staff and making decisions.
Avoid workplace speculation, group discussions about who might be responsible or asking colleagues to compare their recollections.
Witnesses should be asked for their own observations. There is a significant difference between “I saw someone remove equipment” and “Everyone thinks that person has been taking equipment”.
Both statements may explain why a concern arose, but they have different evidentiary value.
Plan interviews and genuinely consider explanations
Once the available records have been reviewed, identify what needs to be clarified and who can assist.
Prepare specific questions about events, transactions and authorisations. Avoid approaching an interview as an attempt to obtain a confession.
An employee facing an allegation should understand the concern in sufficient detail to respond meaningfully. Their explanation may identify another witness, an overlooked approval or a record that needs to be checked.
A fair process requires a genuine willingness to consider that information before reaching a conclusion. A meeting held after the outcome has already been decided does not provide a meaningful opportunity to respond.
Theft can constitute serious misconduct, but that does not make an untested allegation a sound basis for dismissal. Investigation findings and any employment decision need careful, separate consideration.
Consider police involvement
Where the circumstances indicate a possible criminal offence, consider reporting the matter to police promptly. An internal investigation does not need to be completed before a report can be made.
If police are involved, discuss how further evidence gathering or interviews could affect their enquiries.
A workplace investigation and a criminal investigation serve different purposes. A private investigator does not determine criminal guilt or exercise police powers.
Similarly, a decision not to charge someone does not, by itself, resolve every employment or operational question. Those matters require their own assessment and appropriate advice.
Recognise when independent assistance would help
An external investigator may be useful where the allegations involve a senior employee, the owner has a close relationship with those involved or the records extend across multiple sites.
Independent assistance can also help where losses appear ongoing, witness accounts conflict or internal managers lack the time to conduct a thorough investigation.
The scope should identify the suspected events, relevant period, available evidence and questions to be answered. Where accounting or digital forensic expertise is required, that should be identified early.
Use the findings to improve the business
The outcome may establish misconduct, identify an innocent explanation or leave some questions unresolved.
Regardless of the outcome, the investigation may reveal weaknesses in stock controls, shared access credentials, approval processes or recordkeeping.
Addressing those weaknesses can help reduce future losses and make discrepancies easier to investigate.
A clear report should explain what the evidence supports, what it does not support and any limitations affecting the conclusions.
Investigation support across regional Queensland
Regional Queensland Investigations assists businesses with suspected theft, fraud and workplace misconduct investigations across regional Queensland.
We understand the practical challenges facing transport operators, mining suppliers, warehouses and businesses operating across multiple locations.
Our approach focuses on preserving relevant evidence, examining competing explanations and providing clear findings to support informed decisions.
If your business has identified unexplained losses or suspected employee theft, contact Regional Queensland Investigations at www.rqinv.com.au to discuss the matter.
Jason King is the Director of Regional Queensland Investigations Pty Ltd. He has a background in law enforcement, compliance, workplace investigations and corporate investigations, assisting businesses and organisations across regional Queensland and the Northern Territory.