Employee Theft Investigations: A Practical Guide for Business Owners

Employee theft is not limited to cash taken from a register. It encompasses inventory shrinkage, fraudulent expense reports, vendor kickback schemes, intellectual property theft, time fraud, and data exfiltration. The Association of Certified Fraud Examiners estimates that businesses lose a meaningful percentage of annual revenue to occupational fraud, much of it going undetected for months or years.

Small and mid-sized businesses are disproportionately affected because their internal controls are typically less robust. A single trusted employee in a key role — accounts payable, inventory management, purchasing, or IT — can cause significant damage before any formal concern is raised.

When a business attempts to investigate internally, several problems tend to emerge. The person conducting the review may lack the tools, training, or neutrality to do it effectively. Subjects of the investigation can be tipped off through informal communication, giving them time to destroy evidence or alter records. And conclusions reached without proper documentation may not hold up if the matter proceeds to termination, civil litigation, or criminal referral.

Internal investigation also creates liability exposure. If an employee can demonstrate that the process was unfair, inconsistent, or motivated by something other than the alleged conduct, the company's position weakens even when the underlying concern is legitimate.

A well-executed employee theft investigation begins with a quiet assessment phase — reviewing records, identifying anomalies, and understanding the scope of potential loss before any subject is aware of scrutiny. This may include financial record analysis, surveillance, background verification, and covert observation depending on the circumstances.

The investigator's role is to produce documentation, not verdicts. A complete file of what was observed, corroborated, and preserved gives the client options: termination for cause, civil recovery, law enforcement referral, or a negotiated resolution. Each requires a different evidentiary threshold, and a professional knows how to build toward any of them.

Chain of custody matters. Any evidence gathered needs to be documented, preserved, and attributed in a way that survives legal challenge. Statements taken improperly, surveillance conducted without appropriate authorization, or digital evidence handled carelessly can undermine an otherwise solid case.

Working with a licensed investigator from the beginning — before confronting the employee, before notifying HR, and before contacting law enforcement — typically produces the cleanest outcome for the business. Empire Investigation has handled internal theft cases for businesses in Pittsburgh and beyond for more than four decades.