Solving Employee Theft 101©
By James W. Bassett

When an employee theft occurs in your business, a number of questions immediately spring to mind. What was stolen? What should I do about it?  When was it stolen? Where was it stolen from? How was it stolen? And finally, who stole it?

 Let’s examine these questions in terms of a hypothetical but common theft scenario. One thousand dollars has been reported missing from the safe at your store by Andy, an assistant manager. The theft occurred from a deposit bag that was supposed to contain $2700 in cash. The theft was discovered when the bank teller counted the deposit money in front of Andy who took it to the bank. The teller discovered the deposit contained only $1700 instead of $2700.  Andy reported the $1000 theft by phoning you immediately while he was still at the bank.

What was stolen?
You count the money in the safe to make sure that there was only a thousand missing and no more. There could be other deposits, cash carryover money, or change funds in the safe that might be short too. You also re-check the paperwork related to the $2700 deposit to make sure the person who made up the deposit added correctly. You count the entire safe to make sure the missing $100 wasn’t placed in the wrong chamber. You ask every employee who had access to the missing money if he/she knows the whereabouts of the missing money. Once you have done all of these things, you have completed step 1—confirming the loss.

What Should You Do About It?
There are two basic choices here. Ignore it and hope that this theft was an isolated event that will not recur. Or, investigate this theft promptly, openly, and vigorously. Some facts about employee theft will be presented below to help you decide which choice to make.

First, an employee’s first theft from his or her employer is rarely as large as $1,000. Chances are there were smaller cash theft that preceded this one. We might call them practice thefts. Dishonest employees usually start by stealing small amounts--- $5 here, $10 there. If their thefts remain undetected or un-investigated, they graduate to larger amounts-- $20 here, $50 there with the instances occurring more and more frequently. Whoever stole this $1000 will steal again until he or she is caught or scared into resigning by the fear of getting caught. Many thieves quit during suddenly during theft investigations. Some just quit showing up for work.  Others will launch an academy award performance by saying, “How dare you suspect me of stealing from you! You can take this job and shove it!

If you passed up the chance to investigate the $10 shortage, then the $20 shortage, then the $50 shortage, are you now going to also pass on the $1,000 shortage? If you do, you may soon be staring at a $2,000 theft. Look at it this way: You are investigating this theft not only to discover who stole this $1000 but also to prevent the next, usually larger, theft from occurring.

There are employees who steal and employees who don’t steal but would like to steal  if they thought they could get away with it. Leaving a small theft un-investigated sends a message to the thief wanna-bes that stealing small amounts is okay. It caters to their belief that the company is making huge profits so ownership really doesn’t care if the employees steal or not.

There are the employees who never stole anything of value from your company and never would. How are they affected if you fail to investigate a significant theft? Every time an employee theft occurs, the morale of the honest employees take a hit.  Honest employees don’t like working around dishonest employees. Honest employees identify with the success and profitability of your company. Honest employees realize their pay increases and benefits enhancements come from profits. Many of them realize their dishonest cohorts are stealing their raises when they steal profits. Honest employees resent dishonest employees because management’s suspicions fall on the honest as well as the dishonest like rain falling on the just and the unjust. Some honest employees fear that their dishonest co-workers might begin stealing their possessions. Honest employees begin to leave their purses locked in the trunk of their cars, double check to make sure their lockers and desk drawers are locked, or begin to shy away from handling company valuables.

Your honest employees are on your side. They can become your best allies in your investigation to catch the dishonest one(s). The remainder of this report will show you how.

Please remember this. One third of all small business bankruptcies are caused by employee theft.  Many of these former business owners knew they had an employee theft problem but chose to ignore it until it was too late. Employee theft will rise to the level that you are willing to tolerate. The lower your level of tolerance, the lower will be your level of employee theft.                         

When was it stolen?
Usually the answer to this question cannot be known precisely but instead during a particular range of time.  Think of this range in terms of two words--- “after” and “before”. According to Bonnie, she counted the shift money and put it in the safe on Friday night. She is sure that she put the money in the safe and locked the safe at about 9:30 PM on Friday night at closing time. She also emphatically denied having anyone else help her with the deposit or leaving the deposit unattended before putting it in the safe. Assuming Bonnie is telling the truth, the money must have been stolen after 9:30 PM on Friday night. The before is even easier. The money must have been stolen before the bank teller counted the money in front of Andy on Monday morning. When you asked Andy if he watched the teller count the deposit money, he says “Yes” with no hesitation. We can conclude that the theft occurred between the time that Bonnie put the money in the safe and the bank teller counted it and found the shortage.

How was it stolen?
Probably, someone entered the safe, put the money in his or her pocket, and walked out of the store. It is unlikely that Andy or the bank teller stole the money and we will explain why later. It is possible but not likely that Bonnie made a mistake and neglected to put the money in the safe. If she left it out of the safe, the money could have been stolen by any employee who had access to the office where the safe was located. That possibility seems to be remote in this case but very possible in many others.

Who stole the money?
Finally we’ve arrive at the main question. The answer is that the $1000 was probably stolen by someone other than Andy or Bonnie who knew the safe combination.

The money was missing from Bonnie’s deposit. This could be a black mark against her even if she did not steal it because management might assume she handled the money carelessly, failed to put it in the safe, or failed to lock the safe. Bonnie probably didn’t steal this money because employees rarely steal large amounts of money for which they are directly responsible. Instead, they prefer to steal money that a co-worker is responsible for.

If Bonnie did not steal the $1,000, you can expect that she will do everything she can to help you find out who did! Why? Because, this theft could potentially cost her a promotion, a raise, even her job! Bonnie’s stake in solving this crime is actually much greater than ownership’s because she stands to lose much more than $1,000.

A similar argument can be made for Andy not stealing the money. Andy was the last employee who handled the missing money. He would be the first one questioned in its disappearance. And, if there were other funds in the safe when he took the deposit to the bank, it would have been much less suspicious for him to steal that money instead of money from Bonnie’s deposit. By taking Bonnie’s deposit to the bank, Andy became responsible for that money. And, employees rarely steal money they, themselves are directly responsible for. This is especially true when the amount of the theft is large enough to constitute grand larceny. Andy’s stake is solving this crime may not be quite as high as Bonnie’s but it is still substantial. Expect Andy to be completely cooperative in helping you solve this theft. Note that he called you promptly from the bank as soon as he knew the $1,000 was missing.

There are three other employees who had access to the safe because they also knew the safe combination. All three are supervisory types. Their names are Carl, Doris, and Eddie. All three ran shifts on Saturday or Sunday, made up cash deposits and put their deposits in the safe. No money was missing from their deposits that Andy also took to the bank on Monday morning. Two other facts of importance. First, the store has an alarm system that records entries when the store is closed. No after hour entries were made while the store closed during the weekend in question. Sometimes, former employees who had the combination will enter the store during the night when the store is closed and steal money from the safe if there is no burglar alarm and the combination is not changed right away when their employment ends. That is not the case here.

To Find Out Who Committed A Theft, Ask the People Who Might Know!

Your best sources of who information concerning who committed this theft are your own employees. More specifically, your best sources of information about who committed the theft are all the suspects who could have committed the theft.

In other words, to solve the theft of the $1,000, you need to talk to Andy, Bonnie, Carl, Doris, and Eddie. The information you learn from these five may lead you to talk to other employees. But, start by interviewing each of your five supervisors who knew the combination to the safe.

Interviewing the Suspects
Each of the five should be interviewed in private.  This means just you and the suspect alone. No one else should be in the room.  No one else should be permitted to interrupt. No one else should be able to overhear your conversation with the suspect.

Follow These Steps

1. Inform the suspects that your conversation is confidential.  Anything you say to them and anything they say to you is to be kept in strictest confidence.

2. Make sure the suspect knows the facts about what was missing, when it was missing and from where it was missing.

3. Ask the suspect what he/she thinks happened to the missing money.  Some suspects will tell you they think the money was miscounted, misplaced, stolen by the bank teller, stolen by a customer, or that they have "no idea" - anything other than that it had to have been stolen by one of the five employees who had access to the safe.  A suspect who gives this kind of answer immediately zooms right to the top of the suspect list.  Firmly explain that the money was stolen and how you know it was stolen.

4. Explain to the suspect that there are many employees who believe your business makes huge profits, but that is not true.  Most of the profits are ploughed back into the business in the form of equipment, pay raises and employee benefits.  So if an employee steals from the company, they are stealing from themselves.  Also explain that the person who stole the money has drawn suspicion onto all five of the employees who have the safe combination.

5. Ask the suspect, "Who do you think might have stolen the missing money?"  This question is key to the process.  Some suspects respond that they do not want to “accuse” anyone. Explain that you are not asking him to accuse anyone. You merely want to know - in complete confidence - who they think might have stolen the money. On our investigative questionnaires - the Specific Loss Questionnaire™ and Shortage Questionnaire™ - we ask this question five different ways. This approach has been extremely successful in identify perpetrators.

In one of our recent cases, there was a theft that could only have been committed by one of four people. Three of the suspects - A, B, and C - named the one they thought committed the theft and provided reasons why. Suspects A and B named suspect D and offered specific reasons why they thought D was the culprit. Suspect C named A but gave vague reasons why A might be the culprit. But note, Suspect D was the only one of the four who declined to name one of the other three.

Often, this is the way it happens. The suspect who refuses to name one of the other suspects is often the one who committed the theft. Why? We really don’t know for sure. Perhaps, the perpetrator realizes that if he names one of the others whom he know is innocent and that suspect is able to prove his or her innocence, then suspicion immediately falls back on the actual perpetrator. Perhaps the true perpetrator just doesn’t want to get an innocent suspect in trouble. Maybe he can find no reason to suspect someone he knows is innocent.

Sometimes, the guilty suspect will go to extremes to avoid naming a co-worker as his or her suspect. Consider the following case. Frank and Jenny were the only employees working third shift in Smart Mart convenience store when a case of cigarettes came up missing from the back room. Both said that if one of them left the sales floor to take a break, the other always remained on the sales floor. When they were asked in confidence who they thought stole the cigarettes, they gave the following answers:

Frank: “I have no idea. It might have been a customer.”
Jenny : “I know I didn’t steal the missing cigarettes so I must have been Frank.”

Jenny’s answer is completely logical. Frank’s is not. It is not logical that a customer could enter the back room, pick up a case of cigarettes and walk out the front door past one of the clerks without being seen. Further, it is not logical for Frank to have “no idea” who committed the theft if the only other plausible suspect is his co-worker, Jenny!  Frank’s second statement, “It could have been a customer” may be partially true. The thief could have been a customer who was also Frank’s co-conspirator.

 Bear in mind that an employee may decline to name another as the one he/she suspects for several reasons:

(1)  The employee you are questioning may have committed other thefts from your business than the one you are investigating at the moment. The co-worker he suspects may know about the thefts committed by the one you are questioning. The one you are questioning fears that if he “rats out” the perpetrator of this theft, that person will turn around and rat him out for other previous thefts.

(2)  The employee you are questioning may not believe his suspicions will be kept confidential.

(3)  When ask who he/she suspects, an employee might respond, “I don’t want to get anyone in trouble.” Chances are an employee who makes this statement knows something that will get that employee in trouble when he tells you about it. What he knows may be related to this theft or some other theft.  The solution is to assure the employee you are questioning that his information will never get back to the one that he suspects.

(4)  The bond between the co-worker you are questioning and the one he suspects may be stronger than the bond between the one you are questioning and his allegiance to your company. Sometimes, that bond can be broken with a simple reminder that you as his employer are the one who puts a roof over this employee’s head and puts food on his table.

The following are answers we have received on our questionnaires in response to the question “Who do you think might have stolen it?” Please note these answers in group 1 below:

“Right after the armored car delivered too much money by mistake, Mr. Davis took a walk out to his car. To roll up the windows, he said. But, there wasn’t a cloud in the sky.”

“Leon says the owner shouldn’t be allowed to accuse us—we should all quit. Everyone else thinks the investigation is no big deal.”

“I think Mary stole the petty cash money. That morning she was trying to borrow money for cigarettes. At lunchtime, she offered to buy us all lunch. Payday ain’t till Friday.”

“The day before the copper cable disappeared from the warehouse, Jeff’s girlfriend told me Jeff and Calvin were stealing everything from this place that they could get their hands on.”

“We were over at Steve’s house and he showed us his new computer. It was just like the ones Mr. Jones said were missing from stock. Steve said he bought it at another store. But, Mr. Jones gives us employees a 40% discount on everything we buy from the company.”

“Before that tray of rings vanished, Jessie’s deadbeat boyfriend used to drop her off at the front door in an old jalopy. Yesterday, I saw him drop her off in a new Cadillac two block away from the store.”

“I don’t know for sure who stole the lumber. But, there’s this customer who shows up early. Has this big truck. He’ll sit in the truck till Troy shows up for work. He only buys from Troy. It never made sense to me.”

“Shamika’s the only one I think had a reason to steal the money. Last week, I picked up the phone and it’s her landlord. He was really mad. He said to tell Shamika if she didn’t pay her rent by five o’clock, he was going to put her stuff out on the street. I know she’s still living there.”

“It might have been Susan who stole those dresses. She was caught stealing from here before and the manager gave her another chance.”

“Tommy told us he did it. He said the manager is cheating on his wife so Tommy says he can’t fire him.”

All of the answers in group 1 above were given in response to questions on the Specific Loss Questionnaire™.

Each of these answers was then used as the basis for “reasonable suspicion” to ask the suspected employee to take polygraph examination under the provisions of the Employee Polygraph Protection Act of 1988.  The employees who provided these answers remained anonymous. Maintaining informant anonymity is permitted by the Act.

When presented with the necessary paperwork offering the opportunity for the reasonably suspected to clear there names by taking polygraph examinations, all but one refused and quit. The one who did take the polygraph examination came out deceptive and confessed.

Ever since the so-called Employee Polygraph Protection Act was passed more than thirteen years ago, come practitioners of business law have been telling their clients they can’t ask their employees to take polygraph examinations under any circumstances. Judge for yourself if the employees named above as suspects qualify under the wording of the Act.

In order to ask an employee to take a polygraph examination about a specific-incident theft, the Employee Polygraph Protection Act requires that employee to have had access. This law also requires “reasonable suspicion” that a suspected employee is the one who actually committed the theft. This law describes “reasonable suspicion” as any of the following:

1. Information from a co-worker
2. An employee’s behavior, demeanor, or conduct
3. Inconsistencies between facts, claims, or statement that surface during an investigation
4. The totality of circumstances surrounding the access such as its unauthorized or unusual nature

The following answers are from Group 2. They are generally not useful in determining who committed the theft under investigation. Some of them say more about the respondent than the employee he or she claims to suspect.

“I think it’s Jeremy. He just gives off bad vibes.”

“Mary’s probably the one. She doesn’t like me.”

“Betty is going to say I did it so maybe she did it.”

“I think it was Matthew because he’s the newest employee.”

“It’s got to be Wally. He’s the only one dumb enough to steal from here.”

“I bet it was Andrew. He’s a minority.”

Oftentimes, employees’ suspicions about who committed a theft are vague--- hunches or gut feelings. In these cases, if one employee is clearly the favorite suspect of the other employees, that person is more often than not the one who committed the theft.

When you are investigating an employee theft from your business, your best “assistants” will your employees themselves—especially those who had access to what was stolen. Collectively they see more and hear more of whatever is happening in your business than you possibly could. They can help you solve employee thefts that occur in your business if you can convince them it is in their best interest to do so.