What are the best practices for conducting internal investigations into employee theft?

Conducting an internal investigation into employee theft requires a careful balance between uncovering the truth, protecting company assets, and respecting employee rights to avoid legal liabilities like defamation or wrongful termination.

Essential best practices for managing this process effectively include:

1. Act Quickly and Discreetly — Limit knowledge of the investigation to a strict "need-to-know" circle (such as HR, legal counsel, and key leadership). Confidentiality prevents evidence tampering, protects the accused employee’s reputation if they turn out to be innocent, and maintains workplace morale.
2. Select an Objective Investigator — Ensure the person leading the investigation has no personal or professional conflict of interest with the suspect or department involved. For complex financial or high-level thefts, consider bringing in an outside forensic specialist or neutral third party.
3. Gather and Secure Objective Evidence First — Rely on hard data before conducting interviews. Pull relevant audit trails, surveillance video, system access logs, transaction records, and inventory counts. Secure digital and physical evidence immediately so it cannot be altered or deleted.
4. Partner Closely with Human Resources and Legal — Involve HR and legal counsel early to ensure your steps comply with local employment laws, labor agreements, and privacy regulations.
5. Conduct Professional, Structured Interviews — Interview witnesses and the complainant before confronting the primary suspect. When you do interview the accused, maintain a neutral tone, ask open-ended questions, stick strictly to verified facts, and avoid premature accusations. Always have a witness (such as an HR representative) present.
6. Properly Document Everything — Keep detailed, factual, and chronological notes of all findings, evidence gathered, and statements made. If a confession or admission occurs, document it accurately and have the employee and witnesses sign a written account if appropriate and voluntary.
7. Determine Consistent and Fair Disciplinary Action — Review the findings objectively against company policy. Ensure that any resulting discipline or termination aligns with how past, similar infractions were handled within the organization to minimize claims of discrimination or unfair treatment.

Employee Perspectives

People who handle loss prevention often emphasize keeping a cool, fact-based head over rushing to a judgment:

Start discreetly. Limit who knows. Inform only relevant stakeholders—usually security, HR, and senior management. This protects the integrity of the investigation.

Maintain objectivity. Avoid bias. Investigate facts, not feelings. Treat the suspect fairly and professionally throughout the process.

If you are dealing with a specific scenario, let me know:

• Is the suspected theft physical inventory or financial/digital?
• Have you already confronted the employee?

I can provide more tailored guidance on next steps or evidence gathering.

A sound employee-theft investigation should be prompt, impartial, evidence-driven, and carefully documented. The goal is to determine what happened—not to prove the initial suspicion. The EEOC's investigation guidance similarly emphasizes neutral fact-finding, relevant and reliable evidence, interviewing relevant witnesses, and giving the parties an opportunity to provide evidence.

Recommended process

Common mistakes to avoid

• Assuming guilt because the employee had access to the missing property.
• Searching personal devices or accounts without considering applicable legal restrictions.
• Destroying or altering original evidence.
• Conducting a "confession-first" interview.
• Ignoring evidence favorable to the employee.
• Discussing the allegation broadly among employees.
• Treating an employee differently because they participated in a protected complaint or investigation.
• Firing first and investigating afterward.
• Making a criminal accusation when the evidence only establishes an unexplained discrepancy.
• Using inconsistent disciplinary standards for similar misconduct.

For a U.S. employer, the exact procedure should be adapted to the state and circumstances involved—particularly if you are considering searches, accessing electronic communications, recording interviews, suspension, termination, or referral to police.

Conducting an internal investigation into employee theft requires acting swiftly, maintaining strict confidentiality, preserving evidence objectively, and ensuring an impartial process that protects both the organization's legal standing and employee rights .

Key Best Practices

1. Conduct a Preliminary Assessment

• Assess the credibility and detail of the initial report before taking overt action.
• Define the precise scope, potential financial exposure, and key systems or areas involved.

1. Select an Impartial Investigator

• Assign a neutral, trained investigator or team with no personal stake or conflicts of interest.
• Use internal security, HR professionals, or external legal/forensic specialists depending on the scale of the theft.

1. Preserve Physical and Digital Evidence

• Secure relevant logs, surveillance footage, access-card data, emails, and financial records immediately to prevent spoliation.
• Restrict data access and document a clear chain of custody for any physical items or digital files gathered.

1. Maintain Strict Confidentiality

• Limit knowledge of the investigation strictly to those with a clear need to know.
• Remind all witnesses and participants of the importance of discretion to protect the reputation of the accused and integrity of the process.

1. Structure Professional Witness Interviews

• Plan the order of interviews carefully, starting with neutral witnesses, followed by corroborating sources, and concluding with the accused employee.
• Utilize two interviewers where feasible—one to lead the questioning using open-ended inquiries and a second to take clean, verbatim notes.

1. Document Everything Thoroughly

• Keep a comprehensive, chronological file containing all evidence logs, interview notes, and timeline records.
• Ensure reports focus on objective facts and direct evidence rather than personal assumptions or speculation.

1. Determine Appropriate Remedial or Legal Action

• Evaluate findings against company policies to decide on disciplinary actions, termination, or procedural updates.
• Consult legal counsel or law enforcement if the scale of the theft warrants criminal prosecution or formal recovery.

If you'd like, let me know:

• Is the suspected theft digital/financial or physical inventory?
• Have you already notified law enforcement or internal counsel?

I can provide more tailored guidance for your specific situation.

Internal investigations into suspected employee theft should be prompt, impartial, evidence-driven, and carefully documented. The goal is to determine what actually happened—not to prove the initial suspicion.

A sound investigation process

• Could there have been an accounting or inventory error?
• Did someone else have access?
• Could the records be inaccurate?
• Was the policy ambiguous?
• Is there evidence contradicting the allegation?
• Have similarly situated employees been treated consistently?

1. Make findings based on the evidence Separate:

• Facts established by evidence
• Facts that remain disputed
• Credibility assessments
• Policy violations
• Recommended action

Don't state "the employee committed theft" merely because the evidence creates suspicion. Your organization's applicable policy and the governing law determine the appropriate standard and terminology.

1. Document the conclusion A useful final report generally contains:

• allegation and scope;
• investigation steps;
• evidence reviewed;
• interviews conducted;
• factual findings;
• relevant policy provisions;
• conclusion for each allegation;
• recommended corrective action.

Keep investigative materials securely and separately from ordinary personnel records where appropriate.

Pay particular attention to retaliation and discrimination

An employee accused of theft does not lose employment-law protections. If the employee recently complained about discrimination, participated in an EEO investigation, requested an accommodation, or engaged in another protected activity, have counsel/HR scrutinize any proposed discipline. Federal law prohibits retaliation for protected EEO activity, including participating in an internal EEO investigation.

Likewise, compare the proposed discipline with how the organization has handled genuinely comparable misconduct. Inconsistent treatment can create significant legal risk.

When to involve law enforcement

For substantial theft, fraud, organized activity, threats, or situations involving regulated property, the company should consider obtaining legal advice before contacting police. Counsel can help assess reporting obligations, evidence preservation, insurance requirements, and how a criminal investigation could interact with the employment investigation.

One important distinction: an internal investigation is not a police interrogation. Avoid coercive tactics, unauthorized searches of personal property/accounts, or accessing communications or devices without appropriate legal authority and company policy. Privacy and employment laws vary substantially by jurisdiction.

If you're conducting one in California, I can also give you a California-specific investigation checklist covering employee interviews, workplace searches, surveillance, electronic evidence, leave/suspension, termination, and when to involve employment counsel.

Conducting an internal investigation into employee theft requires a delicate balance between uncovering the truth, protecting company assets, and respecting employee rights to avoid legal liabilities like defamation, wrongful termination, or invasion of privacy.

The recommended best practices for managing this process step-by-step include:

1. Initial Assessment and Planning

• Select an impartial investigator: Choose an investigator (HR professional, internal security, or an external investigator for high-level executives or complex fraud) who has no personal stake or bias in the matter.
• Determine the scope: Define what is being investigated, who might be involved, and what company policies or legal regulations apply.
• Evaluate interim measures: Decide if the suspected employee should be temporarily reassigned or placed on a paid administrative leave during the investigation to prevent further loss or evidence tampering. Outline terms clearly in writing.

2. Gathering and Preserving Evidence

• Secure physical and digital evidence: Immediately preserve relevant surveillance footage, access logs, emails, financial records, and point-of-sale data.
• Maintain a strict chain of custody: Document every single person who handles physical evidence to prevent claims that evidence was planted, altered, or lost.
• Keep files separate: Maintain all investigation notes, evidence, and reports in a confidential file completely separate from general personnel files.

3. Conducting Interviews

• Establish a logical order: Generally, interview the complainant/witnesses first, and interview the accused employee last once you have gathered a clear baseline of the facts.
• Maintain neutrality: Approach interviews with complete neutrality. Do not lead with accusations or show anger; frame questions around gathering facts, timelines, and explanations.
• Document meticulously: Take comprehensive notes (or record if legally permissible and standard practice) covering dates, times, locations, and statements made during every interview. Emphasize confidentiality to all participants.

4. Evaluating Findings and Making a Decision

• Assess the weight of evidence: Weigh credibility, corroboration, consistency, and plausibility rather than relying on gut feelings.
• Consult legal counsel: Before taking disciplinary or criminal action, review your findings with legal counsel—especially concerning how the final charge is labeled (e.g., phrasing it as a "policy violation" rather than outright "theft" until proven, which helps mitigate defamation risks).
• Ensure consistency: Check how the company has handled similar infractions in the past to ensure the disciplinary response is equitable and avoids claims of discrimination or unfair treatment.

If you'd like, let me know:

• What type of theft you are dealing with (cash, inventory, intellectual property, or digital assets)
• Whether you have suspects identified yet

I can provide more tailored guidance on the evidence-gathering phase or interview questions.

Internal investigations into employee theft should be prompt, impartial, evidence-driven, and carefully documented. The goal is not simply to prove a suspicion; it is to determine what happened, preserve evidence, protect the organization, and reach a defensible conclusion.

A practical investigation framework

1. Assess the allegation immediately

• Identify what is allegedly missing, when it occurred, how the loss was detected, and who reported it.
• Determine whether the theft may be ongoing.
• Consider whether there are immediate risks to cash, inventory, systems, records, or other employees.
• Avoid prematurely labeling an employee as the culprit.

2. Put the right people in charge

• Assign an investigator who is sufficiently independent and has appropriate investigative skills.
• Depending on the circumstances, involve HR, internal audit, finance, security, IT/forensics, or outside counsel.
• For significant losses, potential criminal conduct, senior executives, or substantial litigation risk, involving employment counsel early is prudent.
• ACFE emphasizes planning, evidence gathering, interviews, documentation, and awareness of employees' legal rights as core elements of an effective investigation.

3. Define the scope and preserve evidence

• Establish the specific allegations you're investigating.
• Secure relevant accounting records, inventory records, receipts, access logs, emails, company-device data, surveillance footage, expense reports, and other potentially relevant information.
• Preserve original records and document how and when evidence was obtained.
• Be especially careful with electronic evidence; don't casually search personal devices or accounts without appropriate legal authority and advice.
• ACFE recommends promptly securing physical and electronic evidence and documenting its handling and chain of custody.

4. Investigate objectively

• Build a timeline of events.
• Reconcile the financial or inventory discrepancy independently.
• Identify evidence that supports and contradicts the allegation.
• Examine whether internal controls made the alleged theft possible and whether other people had the opportunity to commit it.
• Don't let the initial complaint dictate the conclusion.

5. Interview witnesses before the subject when appropriate

• Start with people who can establish the facts without alerting the subject unnecessarily.
• Ask open-ended questions first, then narrow down inconsistencies or specific transactions.
• Record dates, times, participants, and important statements.
• ACFE stresses careful preparation and ethically structured fact-finding interviews; poorly planned questioning can contaminate or weaken an investigation.

6. Interview the accused fairly

• Give the employee a meaningful opportunity to explain the evidence and provide relevant information.
• Avoid accusatory or threatening tactics.
• Present established facts rather than unsupported accusations.
• Ask for explanations of specific discrepancies and follow up on inconsistencies.
• Consider having HR or another appropriate representative present, depending on company policy and applicable law.

7. Protect confidentiality—but don't promise absolute secrecy

• Limit information to people with a legitimate need to know.
• Tell participants not to interfere with the investigation or retaliate against witnesses.
• Don't make promises such as "this will remain completely confidential," because complete confidentiality often cannot be guaranteed.
• EEOC guidance emphasizes prompt, thorough, impartial investigations and protecting participants from retaliation in employment investigations.

8. Be particularly careful about retaliation and discrimination

• An employee under investigation can simultaneously have legally protected activity—for example, a discrimination complaint.
• Separate the misconduct investigation from any protected complaint and document legitimate reasons for employment decisions.
• Apply disciplinary standards consistently across comparable cases.
• EEOC guidance makes clear that employees can still face legitimate consequences for misconduct, but the employer must distinguish those decisions from retaliation.

9. Reach a conclusion based on the evidence A useful final assessment is:

• Substantiated: evidence supports that the misconduct occurred and the employee was responsible.
• Unsubstantiated: available evidence does not establish the allegation.
• Inconclusive: evidence is insufficient to reach a reliable conclusion.
• Exonerated/not involved: evidence affirmatively points away from the employee.

The exact terminology should match your organization's policies. 10. Document the investigation The final file should generally contain:

• The original allegation
• Scope and investigative plan
• Relevant policies
• Evidence collected
• Interview notes/statements
• Financial or inventory analysis
• Timeline
• Credibility/evidence assessment
• Findings
• Disciplinary or remedial recommendations
• Evidence of how the conclusion was reached

ACFE specifically recommends comprehensive documentation of investigative procedures, interviews, findings, evidence, financial analysis, and recommendations.

Don't overlook the "why"

A good investigation should determine not only who took what, but also how the theft was possible.

For example, if an employee stole $30,000 in inventory because one person could create vendors, approve invoices, receive goods, and authorize payment, terminating that employee doesn't solve the underlying problem. Strengthen segregation of duties, access controls, inventory reconciliation, approval procedures, and monitoring.

Common mistakes to avoid

• Starting with the assumption that the suspected employee is guilty.
• Confronting the employee before securing evidence.
• Searching personal devices/accounts without appropriate authority.
• Allowing managers to conduct an informal interrogation.
• Sharing allegations broadly around the workplace.
• Ignoring evidence that contradicts the initial theory.
• Failing to interview witnesses who may support the employee's explanation.
• Treating similar employees differently.
• Failing to preserve surveillance or electronic evidence before it disappears.
• Terminating someone before the investigation is sufficiently complete.
• Writing a conclusion that is stronger than the evidence supports.

For a significant theft, especially one involving large financial losses, electronic evidence, executives, potential criminal charges, or a likely termination, I'd strongly recommend having employment counsel guide the investigation before taking irreversible steps. The precise rules governing searches, privacy, employee rights, recordings, wage deductions, termination, and reporting to law enforcement vary by jurisdiction and circumstances.

The overarching principle is: investigate the facts first, preserve the evidence, give the employee a fair opportunity to respond, document the reasoning, and only then decide what action is justified.

• Starting with the assumption that the suspected employee is guilty.
• Confronting the employee before securing evidence.
• Searching personal devices/accounts without appropriate authority.
• Allowing managers to conduct an informal interrogation.
• Sharing allegations broadly around the workplace.
• Ignoring evidence that contradicts the initial theory.
• Failing to interview witnesses who may support the employee's explanation.
• Treating similar employees differently.
• Failing to preserve surveillance or electronic evidence before it disappears.
• Terminating someone before the investigation is sufficiently complete.
• Writing a conclusion that is stronger than the evidence supports.

For a significant theft, especially one involving large financial losses, electronic evidence, executives, potential criminal charges, or a likely termination, I'd strongly recommend having employment counsel guide the investigation before taking irreversible steps. The precise rules governing searches, privacy, employee rights, recordings, wage deductions, termination, and reporting to law enforcement vary by jurisdiction and circumstances.

Conducting an internal investigation into employee theft requires a delicate balance of protecting company assets, maintaining confidentiality, and respecting employee rights to avoid legal liabilities like defamation or wrongful termination.

Key Best Practices

1. Establish a Neutral Investigation Team
   • Objective parties: Assign investigators who have no personal or professional ties to the accused employee or the reporting party to ensure complete neutrality.
   • Cross-functional expertise: Include representatives from Human Resources, Legal, and Corporate Security or Internal Audit.
2. Act Promptly and Confidentially
   • Immediate action: Initiate the investigation as soon as credible information or a complaint is received.
   • Need-to-know basis: Limit knowledge of the investigation strictly to those directly involved to prevent gossip, protect the reputation of the accused (if found innocent), and avoid the destruction of evidence.
3. Secure and Preserve Evidence
   • Digital and physical trails: Preserve relevant emails, CCTV footage, system access logs, and financial records immediately.
   • Chain of custody: Maintain a strict log of who collected, handled, and stored physical or digital evidence to ensure its integrity if law enforcement or courts become involved.
4. Conduct Thorough and Objective Interviews
   • Order of interviews: Start with witnesses, move to the reporting party, and interview the accused individual last.
   • Neutral questioning: Ask open-ended, factual questions (who, what, when, where) rather than leading or accusatory ones.
   • Witness presence: Consider having two company representatives present during all formal interviews to act as objective witnesses and take detailed notes.
5. Respect Employee Rights and Due Process
   • Fair opportunity: Give the accused employee a fair chance to respond to the allegations and present their own evidence or explanations.
   • Avoid defamation: Keep all findings strictly confidential and do not share details of the investigation with staff members who do not have a business need to know.
6. Document Everything Thoroughly
   • Factual reporting: Create a comprehensive written report detailing the initial complaint, the investigative steps taken, the evidence gathered, summaries of interviews, and a factual conclusion.
   • Subjectivity vs. objectivity: Stick strictly to verified facts, dates, and documented evidence rather than personal assumptions or opinions.
7. Determine Remedial Action and System Improvements
   • Consistent enforcement: Apply disciplinary measures consistently in alignment with company policies and past precedent.
   • Root-cause analysis: Use the findings to identify and patch security vulnerabilities, update internal controls, or provide additional employee training.

If you'd like, let me know:

• The nature or scale of the suspected theft (e.g., cash, inventory, or intellectual property)
• Whether the employee is still active or currently suspended

I can help tailor the steps for evidence gathering or interview preparation to your specific situation.

Internal investigations into employee theft should be prompt, impartial, evidence-driven, confidential to the extent possible, and consistent with company policy and applicable law. The goal is not simply to “prove the employee stole”—it is to determine what happened, preserve reliable evidence, protect the company and employees, and make a defensible decision.

Recommended process

1. Define the allegation and scope

• Record exactly what is suspected: what property or money, approximate amount, dates, locations, and how the allegation arose.
• Identify the policies potentially implicated.
• Decide who will investigate and who has authority to make the final employment decision.
• For significant losses, senior employees, regulated businesses, or potential criminal conduct, involve employment counsel early.

2. Preserve evidence immediately

• Secure relevant transaction records, inventory records, receipts, access logs, time records, emails, messages, photographs, and surveillance footage.
• Preserve originals rather than relying solely on screenshots or summaries.
• Take steps to prevent routine deletion or alteration of potentially relevant electronic information. DOJ compliance guidance specifically emphasizes having mechanisms for preserving information across electronic communication channels.
• Limit access to the investigation to people with a legitimate need to know.

3. Start with objective evidence Don't begin by deciding that the accused employee is guilty. Establish the factual timeline first.

Useful evidence can include:

• Point-of-sale and accounting records
• Inventory counts and discrepancies
• Expense reports and receipts
• Badge/access-control records
• Computer or system audit logs
• Relevant surveillance footage
• Shipping and receiving records
• Emails or other business communications
• Witness observations

Evidence should be assessed for relevance, materiality, authenticity, and reliability rather than simply accumulating as much information as possible. EEOC 4. Interview witnesses before the accused employee when appropriate Use open-ended questions first:

• “Walk me through what happened.”
• “What did you personally observe?”
• “Who else was present?”
• “What records would help establish what happened?”

Distinguish firsthand observations from rumors or conclusions. Document who was interviewed, when, what was asked, and what evidence the witness identified. 5. Interview the employee fairly Give the employee a meaningful opportunity to respond to the allegations and explain apparently contradictory evidence.

Avoid accusatory questions such as “Why did you steal the money?” Instead:

“Our records show a $1,500 discrepancy on these dates. Help me understand what happened.” Don't reveal every piece of evidence prematurely if doing so could compromise the investigation.

6. Maintain confidentiality—but don't promise absolute secrecy Tell participants that information should be kept confidential to the extent reasonably possible and permitted by law. A thorough investigation may require sharing information with certain witnesses, managers, HR, counsel, auditors, or authorities. EEOC guidance similarly emphasizes confidentiality consistent with conducting a thorough and impartial investigation.
7. Watch carefully for retaliation This is particularly important if the employee or a witness has also made a discrimination, harassment, wage, safety, or other legally protected complaint. Employment actions should be based on legitimate, independently supported reasons—not on participation in a protected investigation or complaint.

If there is an overlapping protected complaint, consider having HR or counsel independently review any proposed discipline or termination. 8. Analyze both inculpatory and exculpatory evidence A good investigation actively looks for evidence that could disprove the allegation as well as evidence supporting it.

For example, an inventory shortage doesn't necessarily establish theft. Alternative explanations might include:

• Counting errors
• Incorrect system entries
• Unauthorized access by another employee
• Damaged or misplaced inventory
• Processing mistakes
• Accounting discrepancies

9. Reach a documented conclusion Prepare a concise investigative report containing:

• Allegation
• Scope and methodology
• Relevant policies
• Evidence reviewed
• Witnesses interviewed
• Material facts established
• Employee's response
• Credibility/reliability considerations
• Findings for each allegation
• Recommended corrective action, if appropriate

Keep facts separate from conclusions. For example, “Camera footage shows Employee A removing three boxes at 8:42 p.m.” is a factual finding; “Employee A stole the merchandise” is a conclusion. 10. Apply discipline consistently Compare the proposed discipline with how similarly situated employees have been treated. Inconsistent discipline can create significant employment-law risk, particularly where protected activity is involved. EEOC guidance specifically identifies comparative treatment and the employer's ability to substantiate its legitimate reason for discipline as important considerations. EEOC 11. Consider whether law enforcement should be involved For substantial theft, fraud, identity-related offenses, threats, organized misconduct, or other potentially criminal conduct, consult counsel about whether and when to contact law enforcement or insurers. Avoid making an accusation to police before the company's factual investigation is sufficiently reliable. 12. Fix the underlying control weakness Don't stop at “employee committed theft.” Determine how it was possible:

• Was one person able to authorize and process transactions?
• Were inventory reconciliations inadequate?
• Were system permissions excessive?
• Were cash-handling controls weak?
• Was there insufficient supervisory review?

DOJ guidance treats investigation of misconduct and remediation of underlying weaknesses as important elements of an effective compliance program.

Common mistakes to avoid

• Assuming guilt before investigating.
• Conducting the investigation through gossip or informal conversations.
• Searching personal devices/accounts without appropriate legal authority or policy support.
• Altering or deleting original evidence.
• Confronting the employee aggressively.
• Promising witnesses complete secrecy.
• Treating a confession as the end of the investigation without corroboration.
• Ignoring evidence that favors the employee.
• Automatically terminating someone without checking company policy and comparable cases.
• Taking adverse action because an employee participated in a legally protected complaint or investigation.
• Allowing the same manager who is implicated in the allegation to control the entire investigation.

One practical rule: approach the investigation as though a neutral third party will eventually have to evaluate every important decision you made. That tends to produce better evidence, fairer treatment, and a much more defensible outcome.

If you're in the U.S., the exact procedure can vary substantially by state, industry, union status, employment agreement, and whether electronic devices or personal data are involved, so counsel should review higher-risk cases before evidence collection or termination.

Conducting an internal investigation into employee theft requires a delicate balance of protecting company assets, maintaining confidentiality, and respecting employee legal rights. A mishandled investigation can lead to wrongful termination suits, defamation claims, or compromised evidence.

Best Practices for Internal Investigations

Would you like assistance on how to structure interview questions for the accused employee or guidance on preserving digital evidence safely?

Conducting an internal investigation into suspected employee theft requires a process that is fair, objective, well-documented, and legally defensible. The goal is to determine facts—not to confirm a suspicion. A strong investigation protects the organization, preserves evidence, and reduces the risk of wrongful discipline or legal claims.

1. Assess the allegation and define the scope

Before taking action:

• Document how the concern was reported (audit finding, tip, inventory discrepancy, financial irregularity, etc.).
• Identify the specific allegation: - What was allegedly taken or misused?
• When did it occur?
• Who may have had access?
• What policies or controls may have been violated?
• Decide whether the matter requires: - An internal HR/loss prevention investigation
• Finance or forensic review
• Outside counsel or an external investigator (especially if senior leaders are involved or litigation is likely)

Avoid assuming guilt based solely on a report or unusual behavior.

2. Select a neutral investigator

The investigator should:

• Have no personal stake in the outcome.
• Be trained in workplace investigations.
• Be able to evaluate evidence objectively.
• Have authority to interview employees and collect relevant records.

Depending on the circumstances, the investigator may be:

• HR
• Internal audit
• Loss prevention/security
• Compliance
• Outside counsel or a third-party investigator

3. Preserve evidence immediately

The risk of evidence being altered or lost increases once a person suspects they are under investigation. Consider preserving:

• Inventory records
• Cash reports and transaction logs
• Expense reports
• Purchasing records
• Access-control logs
• Emails and messages
• Computer files and audit trails
• Security footage
• Relevant policies and training records

Collect only information relevant to the investigation and maintain proper handling records.

4. Create an investigation plan

A written plan helps maintain consistency. Include:

• Allegations being investigated
• Questions to answer
• Evidence sources
• Witness list
• Interview order
• Decision-makers
• Expected timeline

Keep the scope flexible if new evidence emerges.

5. Conduct interviews carefully

A typical order is:

1. Reporting employee or source of the allegation
2. Witnesses with relevant information
3. The employee accused of theft (often after enough facts have been gathered to ask informed questions)

Good interview practices:

• Use open-ended questions first.
• Ask for timelines and specific details.
• Avoid leading questions.
• Give the employee an opportunity to explain discrepancies.
• Take detailed notes.
• Document admissions, denials, and supporting evidence.

Confidentiality should be maintained as much as practical, but investigators should avoid promising absolute secrecy if disclosure may become necessary.

6. Evaluate evidence objectively

Consider:

• Reliability of each source
• Whether evidence is consistent or contradictory
• Whether there are alternative explanations
• Whether company procedures or controls contributed to the issue
• Whether the evidence supports a finding that misconduct more likely occurred

Many workplace investigations use a “more likely than not” standard rather than a criminal-law standard of proof.

7. Document findings

A final report should generally include:

• Investigation scope
• Methodology
• Evidence reviewed
• Interviews conducted
• Key facts established
• Credibility assessments where appropriate
• Findings on each allegation
• Recommended corrective actions (if part of the investigator’s role)

Avoid unnecessary speculation or personal judgments.

8. Decide and apply corrective action consistently

Possible outcomes may include:

• No action if allegations are unsubstantiated
• Coaching or policy reminders
• Restitution or recovery efforts
• Discipline up to termination
• Referral to law enforcement when appropriate

Apply policies consistently across employees to reduce claims of unfair treatment or retaliation.

9. Address control failures

Employee theft investigations often reveal weaknesses such as:

• Poor segregation of duties
• Excessive system access
• Weak inventory controls
• Inadequate approval processes
• Lack of auditing

Use findings to improve systems, not only to address the individual incident.

10. Protect against retaliation

Monitor for retaliation against:

• Employees who reported concerns
• Witnesses
• Employees who participated in interviews

Make clear that retaliation is prohibited and provide appropriate reporting channels.

Common mistakes to avoid

• Confronting the employee before preserving evidence
• Treating suspicion as proof
• Using an investigator with a conflict of interest
• Conducting inconsistent investigations for similar conduct
• Sharing details unnecessarily
• Destroying or failing to preserve records
• Pressuring employees into admissions

For a high-value theft allegation, executive involvement, possible criminal conduct, or significant litigation risk, organizations often involve employment counsel early to help structure the investigation appropriately.