You’ve noticed the numbers don’t add up. Inventory is consistently short. A trusted employee suddenly has a lifestyle that doesn’t match their salary. Your gut tells you something is wrong but your next move could make or break your case, your company, and potentially your legal standing.
Here’s what most business owners get wrong: they confront the suspected employee immediately. It’s instinct. But acting on suspicion before gathering evidence is one of the costliest mistakes an organization can make. It can tip off the perpetrator, destroy evidence, trigger wrongful termination claims, and derail any prosecution.
The scale of the problem makes getting this right non-negotiable. U.S. businesses lose an estimated $50 billion annually to employee theft, with the average fraud scheme running undetected for 14 months before it’s uncovered. Nearly 30% of business bankruptcies are linked to internal theft. And according to the ACFE’s 2024 Report to the Nations, asset misappropriation, the most common form of employee theft, carries a median loss of $120,000 per case. This is not a small-business problem or a big-corporation problem. It’s every organization’s problem.
What follows is a methodical, legally sound framework for what to do before you ever walk into that room.
Step 1: Pause and Document Everything First
The moment you suspect employee theft, stop. Do not confront, do not alert HR informally, and do not let word travel through the office. Your first job is to document what triggered your suspicion in writing, with timestamps.
Create a private, secure record that includes:
- What anomaly or behavior you observed, and when
- Any supporting documentation (reports, receipts, logs, access records)
- Who else, if anyone, is already aware of your suspicion
- A timeline of events leading up to this point
This initial record becomes the foundation of any subsequent investigation. Courts and investigators rely on contemporaneous documentation notes made at the time of discovery carry far more weight than reconstructed timelines. If employee theft is eventually prosecuted, this paper trail matters enormously.
Step 2: Secure and Preserve EvidenceWithout Tipping Your Hand
Before anything else is disturbed, lock down access to the relevant data. This means preserving financial records, access logs, surveillance footage, email archives, and any physical documents without alerting the suspected employee.
Key actions at this stage:
- Back up digital records to a secure, access-controlled location. Many perpetrators delete files when they sense scrutiny.
- Preserve surveillance footage immediately, many systems automatically overwrite recordings on a rolling basis.
- Do not access the employee’s workstation, email, or files yourself without legal clearance. Unauthorized access can compromise admissibility and create liability.
- Avoid discussing the situation with colleagues or other staff. Leaks destroy investigations.
This is also the moment to review whether your organization has proper policies in place authorizing monitoring and record access gaps here that can become legal vulnerabilities. For a detailed look at the rules governing recorded evidence, our guide on whether it’s legal to record someone for fraud evidence is essential reading.
Step 3: Conduct a Quiet Preliminary Assessment
Before calling in investigators or escalating to leadership, conduct a discreet internal review to determine whether the evidence supports a credible suspicion. The goal is to establish whether you have an anomaly, an error, or a pattern.
Ask yourself:
- Is this a one-time discrepancy, or does it repeat across multiple periods?
- Does the activity align with a specific employee’s access, role, or schedule?
- Are there alternative explanations (system errors, policy misunderstandings, vendor issues)?
Cross-reference financial records, approval chains, inventory counts, and access logs. If your preliminary review reveals a pattern, especially one that points to a specific individual with repeated access that significantly strengthens the basis for a formal investigation. Refer to our breakdown of the 7 signs of corporate fraud most companies ignore to benchmark what you’re seeing against known red flags.
If your suspicion involves someone in an accounting or finance role, our article on 10 red flags your accountant might be embezzling outlines the specific indicators to watch for critical because 37% of all embezzlers work in finance or bookkeeping.
Step 4: Bring In the Right PeopleQuietly
Once you have documented suspicion and preserved initial evidence, it’s time to loop in qualified professionals. This is not a moment for informal conversations, it’s a moment for confidential, structured engagement.
Engage legal counsel first. An employment attorney will advise you on your rights to investigate, proper access to employee records, and how to protect the organization from wrongful termination or discrimination claims. This step is non-negotiable.
Consider a professional fraud examiner. Certified Fraud Examiners (CFEs) and forensic accountants are trained specifically to investigate employee theft without contaminating evidence. They know how to document findings in a manner that holds up in court or administrative proceedings. Our article on how to prove embezzlement without direct evidence walks through exactly what this process looks like.
Understand the cost-benefit calculus. Professional fraud investigations have a cost, but so does an unresolved employee theft case that festers for another year. Our 2026 fraud investigation pricing guide can help you benchmark realistic expectations.
For clarity on when a formal investigation is warranted versus when internal audit processes suffice, see our comparison of fraud investigation vs. internal audit.
Step 5: Review Your Internal Controls While the Investigation Is Active
An active suspicion of employee theft is also a signal that something in your control environment allowed it to happen. While the investigation proceeds, conduct a parallel review of your internal controls not to assign blame, but to close the gap.
Common control failures that enable employee theft include:
- Single-person authority over payments, approvals, or reconciliations
- Infrequent or superficial audit reviews
- Excessive system access beyond what a role requires
- No whistleblower reporting channel or culture of reporting
- Weak segregation of duties in financial workflows
Tightening these controls during an active investigation also signals to other employeeswithout raising alarmsthat scrutiny has increased. And as AI-powered schemes become more sophisticated, layering in technology-driven detection matters more than ever. Our analysis of how AI-powered fraud is reshaping corporate security in 2026 covers the emerging landscape your controls need to account for.
When You’re Ready to Confront: Do It Right
After evidence has been gathered, legal counsel has been consulted, and investigators have completed their work, the confrontation, if it happens, should be structured, documented, and conducted with HR and legal present. It is not an interrogation; it is a formal meeting with a predetermined outcome path depending on the employee’s response.
Never confront based on suspicion alone. The cost of being wrong legally, reputationally, and financially is significant. The cost of being patient and methodical is almost always lower.
Frequently Asked Questions
1. Should I notify law enforcement before completing an internal investigation?
In most cases, it’s advisable to complete at least a preliminary internal investigation before involving law enforcement, so you have documented evidence to present. However, if the theft is ongoing, large-scale, or involves a safety risk, your legal counsel may recommend earlier law enforcement engagement. Coordinate this decision with your attorney to avoid missteps that could compromise a criminal case.
2. Can I fire an employee if I only have suspicion but not proof?
You may have the legal right to terminate an at-will employee without proof of theft, but doing so prematurely creates real risk including wrongful termination claims and damage to any concurrent criminal or civil case. Consult an employment attorney before taking any termination action. Documentation and due process are your best protection.
3. What if other employees are involved?
Multiple-perpetrator schemes are more common than most organizations realize; the ACFE reports that 38% of employee theft cases involve two or more individuals. Investigate the network, not just the individual. A professional fraud examiner can map relationships, access patterns, and timing to determine whether collusion is occurring.
4. Is my organization liable if the investigation violates the employee’s privacy?
Yes, potentially. Accessing employee communications, devices, or records without proper authorization or policy backing can expose your organization to claims under federal and state privacy laws. This is precisely why legal counsel should be engaged before investigative access begins, not after.
5. How long does a fraud investigation typically take?
The timeline varies significantly depending on the complexity of the scheme, the volume of records involved, and whether law enforcement is engaged. Simple cases may be resolved in weeks; complex multi-year schemes can take months to fully document. On average, fraud schemes run for 14 months before detection so thorough investigation takes time to do correctly.
6. What should I do if the suspected employee is a senior executive or owner?
High-authority fraud is disproportionately costlyThe ACFE reports that the median loss for owner/executive fraud is $573,000, compared to $60,000 for non-manager employees. In these cases, the board of directors or an independent audit committee typically takes over the investigation. External forensic accountants and legal counsel become especially critical to ensure independence and credibility.
References
- Association of Certified Fraud Examiners (ACFE). (2024). Report to the Nations: Global Study on Occupational Fraud and Abuse. https://www.acfe.com/report-to-the-nations/2024/
- Embroker Team. (2025). 70+ Employee Theft Statistics for 2025. https://www.embroker.com/blog/employee-theft-statistics/
- Business.com. (2025). The State of Workplace Theft in 2025. https://www.business.com/articles/workplace-theft-study-statistics/
- GetSafeAndSound. (2025). 50 Alarming Employee Theft Statistics & Data (2025). https://getsafeandsound.com/blog/employee-theft-statistics/
- Metrobi. (2025). Employee Theft Statistics for 2025. https://metrobi.com/blog/employee-theft-statistics-for-2025/
- SMBGuide. (2025). 25+ Employee Theft Statistics to Watch Out For in 2025. https://www.smbguide.com/employee-theft-statistics/
- InCorp. (2025). How Big of a Problem is Employee Theft and Fraud? https://www.incorp.com/help-center/business-articles/employee-theft-and-fraud-part1
- U.S. Department of Justice. (2025). Corporate Fraud. https://www.justice.gov/criminal/corporate-fraud
- U.S. Federal Bureau of Investigation (FBI). (2024). White-Collar Crime. https://www.fbi.gov/investigate/white-collar-crime
- JW Surety Bonds. (2025). 35+ Shocking Employee Theft Statistics. https://www.jwsuretybonds.com/blog/employee-theft-statistics
Disclaimer
This article is for informational and educational purposes only and does not constitute legal, financial, or professional investigative advice. Reading this content does not create a client relationship with FraudOrder or any affiliated professional. Every situation involving suspected employee theft is uniqueconsult qualified legal counsel and a certified fraud examiner before taking investigative or employment action. For questions about FraudOrder services, visit https://fraudorder.co/