Responding to suspected employee theft

Suspected theft by an employee requires a sequenced response, and acting on suspicion before investigating creates its own claims.

Preserve first. Secure records, images of devices, access logs and financial data before the employee knows. Confronting first destroys the evidence.

Investigate under privilege, with counsel directing the work and a forensic accountant where the amounts warrant.

Interview last. Once the documentary case is understood. The interview should be documented, non-coercive, and conducted by two people. Detention, threats of prosecution to extract restitution, and refusal to allow the employee to leave create false imprisonment and extortion exposure.

Employment action. Separate from any criminal question, and based on the documented findings. Follow the ordinary process.

Recovery. Restitution agreements are enforceable and should be documented with a payment schedule, security, and a confession of judgment where lawful. Conditioning non-referral on payment is dangerous and in some states unlawful.

Insurance. Employee dishonesty coverage under a crime policy, with short notice and proof of loss deadlines.

Referral to law enforcement. A business decision. Referral removes control of the timeline and of publicity, and can complicate civil recovery.

Communications. Internal statements should be limited to those with a need to know, factual, and free of conclusions.