What it means
A store discovers missing stock after a shift, and theft is one possible cause alongside receiving errors, damage or misplaced goods, so managers should check records before accusing anyone. The Association of Certified Fraud Examiners studies occupational fraud and common control weaknesses, but its findings are broad trends and not proof about a particular employee, so a business needs case-specific evidence.
A fictional hardware store sees repeated shortages of one tool, checks purchase receipts, transfers and cycle counts, and documents the pattern before deciding whether there is misconduct. Theft can involve cash, inventory, equipment, confidential data or false paid hours, and these carry different evidence and legal implications, so do not combine every operational loss into one employee-theft category.
A fictional restaurant finds a till $50 short, recounts the cash and checks refunds and safe drops, and resolves the variance as a posting error so no employee is wrongly blamed. CIPD's guidance on disciplinary and grievance processes emphasises fair investigation in a UK employment setting, and other jurisdictions have their own rules, but the need for care and evidence remains.
Controls can reduce opportunity, since separation of duties, access limits, inventory counts and transaction reviews make losses easier to detect, though they should not be used to presume every worker is dishonest. A fictional warehouse requires approval for write-offs over a threshold, logs who requested and approved each change, and lets staff report damaged stock without automatic accusation.
A confidential reporting route can surface concerns early, and the ACFE reports that tips are a frequent detection channel in occupational fraud cases, although that does not mean every tip is accurate and corroboration is necessary. A fictional staff member reports unusual late-night access, and security reviews access logs and legitimate maintenance work rather than naming a culprit on one coworker's suspicion.
A loss estimate should use confirmed quantities and replacement or accounting value under the appropriate method, for example units confirmed missing multiplied by supported unit value, without inflating it with unsupported assumptions. A fictional office loses five laptops, asset records show two were reassigned and one returned, and the remaining two require investigation, so the company avoids reporting all five as stolen.
Privacy matters in video and digital monitoring, so set a lawful purpose and proportionate access, because secret blanket surveillance can create its own legal and trust problems. Managers should preserve original records, dates and system logs, never alter transaction history to make a case look stronger, and follow local law and appropriate advice if criminal conduct is suspected.
A fictional ecommerce company finds customer data exported by an account, secures access and investigates whether a worker or an attacker used it, because an employee username alone does not prove the employee acted. Misconduct processes should give the person a fair chance to respond under applicable rules, with decision-makers separating investigator findings from disciplinary outcomes and documenting reasons.
Loss prevention is also operational, since better receiving, stock placement and POS training may reduce discrepancies that resemble theft, and a fictional hotel that sees linen losses finds some stock went to an outside laundry unlogged and updates its transfer records before pursuing a theft theory. Insurance claims may require notice and evidence and a policy does not pay automatically because an employee is suspected, so verify coverage and documentation; the label should follow evidence, and the goal is accurate loss prevention and a trustworthy workplace.
In practice
Real-world examples.
Example
A store checks supplier receipts and inter-branch transfers before treating missing stock as theft. It finds that part of the shortage was a delivery booked to the wrong branch. The remaining gap is then investigated through its normal fair process.
Example
A restaurant manager investigates a cash shortage by comparing till totals with point-of-sale (POS) records, refunds and safe drops. The review shows a keying error on one shift. No employee is accused, and the team gets extra till training instead.
Example
A software firm reviews an access log after a staff member raises a concern about late-night activity. The log shows a named user account, but the firm does not assume the account holder acted. It checks for shared passwords and maintenance work before any conclusion is drawn.
Formula
Calculation
No universal formula applies, but a confirmed loss estimate follows a simple structure: confirmed loss = units or transactions verified as missing x supported value per unit, with no speculative attribution.
Worked example: a fictional store counts 20 units of a power tool missing against its records, and each unit has a supported cost of $45. The manager first checks transfers, returns and receipts and finds that 12 units were booked to the wrong location. The unexplained units are 20 - 12 = 8, so the unexplained loss is 8 x $45 = $360, compared with the $900 (20 x $45) that a careless first estimate would have shown. Even the $360 is only an unexplained shortage until a fair investigation shows whether theft, damage or another record error caused it.Case study
Seen in the real world.
In this fictional case, Lark Retail finds a 20-unit stock discrepancy. Its manager reviews receipts, returns, transfers and camera access under policy. Twelve units were booked to the wrong location. The remaining eight are investigated through a fair process rather than immediately charged to an employee. Lark Retail then looks at why the booking errors happened.
It finds that receiving staff used two different location codes for the same shelf, so it standardises the codes and adds a weekly cycle count of its highest-value items. In this illustrative story, the changes cut unexplained differences in the following quarter without any change to staffing. The owner also adds a confidential reporting route and a written investigation procedure so that future concerns are handled the same way every time. Staff are told that records will be checked before anyone is questioned, which protects honest employees and keeps the focus on evidence.
Watch out
Common mistakes.
- Treating a till variance as proof of theft.
- Using broad occupational fraud data to accuse one person.
- Changing records or spreading allegations before an investigation.
Questions
People also ask.
Does missing stock prove an employee stole it?
No. First check operational and record causes.
What controls help?
Accurate records, approvals, access limits and counts.
How should a suspicion be handled?
Preserve evidence and use a fair local process.
From the founder's library

Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%