What to Do If You Suspect an Employee Is Stealing

First, do nothing you cannot undo

The instinct is to confront the person and get it over with. That is almost always the wrong first move. A confrontation without evidence gives the individual notice to cover their tracks, hands them the opportunity to resign before any process starts, and if you are wrong, does lasting damage to someone who did nothing.

It also weakens your legal position. Dismissing on the basis of a confrontation rather than an investigation is one of the most common routes to a successful unfair dismissal claim.

Preserve what you already have

Before anything else, secure the evidence that exists now. CCTV is the urgent one, because most systems overwrite on a rolling cycle measured in days or weeks, and footage lost to overwriting cannot be recovered.

• →Export and store relevant CCTV footage immediately, before it overwrites
• →Preserve till, stock, delivery and transaction records for the period in question
• →Keep access logs, key fob records, rotas and timesheets
• →Do not reorganise, tidy or correct any records connected to the concern
• →Restrict knowledge of the concern to the smallest group who genuinely need to know
• →Note down what prompted the suspicion, with dates, while it is fresh

What actually counts as proof

A single anomaly is rarely enough. What makes a case is corroboration: two or more independent sources pointing at the same conclusion.

In practice this means connecting a documented loss to a specific person. Transaction and stock records establish when losses happen. Rota, access and shift records establish who was present each time. When those two overlap consistently around one individual, you have grounds worth acting on. Observation, where it is justified, can then confirm what the records suggest.

A gut feeling, a rumour, or the fact that someone is behaving oddly is not evidence, however strong the instinct turns out to be.

Gathering more evidence lawfully

Employers can investigate, but not by any means available. Monitoring staff engages data protection law, and covert monitoring in particular is treated as exceptional rather than routine.

• →Overt CCTV is generally acceptable for legitimate business purposes where staff know it exists and a policy explains its use
• →Covert monitoring is only justifiable in limited circumstances, where there are grounds to suspect criminal activity or equivalent malpractice and telling people would prejudice the investigation
• →Any covert monitoring should be targeted, time-limited, authorised at a senior level, and stopped once it has served its purpose
• →Searching personal property or communications carries additional risk and should not be attempted without advice
• →Keep a written record of what you decided to do and why, because proportionality is judged on your reasoning at the time

The standard a dismissal has to meet

UK employment law does not require you to prove theft to the criminal standard of beyond reasonable doubt. It requires something different and more achievable, but it is not optional.

The long-established test asks three things: did the employer genuinely believe the employee was guilty of the misconduct, were there reasonable grounds for that belief, and had the employer carried out as much investigation as was reasonable in the circumstances before forming it.

All three have to be satisfied. The third is where employers most often come unstuck, because a genuine and even correct belief will not save a dismissal if the investigation behind it was inadequate. This is precisely why doing the investigation properly protects you rather than delaying you.

When to bring in an investigator

Plenty of cases can be handled internally, particularly where the loss is small, the records are clear and nobody senior is involved. Outside help earns its place in specific circumstances.

Consider it when the losses are significant or long-running, when you suspect more than one person or collusion with a supplier, when the individual is senior enough that an internal process would be compromised, when you need observation that your own staff cannot carry out discreetly, or when you can see the matter ending in a tribunal or court and want the evidence gathered to that standard from the start.

There is also a fairness argument. An external investigation is visibly independent, which matters if the outcome is later challenged, and it means nobody in your team has to investigate a colleague.

Whether to involve the police

That is your decision, and you do not have to choose immediately. Many employers deal with the matter internally through a disciplinary process and pursue recovery through civil routes, particularly where the sums are modest and police capacity for this kind of case is limited.

It is usually easier to make that call once you hold documented evidence rather than a suspicion. Investigating properly first keeps both routes open. Reporting first and investigating afterwards often closes off your internal options while you wait.

How long it takes

Records analysis is normally quick, often a matter of days once you have gathered the material. Where observation is needed, it has to run long enough to be representative rather than a single snapshot, which typically means spreading it across a realistic pattern of shifts.

Resist the urge to rush it. An investigation that concludes in two days and does not stand up is worse than one that takes two weeks and does.