How to prevent employee theft in UK businesses

To prevent theft, UK businesses should use clear permissions, separate approvals, regular reconciliation and fair investigation of unexplained losses. Long service and familiar faces don’t remove the need for checks.

The controls should protect staff as well as assets, without treating every mistake as dishonesty. Start by identifying where money, goods or information can leave the business without an independent record.

Key takeaways

• Give the three largest loss risks a named owner, a recorded baseline and a review date.
• Separate responsibility for requesting, approving, receiving and reconciling transactions wherever staffing allows.
• Review cash exceptions daily and count selected stock regularly, with some checks completed at unpredictable times.
• Explain rules for discounts, refunds, food, equipment and working-time records before staff receive access.
• Use video footage and access records for defined purposes, with clear privacy information and restricted viewing rights.
• Preserve evidence and follow a fair procedure before deciding whether suspected theft warrants disciplinary action or police involvement.

Distinguish employee theft from operational loss

A missing item establishes a discrepancy, but doesn’t show who caused it or whether a criminal offence occurred. Use the term “staff theft” only when evidence supports deliberate taking; a missing item on its own remains a discrepancy.

Keep separate records for suspected theft, confirmed process errors, wastage, receiving discrepancies and unresolved losses. Combining them can produce an apparently serious theft problem that actually requires better stock administration.

Recognise the different methods

Employee theft can involve cash, products, company equipment, confidential information or manipulation of business records. Contractors and agency workers may have similar opportunities where access controls are weak.

Sweethearting, also called pass-offs, happens when an employee deliberately fails to ring up every item for a friend or family member. Discount abuse can involve unauthorised reductions or misuse of staff purchase arrangements.

Return fraud includes processing a refund for something never purchased, then directing the credit to the employee’s account, a friend’s account or a gift card. Cash skimming involves taking money before the sale is properly recorded.

Internal collusion may also support organized retail crime, including the unauthorised release of stock or delivery information.

Use statistics without mislabelling the risk

Internal shrink is the employee-driven share of retail loss. The National Retail Federation’s 2018 survey attributed 33.2% of surveyed US retailers’ inventory shrink in 2017 to employee theft.

That historical US figure is not a current UK benchmark. It also doesn’t mean that one-third of employees steal.

The British Retail Consortium’s 2025 crime and shrink benchmark reported £2.2 billion in customer retail theft losses during 2023/24. That figure measures customer theft, not employee theft or operational loss.

Use business records to establish the local problem. National figures explain scale, but they cannot identify the cause of an individual shortage.

Map the largest opportunities before buying equipment

A useful risk review identifies where a person can remove an asset, change a record or approve their own activity. A list of cameras and locks is only part of that assessment.

Follow actual working practices during opening, deliveries, busy periods, shift changes and closing. Include offices, kitchens, workshops and loading areas rather than limiting the review to customer-facing spaces.

Trace each movement and approval

Record how cash, stock and equipment enter the business, move between people and leave the premises. Identify the document or system entry that should accompany each movement.

For finance teams, follow supplier creation, invoice approval, payment release and bank reconciliation. For hospitality, follow deliveries, kitchen issues, wastage, staff meals and complimentary items.

Ask short diagnostic questions. Can one person approve their own refund? Can goods leave through a delivery door without a collection record? Can someone change bank details and release the resulting payment?

Record existing controls that are routinely bypassed. An approval field has little value when colleagues share the manager’s password.

Assign three priorities, not an unlimited action list

Select the three largest exposures by potential loss, frequency and ease of exploitation. Give each an owner, a baseline and a review date.

The baseline might be unexplained cash shortages, refund value, missing units in a high-risk category or overdue equipment returns. Keep the measurement consistent.

Assign responsibility to a role with authority to change the process. A stock supervisor cannot resolve unrestricted finance permissions without support from the finance manager.

Review the initial actions after 30 days. Where records remain incomplete, improve the recording process before claiming that losses have fallen.

Tighten cash handling and point-of-sale controls

Cash controls should establish who handled money, what transactions occurred and whether the physical balance matches the record. Shared tills and shared logins weaken all three.

Apply the same discipline to bars, cafés, reception desks, service counters and cash-based office collections.

Reconcile tills at each handover

Give each operator an individual point-of-sale login. Where practical, assign a separate drawer or record the cash balance whenever responsibility changes.

The supervisor should reconcile opening float, recorded cash sales, refunds, cash drops and closing cash. Investigate differences promptly, whilst records and recollections remain available.

A POS system can show expected cash balances, no-sale drawer openings, cancelled transactions and unusual activity. These reports help narrow the relevant period and access group, but they don’t identify a thief by themselves.

Keep cash drops secure and record their collection. Where two-person counting is practical, both people should witness the count rather than sign a figure supplied by someone else.

Review refunds, voids and discounts

Require a reason code and an approval appropriate to the transaction’s value and risk. An employee should not approve a refund connected with their own purchase.

Review exception reports daily in busy cash businesses. Compare activity against transaction volume, shift duties and legitimate customer-service responsibilities.

Refunds should normally return to the original payment method where the payment system and circumstances allow. Record approved exceptions, including the reason and approving manager.

Retain links between the original sale, returned item and refund. A gift-card refund without a supporting purchase deserves review, not an immediate accusation.

Check staff purchases separately. A colleague or supervisor should process them under the same documented rules used throughout the business.

Count stock often enough to investigate losses

A six-monthly stock take leaves too much time between a loss and its discovery. By then, delivery records may be harder to retrieve and relevant footage may have been deleted.

Use regular cycle counts, meaning small counts of selected stock, alongside broader inventory reviews. Include some counts at unpredictable times.

Match counting frequency to exposure

For small, valuable or repeatedly missing items, a daily spot count may be proportionate. Count other high-risk categories weekly and review lower-risk categories on a rolling monthly programme.

These are starting frequencies, not statutory requirements. Increase checking where discrepancies recur, and reduce unnecessary work where reliable records show low exposure.

Inventory control software can support more frequent storewide checks and identify differences earlier. It still depends on accurate receiving, transfers, sales and wastage entries.

Where possible, use blind counts that don’t show the expected quantity. A second person should recount material discrepancies before records are adjusted.

Make receiving and stockrooms easy to inspect

Check deliveries against the purchase order and delivery note before accepting quantities into stock. Record shortages, damaged packaging and substitutions immediately.

Keep the stock room orderly, with clear aisles and defined locations for returns, wastage, staff purchases and goods awaiting dispatch. Poor visibility and limited supervision create opportunities to conceal removal.

Require records for transfers between branches, departments or vehicles. The receiving location should acknowledge what arrived.

Review stock adjustments independently. Someone able to remove goods and write off the shortage has an opportunity that an annual count will not adequately control.

Retailers should also separate internal controls from practical shoplifting prevention measures. Both address loss, but they require different evidence and responses.

Review layout, camera coverage and response

Camera coverage should follow risk, movement and a defined purpose. A visible camera offers limited protection if nobody can retrieve useful footage.

Pinkerton’s loss-prevention advice recommends checking the building’s interior and exterior for blind spots, then adjusting coverage across the front and back of house.

Keep exits clear and relevant routes visible

Check stockroom doors, loading bays, tills, fire exits and points where public and private areas meet. Include car parks or collection areas where goods change hands.

Keep exit points unobstructed, clearly visible and well lit. Avoid displays, stacked cartons or parked equipment that could create concealed routes.

Security measures must not obstruct emergency escape. Any controlled door needs an arrangement that meets the premises’ fire-safety requirements.

Test recorded images during actual trading and closing conditions. Reflections, darkness, shelving changes and open doors can obstruct views that looked adequate during installation.

Assign responsibility beyond the recording

Decide who receives an alert, who assesses it and who responds. Include evening and weekend cover rather than relying on one administrator.

The distinction between CCTV monitoring and surveillance matters when a business expects intervention rather than later review. Recorded footage and an attended alert service perform different functions.

A controlled demonstration of footage retrieval, or a supervised view of the surveillance room, can reinforce deterrence. Explain the process without exposing passwords, security weaknesses or unrelated recordings.

The ICO’s small-business employee monitoring guidance makes clear that monitoring must respect staff rights. More coverage isn’t automatically a better arrangement.

Control staff movement without creating unsafe restrictions

Access controls should record authorised movement without delaying work unnecessarily or compromising evacuation. Apply them consistently to permanent staff, temporary workers and contractors.

A trusted employee should not hold unrestricted access simply because permissions have never been reviewed.

Establish a clear employee control point

An employee control point directs routine staff entry and departure through one designated entrance and exit, with an individual record of time on site.

Use individual credentials rather than a shared door code where the risk justifies them. Restrict stockrooms, cash offices, server rooms and equipment stores according to role.

Record visitors and deliveries separately. Staff should not admit friends or contractors through private entrances without following the visitor process.

Attendance logs can support an investigation, but presence on site does not prove access to a particular asset. Keep attendance, door-access and payroll records distinguishable.

Remove access promptly when roles change or employment ends. Record who completes that task and who checks completion.

Make search arrangements clear and proportionate

Bag searches require a clear policy, a legitimate purpose and a lawful process. Explain any contractual arrangements, selection method and privacy safeguards before implementation.

Do not force a search or use physical restraint. Seek consent, conduct any agreed search respectfully and record what occurred.

Random checks should use a genuinely neutral method, not a supervisor’s assumptions about particular groups. Searches should not become public confrontations at the staff door.

Refusal does not prove theft. Record the circumstances and obtain HR advice before deciding whether there is a separate policy issue.

Security officers need written intervention rules covering escalation, safety and police contact. Their presence does not remove these limits.

Separate purchasing, payment and expense approvals

Office theft may leave no missing shelf stock. It can appear as a false supplier, duplicate invoice, altered bank details, inflated expenses or payment to someone no longer employed.

Finance controls should prevent one person from creating a transaction, approving it and concealing the result.

Control supplier and bank-detail changes

Separate supplier creation, invoice approval and payment release wherever staffing permits. Restrict changes to supplier records and retain an audit trail.

Confirm bank-detail changes through an established contact route already held by the business. Do not rely on the telephone number supplied in the change request.

Match purchase orders, receipt records and invoices before payment. Record exceptions rather than allowing urgent requests to bypass the process without explanation.

In a small business, the owner can compensate for limited staffing by reviewing supplier changes and bank transactions independently. Access the records directly rather than relying entirely on a prepared summary.

Investigate duplicate invoice numbers, repeated round-sum invoices and purchases split beneath approval limits.

Review expenses and payroll against source records

Require a business purpose, appropriate evidence and an independent approver for expenses. Directors and senior managers should follow an equivalent process.

Check duplicate receipts, repeated mileage routes, personal purchases and claims submitted through more than one channel. A missing receipt requires explanation, but does not establish fraud.

HR should reconcile starters, leavers and contract changes against payroll. A separate reviewer should examine changes to pay rates, overtime and employee bank details.

Keep approved timesheets and payroll adjustments traceable. Where a manager can create overtime and approve it, add an independent sample review.

Record disputed items without altering the original evidence. Correcting an error should leave a visible history of the change.

Protect company equipment and digital access

Physical assets and digital permissions need an owner throughout their working life. Issuing a laptop or access account without a return or closure process creates an avoidable gap.

Apply the same approach to tools, phones, fuel cards, vehicles, software administrator accounts and shared storage.

Record issue, movement and return

Maintain an asset register with an identifier, assigned holder, location, issue date and return status. Record transfers between employees rather than treating the first signature as permanent accountability.

Store portable, valuable equipment in controlled cabinets or cages. Restrict keys and record access where the potential loss warrants it.

Check overdue loans and missing equipment promptly. For construction and maintenance operations, protecting site equipment and materials also requires control of vehicle movements and collection authorisations.

Include remote workers and off-site equipment in the return process. Agree how equipment will be collected before the employee’s final working day.

Limit permissions and retain useful audit records

Use named accounts, multi-factor authentication and permissions appropriate to each role. Avoid shared administrator credentials that prevent reliable attribution.

Restrict who can export customer records, change financial data or disable security logging. Review privileged access after role changes and at a defined interval.

Preserve audit logs for important actions, including account creation, permission changes, bulk downloads and deletion. Assign someone to review significant alerts.

The ICO’s guidance on monitoring workers applies when these records involve staff personal data. Security logging still requires a lawful purpose and proportionate handling.

Remove leaver access at the agreed time, revoke active sessions and recover credentials. Keeping an account available for convenience can leave continuing access to business information.

Train staff on boundaries and consistent treatment

Employee training should define the permitted action, required approval and reporting route. A general instruction to “be honest” leaves avoidable uncertainty around everyday practices.

Managers also need training. Rules lose authority when supervisors approve informal exceptions but discipline staff for similar conduct.

Explain the grey areas before they occur

State the rules for staff food, damaged goods, complimentary drinks, discounts, loyalty points, samples, scrap materials and personal use of equipment.

Explain who may authorise each exception and where it must be recorded. Unauthorised use can be misconduct, but a criminal allegation requires more than an unclear rule.

Address working-time records carefully. Deliberately claiming hours not worked is different from clocking in early because a manager requested preparation work.

Poor productivity, an innocent recording mistake and dishonest timesheet manipulation require different responses. Avoid labelling all three as theft.

Refresh training when processes change and during seasonal recruitment. Record attendance and test understanding through short, work-related questions.

Apply checks without stereotyping workers

Use identity and role-relevant reference checks consistently. Criminal-record checks must match the role, applicable disclosure rules and UK nation; enhanced DBS checks are not available for every position.

Seasonal employees and part-time recruitment can introduce rushed induction, unfamiliar supervisors and temporary access arrangements. Those process weaknesses need attention.

Temporary status alone does not establish a greater likelihood of stealing. Unsupported assumptions can divert attention from established employees with broader access.

Financial pressure, resentment, opportunity and rationalisation may feature in misconduct, but none reliably identifies an offender. Managers should assess conduct and records rather than attempt to diagnose a person’s character.

Fair pay administration and consistent treatment support a healthy employee relationship and a workable reporting culture. They don’t replace independent controls.

Give staff a safe route to report concerns

A reporting arrangement should work when the concern involves the immediate manager. Provide a second named contact, such as a director, HR lead or designated senior manager.

Tell workers what information helps: dates, locations, transactions, items and what they directly observed. Discourage informal investigations, confrontation and circulation of allegations.

Provide confidentiality without impossible promises

Offer a confidential reporting route and, where practical, an anonymous option. Explain who receives reports and how follow-up questions will be handled.

A locked suggestion box is inadequate if nobody is assigned to open it. The same applies to an email address with no monitoring responsibility.

Limit access to reports and explain that confidentiality may have legal or procedural limits. Do not promise anonymity that cannot be maintained.

Acknowledge concerns where contact details are available. Share only the outcome information appropriate to the reporter’s role.

Protect reporting while testing the allegation

GOV.UK’s whistleblowing guidance for employers explains the protections attached to qualifying disclosures. A theft report is not automatically protected; the legal conditions include a reasonable belief that the disclosure is in the public interest.

Regardless of that legal classification, prohibit retaliation against people raising genuine concerns. Distinguish an unproven report from a deliberately false allegation.

Assess the evidence independently. An anonymous accusation may justify discreet record checks, but it should not determine a disciplinary outcome by itself.

Record the reason for opening, closing or escalating the concern.

Keep monitoring lawful and proportionate

Preventing dishonest taking does not remove data-protection obligations. CCTV, access logs, transaction records and digital monitoring can all contain personal data.

The ICO’s data protection and worker monitoring guidance requires lawful and fair processing. A security purpose alone is not a complete legal assessment.

Document the purpose and limit intrusion

Identify the lawful basis, the problem being addressed and whether a less intrusive measure would work. Where relying on legitimate interests, document the balancing assessment.

Complete the required data protection impact assessment for workplace video or audio monitoring. Involve appropriate staff representatives and explain the nature, purpose and extent of recording.

Target relevant risk areas rather than continuously observing individuals. Do not install cameras in toilets or changing rooms, and avoid unnecessary monitoring of rest areas.

Keep audio recording disabled unless separately justified. Biometrics and facial recognition introduce additional considerations and should not be added simply because a system offers them.

Covert monitoring is exceptional. It requires a tightly defined justification, authorisation, scope and duration, rather than a general wish to catch wrongdoing.

Control retention, viewing and disclosure

Set a justified retention period based on purpose. There is no universal rule that every business must retain recordings for 30 days.

Restrict viewing and exporting to authorised roles. Keep a record of relevant disclosures, including evidence supplied to police.

Where an external monitoring provider processes recordings on the business’s behalf, put the required data-processing terms in place. Assign responsibility for access requests, deletion and incident preservation.

Information about suspected criminal conduct can require additional safeguards. Avoid informal suspect lists or sharing footage through personal messaging accounts.

Preserve the relevant evidence without retaining unrelated recordings indefinitely. An incident does not justify abandoning the retention policy.

Treat warning signs as reasons to examine records

Repeated shortages, unusual refunds, unexplained stock adjustments or transactions outside normal duties can justify closer review. Each can also have an innocent explanation.

Compare like with like. A supervisor handling difficult returns will normally process more refunds than a colleague assigned to replenishment.

Frequent visits from friends or relatives may deserve attention where they coincide with unrecorded goods, unauthorised discounts or access to private areas. Visitors alone are not evidence of theft.

Record the observable event rather than a conclusion about motive. “Three refunds without original receipts” is useful; “seems dishonest” is not.

Check system faults, training gaps, shared credentials, receiving errors and approved exceptions before attributing a discrepancy to an individual. Confirm whether timestamps across footage, tills and door systems agree.

Avoid treating financial difficulties, lifestyle changes, nationality or employment status as evidence. Managers should not seek private financial information simply because stock has gone missing.

Acas places a fair investigation at the centre of its workplace investigation guidance. Preserve the distinction between establishing facts and deciding disciplinary action.

Where continued access creates a material risk, consider temporary permission changes or reassignment. These should be proportionate protective steps, not an announcement of guilt.

Suspension should not be automatic. Follow Acas guidance on deciding whether to suspend, consider alternatives and keep any suspension under review. It should normally be on full pay and benefits.

Investigate suspected theft through a fair process

An investigation into suspected stealing needs a defined scope, protected evidence and an investigator able to examine competing explanations. Speed matters where evidence may disappear, but a rushed conclusion can undermine the outcome.

Use the following sequence, adapting it to the circumstances and business size.

1. Secure relevant evidence promptly. Preserve original transaction records, stock documents, access logs and footage before routine deletion. Record who collected each item, when it was obtained and where it is stored.
2. Appoint an impartial investigator. Define the allegation, relevant period, evidence sources and expected reporting route. Where possible, use different people for investigation, disciplinary decision and appeal.
3. Establish the facts without assuming intent. Reconcile records, identify everyone with relevant access and examine evidence supporting or contradicting the allegation. Separate direct observations from hearsay.
4. Give the employee a fair opportunity to respond. Explain the concern, ask clear questions and record answers accurately. Consider relevant witnesses, reasonable adjustments and explanations requiring further enquiries.
5. Decide whether disciplinary proceedings are justified. If proceeding, provide the allegation and evidence, explain possible consequences and arrange a fair hearing. Respect the applicable right to accompaniment and allow an appeal.
6. Record the outcome and remaining control failures. Explain the evidence relied upon, the reasoning and any action. Correct weaknesses even where the allegation is not upheld.

Acas provides further detail on carrying out an investigation. Criminal proceedings and employment decisions have different purposes and standards; obtain legal advice where police enquiries affect the internal process.

A policy should warn that theft may lead to dismissal and police referral. Theft can amount to gross misconduct, but Acas confirms that a fair disciplinary procedure remains necessary.

Do not automatically deduct alleged losses from wages. Any recovery needs a lawful basis and separate consideration.

These Acas procedures concern Great Britain. Northern Ireland employers should use the Labour Relations Agency framework and relevant local employment law.

Budget for prevention and reduce repeat opportunities

Effective controls require staff time as well as equipment. A system that generates reports nobody reviews creates an additional task without a dependable control.

Price the work around identified weaknesses. Include installation, licences, maintenance, training, monitoring, record review and management follow-up.

Allocate time before adding technology

For a small premises, the following is a starting allocation for additional weekly oversight, not a replacement for routine daily controls.

Two hours each week equals 104 staff hours across 52 weeks. Multiply that by the business’s actual fully loaded hourly cost, then add equipment and service expenditure.

Increase the allocation where stock volumes, transaction levels or recurring discrepancies require it. Large counts and daily cash reconciliation sit outside this example.

Where physical supervision is the gap, commercial security guarding can support controlled movement and incident reporting. It cannot replace independent financial approvals.

Review the failure behind each incident

During the first month, establish baselines, close urgent permission gaps and introduce targeted reviews. Avoid changing every process simultaneously if that prevents meaningful assessment.

After an incident, identify how the asset moved and why the records failed to reveal it earlier. Assign one person to implement each corrective action.

Track loss value, unresolved discrepancies, overdue actions and completion of required checks. Keep the valuation method consistent and avoid counting the same recovered loss twice.

Review trends monthly and reassess after layout changes, new payment systems, staffing changes or major incidents. A reduction in reported incidents may reflect weaker reporting rather than reduced theft.

Frequently asked questions

What are five practical methods of retail loss prevention?

Use individual till and access credentials, independent approvals, regular stock counts, targeted CCTV and a clear reporting process.

These controls cover different opportunities. Their value depends on whether exceptions are reviewed and acted upon.

How often should random stock takes happen?

Use daily spot checks for particularly exposed items, weekly checks for other high-risk lines and rolling monthly counts elsewhere as starting points.

Include unpredictable timing without abandoning regular coverage. Recount significant differences promptly and investigate the underlying transactions before adjusting stock records.

What should happen when someone is seen stealing?

Prioritise safety, alert the appointed manager or security officer and preserve direct observations and relevant records. Staff should not chase, threaten or physically confront someone outside their authorised procedure.

Clear evidence may justify urgent protective action, but disciplinary decisions still require a fair process. Police referral and internal action should be considered separately.

Can a small business prevent employee theft without expensive systems?

A small business can reduce opportunities through individual logins, controlled keys, owner review of payments, targeted counts and documented approvals.

Where staffing prevents full separation of duties, add an independent review of the highest-risk transactions. Shared access and unexplained exceptions require attention before more equipment is purchased.

Does trusting staff reduce the need for checks?

Trust supports working relationships, but it cannot establish whether a transaction was authorised or an item was returned.

Apply proportionate controls consistently, including to senior managers and long-serving employees. Reliable records protect honest staff when a discrepancy would otherwise leave responsibility uncertain.

Make each control accountable

Employee theft prevention depends on clear permissions, independent records and timely review. Familiar faces and visible equipment cannot perform those checks.

Start with the largest exposure and assign an owner. Record what the control should reveal, who reviews it and what happens when an exception appears.

Treat allegations fairly and correct the process behind each loss. Accountable controls should remain effective after the investigation closes.