A Warning Sign Is Not Proof
Inventory shrinkage, unusual refunds, duplicate vendors, altered time records, missing cash, unexplained write-offs, or repeated control overrides can justify review. None proves that a particular employee stole. Errors, poor training, broken processes, vendor mistakes, cyber compromise, and collusion outside the suspected department can produce similar patterns.
A fair response begins by describing the anomaly without naming a culprit: which asset or transaction is missing, when the variance started, who had authorized access, which control should have operated, and what records could confirm an innocent explanation? This approach protects the business from tunnel vision and reduces the risk of accusing the wrong person.
Under Florida Statute 812.014, theft includes knowingly obtaining or using another's property with specified intent. Investigators collect facts relevant to those questions; they do not adjudicate guilt. Employment counsel should advise on suspension, search, discipline, termination, restitution, and law-enforcement referral. This guide is not legal advice.
Preserve Records Before Confrontation
A premature confrontation can cause ordinary system logs to roll over, witnesses to coordinate, or relevant documents to disappear. Authorized leaders should work with counsel, HR, IT, and loss prevention to identify likely data sources: point-of-sale logs, badge access, inventory movements, approval histories, expense records, schedules, email, camera footage, and device or account records the company is legally entitled to access.
Preservation is different from indiscriminate copying. Confirm system ownership, user notices, role permissions, retention settings, and any limits imposed by policy, contract, collective bargaining, or law. Keep original or native files when feasible, record the custodian and collection method, and analyze a working copy. Do not direct a private investigator to bypass passwords, access personal accounts, intercept communications, or enter a private space.
If an active loss or cybersecurity incident is underway, containment may be urgent. Preserve available logs before changing credentials when feasible and keep a decision record. The goal is to stop harm without destroying the history needed to understand it.
Test the Process, Not Just the Person
A useful employee fraud investigation traces the transaction end to end. Who could create a vendor, approve a purchase, receive goods, alter inventory, issue a refund, and reconcile the account? Were duties separated in policy but combined in practice? Did the anomaly occur only under one credential, terminal, location, or shift? Did another person share access?
Sampling comparison transactions can reveal whether the event is isolated or routine. Public business and property records may identify a potential relationship or conflict, but a name match is only a lead. Identity resolution should use multiple lawful identifiers and clearly state uncertainty. Surveillance is appropriate only when a defined, relevant activity can be observed lawfully; it is rarely a substitute for accounting records.
An investigator should report exculpatory facts with the same care as suspicious ones. If the variance results from a software setting or control failure, finding that cause may save more money than forcing the evidence toward an employee-theft theory.
Interview Fairly and Avoid Retaliation
Interview order and wording matter. Start with process witnesses and records custodians when appropriate, then move toward people whose accounts can be compared with known documents. Explain the interviewer's role accurately, ask open questions before presenting contradictory material, and document the source's actual words. Do not promise confidentiality, immunity, or continued employment unless an authorized person can make that commitment.
Counsel and HR should review whether the subject is entitled to representation or other procedural protections. They should also assess protected activity. Anti-retaliation rules depend on the type of complaint and governing law; the U.S. Department of Labor, for example, explains protections tied to wage-and-hour complaints and cooperation. A report about payroll or expenses may overlap with a legally protected workplace concern.
Interview notes, recordings, and consent require a case-specific protocol. A PI license does not erase Florida communication-privacy rules or company obligations.
Report Facts and Know When to Refer
The final report should separate firsthand observations, business records, source statements, public-record leads, and investigator analysis. Each significant item needs a date, source, collection method, and limitation. Quantifying a loss may require a forensic accountant; deciding discipline requires authorized management and HR; determining criminal liability belongs to prosecutors and courts.
Evidence handling supports reliability but does not guarantee admission. Florida Statute 90.901 addresses authentication, while other evidence and procedure rules may govern use. If the company refers the matter to authorities, maintain an inventory of what was transferred and preserve the originals as counsel directs.
Verify any investigator through the FDACS license search. Emerging Investigations can work from a counsel-approved question, budget, and reporting protocol. We will explain what can be lawfully tested, which specialist should handle adjacent work, and when the records do not support the initial allegation.
Related Services