A missing stock item, unexplained till shortage or suspicious supplier payment can quickly become more than an operational annoyance. A workplace theft investigation must protect the business without making premature accusations, compromising evidence or treating staff unfairly. The first few decisions often determine whether the matter is resolved quietly, escalates into an employment dispute, or becomes a police matter.
For New Zealand employers, the objective is not simply to identify a suspect. It is to establish reliable facts, preserve procedural fairness and make a proportionate decision based on evidence. That requires calm, discipline and confidentiality – particularly where the employee involved has access to cash, stock, customer information or company assets.
When a workplace theft investigation is justified
Not every discrepancy is theft. Stock systems fail, invoices are coded incorrectly, equipment is moved between sites and cash handling mistakes occur. Beginning with an assumption of guilt can damage working relationships and expose an employer to avoidable risk.
An investigation is justified where there is a specific and credible concern that cannot be explained through normal operational checks. Examples include recurring shortages linked to particular shifts, altered records, unauthorised refunds, unexplained access to restricted areas, suspicious supplier arrangements, or company property appearing for sale privately.
The response should match the allegation. A low-value one-off discrepancy may require a manager to review records and tighten controls. Repeated losses, evidence of deception, financial exposure or concerns involving a person in a position of trust require a more formal and independent process. It depends on the facts, the potential loss and the level of risk to the organisation.
Secure the facts before speaking to staff
Employers under pressure sometimes call an employee into a meeting before checking the available evidence. This can alert a person to the concern, lead to records being altered or discarded, and make later interviews less reliable. It may also be unfair if the employer has not yet identified what has actually happened.
Start by preserving the relevant material. This may include CCTV footage, access-control logs, point-of-sale reports, stocktake records, emails, mobile messages held on company systems, vehicle GPS data, invoices, delivery dockets and financial transaction records. Record when each item was obtained, who handled it and where it is stored. A clear evidence trail is especially valuable if the issue later leads to disciplinary action, civil recovery or a complaint to Police.
CCTV should be reviewed promptly because many systems overwrite footage after a short retention period. The footage should be copied securely, with the original retained where possible. Avoid editing clips in a way that removes surrounding context. A short segment may look suspicious, while the full sequence offers an innocent explanation.
The same caution applies to digital information. Monitoring employee communications or devices can raise privacy and employment issues. Employers should check their policies, the purpose for which the information was collected, whether staff were advised of monitoring, and whether access is necessary and proportionate. An investigator can assist with lawful evidence collection, but cannot cure a process that began with unjustified access to personal information.
Keep the circle small
Confidentiality is operationally important and fair to everyone involved. Details should only be shared with people who have a genuine need to know, such as the relevant decision-maker, HR adviser, legal counsel or appointed investigator. Gossip can undermine the investigation, unfairly damage reputations and create further workplace tension.
A single case manager should maintain a dated file of actions, findings and decisions. This avoids the common problem of multiple managers conducting separate enquiries, forming different views and accidentally influencing witnesses.
Build a clear timeline, not a theory
The strongest investigations are evidence-led. Before interviewing anyone, establish a timeline that answers basic questions: what property, money or information is missing; when it was last accounted for; who had authorised access; what records were created; and what alternatives have been considered.
This process often reveals control failures as well as individual conduct. For example, a stock loss may involve one employee taking goods, but it may also show that keys were shared, inventory adjustments were not reviewed or returns could be processed without approval. Addressing only the suspected conduct leaves the business open to a repeat event.
Witness accounts should be obtained separately and documented as accurately as possible. Ask open questions first. “Talk me through the close-down procedure on Friday” is more reliable than “Did you see Sam remove money from the till?” Leading questions can shape a witness’s recollection and weaken the value of their evidence.
Do not promise a witness that their identity or statement will remain secret if it may need to be put to the employee as part of a fair process. Confidential handling is appropriate; absolute secrecy is not always possible.
Interviewing the employee fairly
Where concerns point towards an employee, the employer should give them a genuine opportunity to respond before reaching a decision. In a formal employment process, this generally means setting out the allegations with sufficient detail, providing the relevant material being relied upon, allowing reasonable time to consider it, and permitting representation or support where appropriate.
The interview should be planned, private and conducted by people who can remain objective. Present the facts rather than making accusations. Ask for an explanation of the discrepancy, the relevant actions and any evidence that may assist. The employee may identify a system error, another person with access, a legitimate reason for a transaction, or contextual information that changes the assessment.
A suspension may sometimes be necessary while enquiries continue, particularly where there is an immediate risk to people, evidence, customer data or assets. It should not be used as punishment or as a shortcut. Consider whether restricted access, altered duties or supervised work would manage the risk with less impact. If suspension is contemplated, obtain appropriate employment advice and follow the applicable employment agreement and policies.
Interview notes should distinguish between direct observations, documents, witness information and assumptions. If an employee makes an admission, record the precise words used and the circumstances in which it was made. Pressure, threats or improvised questioning can jeopardise both the integrity of the investigation and the employer’s response.
Decide what the evidence supports
An investigation report should be factual, balanced and sufficiently detailed for a decision-maker to understand the reasoning. It should identify the allegation, scope, evidence reviewed, accounts obtained, findings and any unresolved limitations. It should also record evidence that does not support the allegation. A credible report is not an argument for a predetermined outcome.
The next step may be an employment process, recovery action, an insurer notification, referral to Police, a control review, or no further action against an individual. These options are not mutually exclusive, but each needs to be considered carefully. Police involvement may be appropriate for serious or repeated offending, threats, fraud, burglary or clear evidence of criminal conduct. It does not remove the employer’s responsibility to act fairly in any employment process.
Employers should avoid announcing outcomes broadly across the workplace. Colleagues may need to know about changed procedures or responsibilities, but they rarely need personal details. Respectful communication protects privacy and helps maintain confidence among staff who were not involved.
Independent investigation for sensitive matters
Internal managers may understand the operation well, but their proximity can be a disadvantage where the allegation concerns a senior employee, a close working relationship, high-value losses or a dispute over what happened. An independent investigator can bring objectivity, structured evidence handling and experience in interviews, surveillance, intelligence gathering and reporting.
This is particularly useful for multi-site businesses, where information and witnesses are spread across regions, or where the organisation needs a prompt response outside normal working hours. The Neill Group (TNG) can undertake discreet, nationwide investigative assignments with clear reporting for commercial, government and legal clients.
The best outcome is not always a dramatic confrontation or a criminal charge. Often, it is a properly tested finding, a fair decision and stronger controls that prevent the same loss from occurring again. Acting early, preserving evidence and treating every person with procedural fairness gives an organisation the best chance of resolving a difficult matter with confidence.