Employee Theft Investigation^©
A Practical Guide by J. Patrick Murphy

Regardless of your business sector size of your company, employee theft has happened and will occur in the future.  Theft can be in the form of proprietary information, data, company supplies (not a pen), cash, stock manipulation, and the list is endless.  However there are some common covenants that should be in place.  Policy and procedure is important to running a small business or multimillion dollar corporation.  They are the rules of the road.  There cannot be a more important set of guidelines than how employee theft is handled within the company.  Call or email us regarding investigation.  Our initial consultation is without charge.   Below are resources you may find helpful.

Have a question about an employee theft or embezzlement issue? Email us.  We'll reply in total confidence by email or by phone.

Here are some suggestions regarding employee theft awareness, investigations and prevention.  All policies should be reviewed by a Human Resource professional and a Labor Attorney before implementation.  Click here for more employee theft information or here for information regarding embezzlement. 

Policy and Procedure Development

• HAVE a written  policy regarding disciplinary action if an employee is found to be stealing.

• Clearly define stealing.  Sure, we know it when we see it but sometimes people see it as "borrowing".  An example statement in such a policy would define theft as "The unauthorized removal of company assets both tangible and intangible".  Notice it does not use the word theft.  Theft requires intent.  For termination purposes their intent is not an issue.  For prosecution, it will be the crux of the allegations.

• Communicate that policy beyond new hire orientation.  Posters, newsletters, and blogs can help reinforce a gentle message.

• Ensure that all levels of the company are tied to the policy including Senior Management.

• Keep in mind that precedents are set with any termination.  Ensure there is consistency in the enforcement of policy.

• Management must set the tone and lead by example regarding policy.  If a manager borrows a laptop so his child could do a PowerPoint presentation in class then why can't any employee do that?

• If there is not a formal department that conducts internal investigations formulate a plan (in writing) as to what initiates an investigation and who handles it.

• Have a written policy regarding searches of vehicles, personal articles like backpacks, briefcases, and backpacks.

• Have a written policy regarding refusal to allow a search.

Searching Employees

Warning!  The ability to search someone (anyone) is a vital right for any business but doing so should be considered very sensitive.  Put yourself in the position of the person being searched to understand the feelings of the process.  There are many scenarios to justify the need for search but this discussion will focus on employees and the implementation and management of the procedure. 

Bag checks are common place and should be accepted by employees if properly positioned and concerns addressed. If a company adopts a policy to require employees to submit to searches the policy and procedure should be well vetted with Human Resources, Legal, and Management.  There are five provisions that should be considered when formulating policy:

1. Define "search".

2. Searches should be limited to anything outside the body.  This would include purses, backpacks, brief cases, computer bags, sacks, etc. NEVER touch someone in the process.  Don't frisk or have them disrobe. (yes it happens).

3. The policy is in place for all levels of employees including (especially) Management.

4. The consistency of the policy.  Under what circumstances will a search be conducted?

5. Who has the authority to search?

Policies are only as good as the people implementing them.  Don't assume that a written policy created is a written policy understood.  Consistency in application is the key.  If, for instance, there is a security person at the door and all employees are to stop and open anything they are carrying them, even the company President or owner should do so.  There needs to be a clear definition of how a search can be conducted.  Is that defined as allowing someone to dig through a handbag or does it mean merely a visual inspection is allowed?  This is very important.  Is a metal detector appropriate?  If so how are activations handled?

Even with the best written policy, occasionally someone will refuse.  These refusals do not necessarily mean they are in the act of theft but they can be volatile situations nonetheless that can escalate needlessly if handled improperly.  What disciplinary action is available for an employee refusing to comply with company policy?

Unless there is a very compelling reason to not allow the employee to leave if they refuse, then allow them to leave.  First, however, a possible solution is to call a supervisor to remind the employee of the policy.  When the supervisor arrives a discussion between the employee and the supervisor should be taken in an area that is as private as possible which could simply be off to one side.  If the employee still refuses to follow company policy after a calm but firm discussion with a supervisor, then allow the employee to leave.  The individuals attempting to perform the search should document the incident, retrieve video if available, and turn the matter over to those who make the disciplinary action.  If other witnesses are available, obtain their statements as well.

More points to consider are:  What if something is actually discovered while doing the search?  Is the discovery of narcotics, such as marijuana, or a firearm covered in the scope of the search?  How are those to be handled?  What if the search reveals something that is suspected to be of value to the company?  What are the steps to be taken?

Controls

• Audit your own policies and procedures.  These should be unannounced and conducted regularly.

• Watch carefully anything that involves cash or other negotiable items.  There should be a number of checks and balances in place to detect problems.  Bank deposits are especially vulnerable.

  • How are deposits monitored?  Is there a notification from the bank if a deposit is short or missing?

  • Is that notification going to someone other than the person who deposited the money?

  • Is there notification or deposit review to ensure deposits are made daily?

  • Is there a requirement that deposits be made during daylight hours only?  This helps prevent employees from faking a robbery and stealing the money.
     

• Is trash disposal controlled?  Dumpsters are great places to hide property only to come back later and take it.  How do they know which trash bag it's in?  They tie the knot differently.

• If a company asset is missing, such as a laptop, is there a record of the serial number and description of the device available.

Investigation

 Warning!  Whether a professional investigative department is involved, a private investigator, or simply Management or a Supervisor, investigating an employee for any cause is very serious business.  Investigators who have experience in internal matters should be the first choice to conduct the investigation.  There are companies that specialize in the investigation of white collar crime that are available.  Police Departments are generally not equipped to properly investigate most internal thefts because they don't have the time to learn the inner workings of a company.  They are certainly a resource to be used however and will always be the conduit to prosecution.

1. Conduct an immediate and thorough investigation if you learn of a theft.   Document all investigative efforts.

2. Investigations are "sexy" to others.  Remind everyone interviewed, even a suspect,  that the matter is confidential.  Create a confidentiality agreement for signature if possible.  TIP:  Employees often claim defamation after investigations.  Confidentiality agreements keep everyone on notice about the sensitive nature.  There's no real way to keep people from discussing the investigation but as long as the investigators and management maintain their confidentiality, the risk of a successful civil action is low.  Termination should be a possible action if confidentiality is broken.
   
                     I am aware of a sexual harassment investigation where an entire department was interviewed based on
                  highly detailed anonymous complaints.  Each person was privately interviewed and was asked questions
                  about observations or experiences with the department supervisor.  The supervisor  was eventually fired
                  although he made no admissions.  He then brought a successful defamation suit against the company.  His
                  allegation was that people who knew nothing about the alleged activity now knew that he was being
                  accused of sexual harassment and that his termination confirmed the allegations.  Award:  $17 million.
    

3. Evidence is important.  Company documents, witness statements, video or physical evidence must be preserved.

4. Polygraph.  Thoroughly understand the laws regarding the use of polygraph and drug tests.  The use of the polygraph is governed by the Employee Polygraph Protection Act and is still a viable tool when investigating a loss.  If there is cause to use a polygraph, my recommendation is to ask the police to do that.  The employee may refuse which is their right to do so.  The results of the polygraph or the refusal to submit to a polygraph are not grounds to terminate an employee.  The totality of the investigation must be the basis for termination, not just solely on the results of the polygraph or a refusal to take the polygraph.
   
                           My experience with polygraphs in conjunction investigations is considerable however the results
                     are mixed at best.  I have never had an employee refuse to submit to one however I would estimate
                     that only 95% ever showed up.  No one who was alleged to have committed a theft or who was alleged
                     to have staged a robbery was ever found to be truthful.  If a police department conducted the polygraph
                     first, they could not reveal the results.  However when I was told that they could not clear the employee as
                     a suspect, they, in effect, gave me the results.  We then conducted our own polygraph and, of course, got
                     same results.  Termination was based on a full investigation.  The polygraph was not the defining moment
                     but rather was a buttress to conclusions.  Failure to protect company assets was common verbiage for the
                     reason for termination.

Interview

Interview and interrogation is an acquired skill that is a mix of recognizing body language, knowing that no one admits to wrongdoing initially, being patient and knowing how and when to ask questions.  There are two prominent companies that offer instruction and training on conducting these types of interviews. WIcklander & Zulawski (www.wz.com) and Reid (www.reid.com).   If the interviewer is not trained at the very least there should be procedures established for ground rules to guide non-investigative personnel.  Conducting "cold" interviews whereby a series of people are interviewed in hopes of gaining an admission, is not for the untrained.  Said another way, the investigation should provide enough evidence and information to point to the actual culprit(s).  There is comfort in knowing what you know. 

Here are a few guidelines that should be considered.  It should be said too that, regardless of skill level, extreme care is demanded of all investigatory interviews.

1. Interviews can be conducted with or without a witness present.  Female employees should always have a female witness present.  A witness should sit out of the peripheral vision of the person being interviewed.  The witness should not be an active part of the interview but should take notes.  If the employee diverts their attention to the witness to talk to them, simply redirect them calmly back to the interviewer.

2. Be prepared.  Create an outline of how you wish to present your facts.  Have your documentation and evidence prepared as well.

3. Props.  Examples of props:  Thick file folders with labels such as "Theft Investigation of John Doe" or video tapes with similar labels.  A prop is intended to give the interviewee the impression of overwhelming evidence against them.  My recommendation:  Don't use them.  If your investigation does not have merit on its own then perhaps the decision to talk to the employee should be reconsidered.  Leave the props to theater.

4. Document the start and stop time of the interview and document any offering of a break for use of a restroom or drink even if it is refused.  Document the time of those offerings and acceptance/refusal.

5. Provide the employee a document stating that they acknowledge that they can stop the interview at any time and are free to leave at any time.  Have them sign that document for your file.

6. Don't position yourself between the employee and the door.

7. The hardest part of an interview can be simply getting started.  What do I say?  If needed, write out a script and keep it handy as if you were giving a speech.

8. Be very mindful of the duration of the interview.  If an admission has not been made within an hour then it is unlikely that any further discussion will bring one.  It is important to understand that this does not mean there is a standard to length of interviews nor does it suggest that haste is important.  Simply keep in mind that the employee should never be given the impression that they will sit there until they confess or that they do not have the option to end the interview.  However, my experience of well over 1000 such interviews tells me that an hour is on the outer edge of reasonable time when interviewing someone and no admissions have been obtained.

9. There are pros and cons to taking notes.  Interviewees tend to be distracted when they notice someone writing something down.  During the interview try not to take too many notes.  You'll come back to the admissions later.

10. Audio or video recording an interview is dangerous territory.  If done, it should be with the full acknowledgement and authorization of the interviewee.  I have tape recorded one interview in my career and it was a witness, not the suspect.

11. Be mindful of the lateness of the interview.  Do not be the only people in the entire building at 11:00 PM.

12. Be mindful that if the employee says they have an appointment and can't stay you may have to reschedule.

13. NEVER offer to negotiate their termination or prosecution.  Don't offer to not prosecute if they just "tell the truth" or if they just made payments for the loss "everything would be alright".  Don't make statements implying that the investigation will make the morning news (even if it might) if they don't admit to the allegations.  Don't threaten to fire them if they refuse to take a polygraph.

14. Don't allow the interviewee to steer the interview by demanding to take a polygraph.  They can do that on their own if they wish but it is not their decision as it relates to company business.

15. Show me the video!!  There is no obligation to show the interviewee any video evidence.  Note:  If you say you have it, make sure you do. 

16. Employees have a very difficult time using the words "steal, theft, intentional, lied".  Instead they use software descriptions such as "took, borrowed, mistake, mislead".  Efforts should be made to clarify that they knew what they were doing was theft.  While they were going to pay the money back later, they were not authorized to take the money and it did not belong to them.  It is theft.

17. Expand the interview to understand where they learned how or got the idea to do this.  Many times employees are influenced when they see others do the same thing.  This is especially true when they see a member of management steal.

18. Obtain a written statement from the employee about the thefts they committed.  Ask that they include implications of any other persons involved in theft.   Have them be very specific about those allegations.  Have them state dates, times, circumstances, and the property involved.

19. The conclusion of the interview should result in a voluntary written statement.  It should be written in the person's own handwriting and signed by the witness as well.  Document the times of the beginning and ending of the writing of the statement.  Obtaining a written statement is important but dictating it is leaving the door open to question as to the validity of the content.  If upon completion of the statement, it is found that they left out important facts or information, they can be asked to write about that.  Accept the manner in which the statement is written, bad handwriting, poor grammar, spelling and all.

20. Finally, they do not need to be read their Miranda rights unless they are being interviewed by law enforcement.

Termination

Terminations for theft should not be handled in a manner different from any other termination for cause.  Termination is based on established policy and procedure.  Sometimes, however, theft is judged on a sliding scale of value.  Example:  A jar was set up on a desk to collect money for a charity.  An employee, needing lunch money, stole (was going to pay back the next day) $2.00.  The money was not the property of the company but the employee was terminated anyway.  Theft of anything causes loss of confidence and not terminating may create a dangerous precedent.

1. Consult with your Legal Department or Counsel regarding your investigation.  Ultimately they will have to defend the actions of the company if it comes to that.  Nothing can prevent someone from filing a civil suit.  What is more important is that the actions are defendable in court and that the plaintiff does not prevail.

2. Consider terminating the employee for "Violation of Company Policy" versus theft.  It is easier to defend as no intent is required or suggested.

3. Industries that hire young people are well aware of the parents' interest in the termination of their child.  If the child is an adult (based on your State's definition of adult) then the parents do not have a right to know anything about the employer's actions.  A minor child's parents have no "rights" that compels a company to discuss their child's employment or any actions taken.  However, discretion is sometimes the better path taken and the case is discussed.  What the parent knows is usually vastly different than the truth.  Check with your attorney before releasing any information.
   
                      Dealing with parents, guardians, spouses and other concerned friends is sometimes difficult.  The hard fast
                  fast rule is that a company should not discuss internal information with anyone.  Minor children hate the
                  prospect of telling their parents they were fired for stealing and thus the information is withheld or
                  watered  down.  There are times when I have actually read the employee's statement to the parents over
                  the phone and, in most cases, they are stunned and that is the end of the conversation.  There are other
                  times when parents are hostile and demand copies of the file, statements, and video and threaten to sue.  I
                  have no obligation to speak with them or reveal the contents of the investigation and usually simply
                  responded by advising them to talk to their child again because they are not giving them all of the
                   information.  I have never had any civil action taken due to my lack of communication with a parent.
    

4. Suspension.  Suspension prior to termination is highly recommended.  This serves as a sort of cooling off period to gather all of the pieces of the investigation together for review.  While it may be a foregone conclusion that termination will occur, it is still a good practice.

Prosecution

As a percentage, few employees are actually prosecuted for theft.  There are many reasons why but frankly, there may just not be enough evidence that would make a prosecutor want to take the case to trial.  Prosecution rarely results in full restitution to the company and if restitution is required, it is paid back over the lifetime of their probation.  A great deal of payroll is going to be used to prosecute an employee.  That cost needs to be weighed.  The argument is made that not prosecuting sets a bad example.  The question that needs answering is who knows they were prosecuted and who knows what the outcome was.  Isn't the investigation confidential?

Prosecution has some worth but it is a business decision.  Consider the following carefully when making that decision.

1. In most cases, calling the police immediately is not necessary.  While it may be more dramatic, there is no need to send someone out the door in handcuffs.  It is better to organize your investigation and take it to local law enforcement.  Don't rush this part of your investigation.  The criminal process is not anything like portrayed on television.

2. Your case may be well documented but the prosecutor may decide to plea bargain the case to a lesser charge.  It's out of your hands.

3. Your case may languish in the system because it is not a priority.

4. Losing a criminal case may give rise to a civil action based on malicious prosecution.

5. You may have a confession for $1000 but you can only prove $50.  Charges may only be accepted on the provable $50.00.

Restitution and Civil Restitution

Restitution is an available option on any case.  It is simply the employee's agreement to repay what they stole.  Civil Restitution is available in most states.  Civil Restitution is allowed, generally through a civil statute, that basically says a company can seek civil damages because of the time and effort required to investigate the incident.  Every state that has enacted what is also known as civil demand, has a range of damages that can be sought.  In Texas, for instance, damages up to $1000 can be sought against an adult and up to $5000 against the parents of a juvenile.  The monetary value of the theft is irrelevant.  What is important to know is that Civil Restitution is a separate matter from prosecution.  In essence an employer can seek prosecution, full restitution and then file for Civil Restitution.  Check with your attorney on this and how pursue this aspect.  Regardless of the method chosen, there should be a written policy in place to adequately cover this practice.

1. If you prosecute, you will receive restitution through the courts and it is up to the court as to the amount (if any) of payment and the length of time to repay.

2. If prosecution is not intended then restitution should be agreed to and a Promissory Note should be created.  I recommend a term of one year with equal payments each month.

3. Check with your attorney or HR Department and discuss how an employee can voluntarily forfeit final pay, vacation pay, profit sharing or any other source within the company for restitution.  A document should be created that allows the employee to use those funds for restitution.  The form should be signed but does not need, necessarily, to be notarized.  This method shows the greatest opportunity to recover from theft.

After-action

This is the part that is frequently left out of an investigation:  root cause analysis or what happened and why did we not catch it earlier?  Prevention is the key and plugging gaps in your current way of doing business is an ongoing challenge.  Prevention efforts will be successful about 80% of the time.  A component of prevention is the fear of detection.  It's the old question of would you steal a million dollars if no one knew you did it.  Some people would never steal.  Some would steal if given an opportunity regardless of the chance of detection.  That middle group fears they would be found out.  That process of detection must be in place through rigorous oversight of controls, policy and procedures.  The apprehension of an employee is the result of a failure somewhere along the way.  Keep in mind that all procedures are written with a perfect world in mind but those procedures are never followed correctly 100% of the time.  Employees prey on systemic weakness and human error.  You can't have one without the other.

Review every piece of the chain of events regarding the theft.  Remember...you asked the employee how this happened.  Make suitable changes but try not to go overboard and put safeguards in place that begin to hamper business.

Secrets to a Successful Employee Theft Investigation

Even the most complex financial crimes come down to one thing:  some "rule" be it policy, procedure, law, regulatory act, or note on the time clock, has been violated.  While that concept may be overly obvious, it is significant when it comes down to the time of the interview.  Establishing that the employee understood the correct manner to conduct their business will be the bedrock to all subsequent actions.  While feigning ignorance may be offered, it is extremely rare that the person did not know they were in violation especially when it comes to theft.  Investigators sometimes miss this huge opportunity for discussion.  The employee should be emboldened by the fact that they know how things are done properly and that they can recite that almost verbatim .  It is, however, an unknowing trap because your investigation may have revealed that they circumvented all of the intended safeguards.  This interview method dispels any notion of inadequate training.

The most important facet of an investigation is to learn what you don't know.  Your investigation may reveal all kinds of damning evidence but that is what you developed and there are likely more acts that have not been surfaced.  Too often an employee is handed a file and told "Tell me about this".  What is the next question when the answer is "I don't know".?  The fruits of the investigation will extend far beyond what is known if the interview process is handled properly.  The smallest admission of theft is the beginning of a successful interview that ultimately simply confirms what you already knew.  The successful interview always gains more than is known.  The art is in knowing how to get to that information.

The notion that interviews and interrogations are stern and overbearing is false.  Professional investigators keep it conversational and with humor.  It's not about the spoken words but more about the body language.  Investigating crime of any kind requires training and experience.  Gathering evidence is not very difficult but the successful investigation ultimately ties the person to the events.  In cases where no admission is made, one must be prepared to act on that very evidence.  An accusatory interview/interrogation will be a disaster if the employee is returned to work.  Don't rush into an interview without knowing the facts.

We offer training in internal theft investigation.  Call us for more details.

Click here for a written copy of this article.