Documenting a Cash Drawer Shortage

A drawer shortage is a measurement, not a conclusion

Document a cash drawer shortage as a counted variance under stated conditions — the amount, the bank, who counted, who had access, and which POS records you pulled — and leave every judgment about how it happened out of the write-up. The distance between "short" and "stole" is where restaurants create records they cannot defend. A photo of a till, cash-out sheet, or guest payment posted to TikTok or Instagram is a different record: use the restaurant social media write-up. If a manager, camera, or named witness saw product, unpaid comps, or tip-jar/till cash leave with an employee, that is a different record: use the restaurant employee theft write-up. A withheld tip-out or tip-pool skim is a different record: use the restaurant tip-theft write-up.

Managers get this wrong in both directions. One writes "Katie was $60 short again" with no count sheet, no witness, and no access list. Another skips the record entirely because they are not sure enough to accuse anyone, and then a pattern that has been running for six weeks has zero paper behind it. Both leave you with nothing.

What to capture before the drawer leaves the office

Cash evidence has the shortest shelf life of anything on a restaurant floor. Do this at close, in the office, with the drawer still on the desk.

Capture	Detail that makes it usable
Starting bank	Amount, who issued it, when, and whether it was counted at issue
Count result	Exact variance to the cent, not "about sixty bucks"
Who counted	Two names. A shortage counted by one person is a claim, not a count
Recount	Whether a second count was performed and its result
Drawer and register ID	Which till, which terminal, which shift
Sign-ins	Every employee ID that accessed that drawer, with timestamps
POS cash-out report	Printed or exported, attached to the record
Voids and refunds	By employee ID with times — a shortage plus a void spike is a different record than a shortage alone
No-sale / drawer-open events	Count and timestamps for the shift
Payouts and petty cash	Vendor COD, ice run, anything that legitimately left the drawer
Camera preservation	Whether you pulled the clip over the register, and when
Employee statement	Their account, taken the same night if they are still on property

The camera line matters more than people expect. Register-facing footage is the single most useful piece of evidence in a cash case, and most systems overwrite it before anyone thinks to save it. If the shortage might be reviewed by anyone, export the clip the night it happens and note in the record that you did.

What the record should say

The distinction here is subtle enough that it is worth seeing both versions side by side.

Wrong — an accusation with a dollar sign:

Katie's drawer was short $62 again. Third time. She's clearly taking money and I'm writing her up for theft.

Right — a shortage record:

Friday 3/14, Register 2, closing count 11:15 p.m. Starting bank $300, issued 4:00 p.m. by J. Ruiz, counted at issue. Closing count $62.40 short against the POS cash-out report. Counted by J. Ruiz, witnessed by M. Okafor; recounted once with the same result. Employee sign-ins on Register 2 for the shift: K. Alvarez (4:02 p.m.–11:04 p.m.), sole sign-in. Void log shows 4 voids totaling $38.15 under K. Alvarez, 2 of them post-payment. No-sale events: 7. No payouts recorded. Register-facing camera clip 4:00–11:15 p.m. exported and saved 3/14. K. Alvarez stated: "I don't know, I counted it twice at the start and it was fine." Prior shortages on this employee: 2/19 ($21.00, coached) and 3/2 ($44.75, written warning). Policy: Handbook §6.1 Cash Handling, acknowledged 8/9.

Nothing in the second version says anyone took anything. It also gives a reviewer everything they need — including the two post-payment voids, which are the detail worth following up on.

What not to write down yet

• "Stole," "took," "pocketed." A count establishes a variance. It does not establish where the money went.
• "Theft" as the incident type. If you believe theft occurred and nobody saw product or cash leave, that is an investigation with witness statements, a restricted file, and probably a conversation with counsel — not a discipline form. Start with documenting suspected employee theft and the restaurant workplace investigations process. If the taking was observed the same shift, use the restaurant employee theft write-up.
• A total across weeks. "$128 short this month" hides which shift, which register, and who else signed in. Write each shortage as its own dated record and let the pattern be visible across them.
• A repayment demand. Wage deduction rules vary by state. Keep it out of the document entirely.
• The word "again" without the prior dates. If the earlier shortages were never documented, this is a first written record no matter how many times it has happened.

Which document this becomes

Most drawer shortages produce a write-up for a cash handling procedure violation, not for the variance itself. That distinction is what makes the document survive review: you are disciplining the missed drop, the shared sign-in, the unverified refund, or the uncounted bank — things the employee controls and the policy names.

Build it from the eleven fields on the restaurant employee write-up page, or run it through the write-up generator, which flags judgment words as you type.

Escalate the format when the facts do:

• Repeat shortages with a documented prior step → a final written warning citing the earlier dated records.
• A shortage alongside a void or comp anomaly → an incident record as well, because you now have two evidence sources. The restaurant incident report guide covers evidence preservation.
• An active investigation → a suspension notice if you are removing the employee from the schedule while you look into it. Word it as pending investigation, not as a finding.

Follow-up

Same night: count, recount with a witness, export the POS reports, preserve camera, take the statement, file the record.

Within 48 hours: hold the conversation off the floor. Read the count and the conditions, ask what they remember about the shift, and write their answer verbatim. If their account names a procedure gap — a manager who used their till, a bank that was never counted at issue — that goes in the record too, and it may be the real finding.

Two weeks: check whether the procedure change actually happened. Most repeat shortages in restaurants trace back to shared drawers and uncounted starting banks, and no amount of discipline fixes a procedure. If the same employee is short again under a clean procedure, you now have a dated series instead of a hunch.

For servers running their own banks, the evidence trail is different from a bartender on a house till — that role-level difference is covered in documenting servers. The whole record set a restaurant file needs is on the pillar guide.

Conclusion

Write the count, not the theory. Amount to the cent, two counters, the access list, the POS exports, the camera clip, and the employee's own words — then choose the discipline level from your published threshold.

The write-up generator builds the document and shows which defensibility fields are still empty. Docu-Coach™ keeps each dated shortage in one employee history so a pattern is visible on the second occurrence instead of the sixth — better documentation and more consistent records, not legal advice. Wage deduction and theft questions belong with your own HR advisor or employment counsel.

See it against a real close at /demo.