Documenting Suspected Employee Theft in a Restaurant

Document the evidence, not the accusation

When you suspect theft, your job that night is to preserve evidence and write a neutral observation record — the counts, the POS exports, the access list, the footage, and the times — while keeping every conclusion about intent out of the document. The temptation runs the other way, and the file written at 1 a.m. by a furious manager is the one that causes problems for everyone in it.

There is a practical reason beyond fairness. Theft matters get reviewed by people with a much higher evidentiary bar than a shift manager: an insurer, a prosecutor, a hearing officer, your own counsel. A file that reads as a conclusion invites the question of whether you investigated or just decided. A file that reads as evidence lets whoever is qualified reach the conclusion.

This page is the observation record. If what you actually have is a drawer variance with no other signal, that is a different and much more common document — see documenting a cash drawer shortage. If it is a POS pattern, it is void and comp abuse. If a manager, camera, or named witness saw product, unpaid comps, or tip-jar/till cash leave with the employee and you are writing the discipline step, use the restaurant employee theft write-up. If the facts are a withheld tip-out or a tip-pool skim, use the restaurant tip-theft write-up.

What to capture, and how fast

Order matters here. Preserve before you talk to anyone.

Capture	Why it is first	Expiry
Camera footage over the register, safe, walk-in, and back door	The only evidence that shows conduct rather than an outcome	Days, sometimes less on a busy camera
POS exports by employee ID — cash-out, voids, refunds, no-sales, comps, payouts	Ties activity to a sign-in and a timestamp	Detail reports often roll before summaries
Drawer or bank count sheets, two counters, recount noted	A single-counter count is a claim	Same night
Schedule and clock-in record	Establishes who was in the building	Stable, pull it anyway
Inventory, pour cost, or waste variance	Where product rather than cash is involved	Weekly cycle
Key, alarm, and safe access log	Narrows the access list	Stable
Written statements from anyone who observed something	Memory converges within days	Same shift
Your own observation, written the same night	Dated and specific beats recalled and vivid	Same night

Export the footage before you do anything else. Every theft matter that falls apart falls apart on this, and the reason is always the same: somebody planned to pull the clip on Monday.

What the record should say

Do not write this:

Katie has been stealing from the bar all month. Everyone knows it. Drawer keeps coming up short and her voids are through the roof. Terminating for theft.

Write this:

Cash and POS review, Register 2, 3/1–3/14. Closing variances: 3/2 ($44.75 short), 3/8 ($31.00 short), 3/14 ($62.40 short). Each counted by J. Ruiz with a second counter present and recounted once; count sheets attached. Sign-ins on Register 2 for those shifts: K. Alvarez sole sign-in on 3/2 and 3/14; K. Alvarez and M. Reyes on 3/8. Void report for the same period: 14 voids under K. Alvarez totaling $196.15, of which 9 were entered after payment was tendered. Store average post-payment voids for the period: 2. No-sale events on K. Alvarez shifts: 7, 4, 11. Register-facing camera exported for all three closes on 3/14 and saved to the office drive. Starting banks were counted at issue on 3/8 and 3/14; the 3/2 bank was not counted at issue. No employee interviews conducted as of this entry. Matter referred to ownership on 3/14 and to employment counsel on 3/15.

The second version never uses the word theft, and it is far more damaging to a dishonest employee and far safer for an honest one. Note the last two details: the uncounted bank on 3/2 is a genuine weakness in the evidence, and recording it is what makes the rest credible.

What never belongs in the record

• "Stole," "stealing," "theft," "dishonest." These are conclusions and, in some contexts, allegations of a crime. Keep them out of the personnel file entirely and let counsel choose the language for anything beyond it.
• Speculation about motive or circumstances. Their financial situation, their personal life, what someone heard. None of it is evidence and all of it looks bad later.
• Aggregated totals with no shift detail. "$400 missing this quarter" cannot be attributed to anyone.
• Other employees' opinions presented as fact. If a coworker observed something, take a dated witness statement in their own words. If they only suspect something, that is not a record.
• A confession you paraphrased. If an employee says something significant, write their words, and note who else was present. Never write "he admitted it."
• Anything you would not want read aloud with the employee, their representative, and your own counsel in the room.

Theft matters carry legal exposure that ordinary discipline does not — defamation, wrongful termination, and criminal-process questions all sit close by. Bring in your own HR advisor or employment counsel early, and let them direct anything beyond preserving evidence and recording observations.

Which documents this becomes

Three, usually, and they stay separate:

1. An investigation file, restricted to the people who need it — not the general personnel file. The process is on restaurant workplace investigations; capture the underlying events with the incident report generator.
2. A suspension notice if you are removing the employee from the schedule while you review. Word it as pending investigation, name no finding, and state the pay treatment.
3. A closure document, whichever way it goes. If the review supports action, the discipline is written after the investigation and cites the dated evidence — often a final written warning where the finding is a procedure failure rather than anything more. If it does not, the file gets a note saying the matter was reviewed and no action was taken. Skipping that note is unfair to the employee and it makes your next investigation less credible.

Follow-up

Hour one: export footage. Pull the POS detail reports. Do not announce anything.

Same night: write the observation record. Take statements from anyone who saw something, separately.

Next day: brief ownership and, for anything material, your own counsel. Decide together whether a suspension is warranted and whether the interview happens now or later.

Within the week: hold the interview with a second manager present, ask open questions, and write the answers verbatim. Close the file in writing.

Afterward: fix the procedure that made it possible. Uncounted starting banks, shared sign-ins, unsupervised voids, and a safe four people can open are the conditions behind most of these matters, and none of them are fixed by a termination. The pillar's cash and voids section covers where those records live.

Conclusion

Preserve first, describe second, conclude never. Footage exported the same day, POS detail by employee ID, counts with two counters, statements in their own words, and a record that would still be fair if you turn out to be wrong.

Capture the events with the incident report generator and take accounts on the witness statement form. Docu-Coach™ keeps the evidence, the notice, and the closure in one dated sequence so the file shows an investigation rather than a decision — better documentation and organized employee history, not legal advice. Anything involving a possible crime belongs with your own employment counsel before you act.

See it against a real case at /demo.