Restaurant Employee Theft Write-Up

Restaurant employee theft write-up (product walkouts, unpaid comps, tip-jar or till cash)

A restaurant employee theft write-up is the dated record that product, unpaid comps, or tip-jar/till cash left with a scheduled employee against a posted rule—plus what left, how it left, who saw it, POS or camera cite, policy citation, and next progressive step. It is not a group-chat vent about "always stealing," and it is not a Friday memo that bundles three short drawers after the unemployment letter arrives.

Use this page when you manage FOH, BOH, or a bar and someone was seen walking out with food or product, ringing an unpaid or fake comp, or taking tip-jar or till cash. This is not a counted drawer variance with no observed taking: that belongs on the cash drawer shortage write-up. It is not a POS void or comp spike by itself: that belongs on void and comp abuse. It is not suspicion without an observed taking: preserve first on documenting suspected employee theft. It is not a food-safety miss: that belongs on the restaurant food-safety write-up. It is not refusing a lawful work order: that belongs on the restaurant insubordination write-up. It is not a guest photo or public workplace post: that belongs on the restaurant social media write-up. It is not walking off the job: that belongs on when an employee walks out mid-shift. Do not use this form for a tip-pooling policy dispute: use the restaurant tip-theft write-up. For the full floor file (hire packet, guest complaints, alcohol, cash), use the restaurant employee documentation checklist. For write-up language that is not this incident type, see how to write up an employee and employee write-up examples.

What a documented taking is—and is not

Documented taking means a manager, camera, or named witness can point to product, unpaid comps, or tip-jar/till cash leaving with the employee. The record is the item, the time, and the observation—not the word "theft." "Stole," "thief," and "dishonest" are conclusions. Write what left and who saw it.

Treat these as different records, even when they happen the same night:

Event	What to log	Typical next step
Food or product walked out (to-go bag, backpack, walk-in to car)	Item, quantity, exit time, who saw it or camera ID	Often a first write-up if the handbook already bans unauthorized product removal
Unpaid or fake comp (rang as comp, product left with employee or a guest they named)	Check number, items, who approved (or "no approval"), where the product went	This page if the taking was observed; void/comp abuse if you only have a POS pattern
Tip jar or till cash seen leaving with the employee	Amount if known, container, time, who saw it	Often a first write-up if cash-handling is already acknowledged
Drawer counted short, no observed taking	Count, bank, access list, POS cash-out	Cash drawer shortage write-up only
Void/comp percentage outside the store range, no observed taking	Report by employee ID, baseline	Void and comp abuse
Suspicion, no observation, no exported clip	What you preserved, access list	Suspected employee theft documentation—not this write-up
Tip-pool split or tip-out dispute	Their words, the posted tip policy	Tip-theft write-up—not this form
Approved leftover / manager-released product	Who approved, what left, time	Not this write-up; note the approval
Walk-out / job abandonment	Exact words, last station, last punch	Attendance/incident—not a product taking
Food-safety miss with no product removed	Reading, product disposition, retrain	Food-safety write-up only
Refused a lawful search or stay-until order	The order, the reply	Insubordination plus this page if a taking was also observed
Posted a till, cash-out, or "I took this home" photo	Platform, URL, what is visible	Social media write-up; add this page only if the taking is also documented

One observed to-go bag of steaks is an occurrence. Three dated takings with coaching or investigation paper between them is a pattern. Unemployment boards treat "they are always stealing" as a story until the item, the time, and the observer are on the same page.

What to document the same day

Capture this before the camera overwrites—voice note on the floor is fine if the clip and official file hit the same day.

1. Identity — Employee, role (server, host, line, dish, bartender), home store if borrowed.
2. What left — Item and quantity, or cash amount if known. "Two wrapped ribeyes" beats "food." "Tip jar emptied; $40 counted at 4:00 p.m., $0 at 9:12 p.m." beats "stole tips."
3. How it left — Backpack, unpaid comp, coat, till cup, guest check named to a friend. Write the path, not the motive.
4. When — Clock time of the observation, and the punch if they were leaving.
5. Who saw it — Manager, named coworker still employed, or camera ID and export path. A clip nobody exported is not evidence.
6. POS or inventory proof — Check number, comp/void line, inventory or waste log, starting tip-jar count. Cite the report.
7. Approval — Whether a manager released the product or approved the comp. If nobody did, write that.
8. Policy — Handbook cash-handling, product-removal, leftover, or tip-jar section the employee already acknowledged.
9. Employee explanation — Their words, or "declined to comment." If they mention a manager-approved leftover, a mistake, a medical need, or a tip-pool dispute, write that sentence verbatim and stop.
10. Next step — Coaching, written warning, final warning, or separation per the published ladder. Do not write a crime label.

Skip: "stole," "thief," "dishonest," "third time this month" with no prior dates. Those sentences are what hearing officers discard.

Do not search a personal bag or phone unless your published policy and counsel already allow it. If you give a lawful stay-until or empty-pockets order and they refuse, that is the insubordination record. If you only suspect taking and have no observation, stop this form and use documenting suspected employee theft.

If you are scoring the whole file—not just this observation—walk the personnel file checklist for handbook and I-9 storage, then the restaurant checklist for floor extras.

Progressive discipline for restaurant employee theft

Write the step you are on, and list the prior dated product, comp, or cash-taking notes. Do not invent a "final warning" on the day you terminate unless the file already shows the earlier paper.

Step	What belongs in the file	Restaurant miss
Same-day occurrence	Item or amount, path, observer or camera export, POS cite, MOD	"I know they took it"
Coaching	Facts from the occurrence, policy cited, follow-up date	"I told them to stop stealing"
Written warning	FACT write-up, prior taking dates listed, employee response	First paper appears on termination day
Final warning	Same issue or published cash/product threshold	New issue stacked without dates
Separation summary	Who, when, which taking dates, property/keys, final pay	Termination text with no item-and-observer history

A first leftover sandwich with a posted leftover rule is often coaching even if Saturday was slammed. An observed product walkout, unpaid comp, or tip-jar/till taking is often a written warning if the handbook already banned it. A documented pattern with the first steps dated and acknowledged is the unemployment-defense version of "we gave fair notice."

If your handbook is zero-tolerance for taking product or cash, say so in the write-up and attach the signed acknowledgment. Inconsistent enforcement—night MOD writes it up, day MOD laughs it off—hurts more than a missing adjective.

A first conversation that states the next step is still a verbal warning if you said a further taking becomes a write-up. For the ladder itself, use the progressive discipline policy guide.

Build the document with the employee write-up generator if you want the item, the observer, and the next step held in one place. The field definitions live on the restaurant employee write-up page.

Unemployment-defense angle

States differ on misconduct, but the questions are boring and predictable:

• Did the employee know the cash-handling, product-removal, leftover, or tip-jar rule?
• Can you show what left, when, and who saw it—or only a short drawer?
• Did you export the camera clip the same day—or after the claim, when it was gone?
• Were prior product or cash steps dated, coached, and delivered?
• Did you apply the same rule to other employees who took leftovers or comps?
• If they raised a manager-approved leftover, a tip-pool dispute, or another protected reason, is that check in the file separately from the write-up?

A charged claim is a tax event, not a morality play. Price it with the unemployment claim cost calculator. Build the hearing pack with how to defend an unemployment claim. Restaurants that fail with a "complete" hire packet usually have no item-and-observer note; that failure mode is spelled out in how restaurants lose unemployment claims.

If two of these boxes are empty, coach and document before you separate—unless the published cash or product rule and a same-day observation support immediate action. Confirm search, criminal-process, and accusation thresholds with your own HR advisor or employment counsel. Anything that may become a police matter belongs with counsel before you interview or terminate.

Example employee theft write-up structure

Copy the headings. Replace the brackets. Do not add personality.

Employee: [Name], [server / host / line / bartender], [store]
Date of incident: [Saturday, date]
Station: [Walk-in / expo / bar well / cash-out office]
On duty: Clocked in [4:02 p.m.]; scheduled [4:00 p.m.–10:00 p.m.] per [7shifts / POS labor export].
What left: [Two wrapped ribeyes / check 4418 entrée marked comp, product left in employee's bag / tip jar counted $40 at 4:00 p.m., $0 at 9:12 p.m.].
How it left: [Backpack through back door / unpaid comp, no manager approval / till cup into coat pocket].
Observed: At [9:14 p.m.], [MOD / camera 3 / named witness] saw [the bag leave / the cup leave the till].
Proof cited: [Camera 3 export saved to office drive 9:40 p.m. / POS check 4418 / tip-jar count sheet].
Approval: [No MOD release / leftover log not signed / comp not approved].
Posted standard: Handbook requires [no product removal without manager sign-off / manager-approved comps only / tip jar counted and dropped, not removed].
Impact: [Inventory short two ribeyes / guest check 4418 $28 unpaid / tip jar $40 missing vs. 4:00 p.m. count].
Policy: Handbook §[Cash Handling / Product Removal / Leftovers / Tip Jar], acknowledged [date].
Prior steps: Coaching [date] for an unsigned leftover; verbal warning [date] for an unpaid side.
Action: [Coaching / written warning / final warning].
Employee response: [Quote or "declined to comment"].
Follow-up: Next unauthorized product or cash taking in [window] results in [next step]. Follow-up date [date].
MOD: [Name]. Witnesses still employed: [names].

That is a write-up. "Employee stole food and is a thief" is not. Pull FACT replacements from employee write-up examples if you catch yourself reaching for a label.

Common employee theft write-up mistakes

• Logging Friday because Saturday's camera had already overwritten
• Bundling three short drawers into one "always stealing" memo
• Writing "stole" with no item, no time, and no observer
• Calling a drawer short a theft write-up instead of using the cash drawer shortage write-up
• Calling a void/comp spike theft instead of using void and comp abuse
• Writing this form on suspicion alone instead of using documenting suspected employee theft
• Treating a tip-pool split argument as till theft—use the restaurant tip-theft write-up
• Calling leftover food a food-safety write-up when the miss was unauthorized removal—use this page, not the food-safety write-up, unless a holding standard was also missed
• Calling a refused bag check "theft" instead of using the insubordination write-up
• Calling a walk-off "they stole a shift" instead of using when an employee walks out mid-shift
• Searching a personal bag or phone without a posted rule and counsel
• Writing the first formal note on the day of termination
• Filing the clip in camera roll or Slack, not the official record
• Skipping whether a manager actually approved the leftover or comp

How to run this the next time product or cash leaves with an employee

1. Confirm an observed taking—item, path, observer or camera—before you assume a violation.
2. Export the clip and pull the POS or inventory cite the same night.
3. Log the observation within two hours: what left, how it left, approval, MOD.
4. File it to the official record the same day.
5. Draft the write-up from that capture using the structure above—not from memory on Tuesday.
6. If this is occurrence two or three, pull the prior dated product or cash notes before you talk termination.
7. If you only have a short drawer, use the cash drawer shortage write-up—do not merge the two.
8. If you only have a void/comp pattern, use void and comp abuse.
9. If you only have suspicion, use documenting suspected employee theft and stop this form.
10. If they refused a lawful stay-until or search order, use the insubordination write-up.
11. If they posted the till or the take-home, also file the social media write-up.
12. If they raised a manager-approved leftover, a tip-pool dispute, or another reason that is not this taking, check that claim and file it separately. If the facts are a withheld tip-out or a tip-pool skim, use the restaurant tip-theft write-up. Confirm the next step with your HR advisor or employment counsel when a search, accusation, or possible crime is in play.
13. If a claim is already filed, export the pack and follow how to defend an unemployment claim.

Conclusion

Restaurant employee theft documentation is a same-day habit: what left, how it left, who saw it, and a progressive step the employee already knew. This page is the write-up for one observed product walkout, unpaid comp, or tip-jar/till taking. The restaurant employee documentation checklist is the rest of the floor file. The personnel file checklist still covers hire packets and I-9 storage. Docu-Coach™ timestamps the capture so the write-up is a review, not a reconstruction.

Book a demo or start a 30-day trial at /demo.