Employee Theft Investigation Procedure SOP
Use this Employee Theft Investigation Procedure SOP to log allegations, preserve evidence, coordinate HR and loss prevention, and document findings without compromising confidentiality or case integrity.
Trusted by frontline teams 15 years of frontline software
Built for: Retail · Warehousing & Logistics · Corporate Offices · Manufacturing · Healthcare Administration
Overview
This Employee Theft Investigation Procedure SOP template provides a controlled workflow for handling suspected internal theft from the first allegation through case closure. It covers how to receive and log the report, notify HR and loss prevention, preserve evidence, review records for factual indicators, consult HR before employee contact, conduct the interview, and document findings and escalation decisions.
Use this template when a manager, auditor, coworker, or system report suggests possible theft, fraud, inventory diversion, or unauthorized removal of company property. It is especially useful when multiple departments need to coordinate and the organization must protect confidentiality, maintain evidence integrity, and keep a clear record of who knew what and when. The structure also helps when the facts are incomplete and the team needs to separate allegations from verified non-conformance.
Do not use this SOP as a substitute for legal counsel, criminal reporting guidance, or a workplace violence response. It is also not the right tool for routine performance issues, minor policy violations with no theft indicator, or situations that require immediate law-enforcement involvement before internal review. If the allegation involves hazardous materials, controlled substances, or regulated inventory, the procedure should be paired with the relevant safety, security, or permit-to-work controls before any employee contact.
Standards & compliance context
- The template supports ISO 9001:2015 documented information practices by requiring controlled records, traceability, and retained rationale.
- It aligns with general HR and governance expectations for confidentiality, consistent investigation handling, and documented non-conformance response.
- If the allegation involves hazardous substances, controlled access areas, or regulated operations, the process should be coordinated with OSHA, permit-to-work, or site security controls as applicable.
- Where evidence includes personal data or surveillance footage, the SOP should be reviewed against local privacy and employment law before use.
General regulatory context for orientation only — verify current requirements with counsel or the relevant agency before relying on this template for compliance.
What's inside this template
Steps
This section matters because it turns the investigation into a controlled sequence with clear ownership, evidence handling, and escalation points.
-
Receive and log the allegation
The manager records the allegation in the incident log using objective language only.
Include:
- Date and time received
- Reporter identity or source category, if permitted
- Employee name or identifier
- Alleged conduct and location
- Any immediate risk to cash, inventory, systems, or people
Do not speculate, accuse, or discuss the allegation with uninvolved staff.
-
Notify HR and loss prevention
The manager notifies HR and the designated loss prevention role using the approved escalation channel.
Document:
- Who was notified
- When notification occurred
- What information was shared
- Any immediate instructions received
If the allegation involves a manager, cash handling, controlled inventory, or system access, escalate immediately to the next authorized leader.
-
Preserve evidence and restrict access
The assigned investigator secures relevant evidence and limits access to authorized personnel only.
Preserve, but do not alter:
- CCTV footage
- POS or transaction records
- Timekeeping records
- Inventory counts and adjustments
- Access logs
- Physical items related to the allegation
Use chain-of-custody documentation for every item collected or copied. Store evidence in a secure location with controlled access.
-
Review records for factual indicators
The investigator reviews available records for objective indicators of loss or policy deviation.
Check for:
- Unusual voids, refunds, or discounts
- Inventory discrepancies beyond tolerance
- Access log mismatches
- Timekeeping anomalies
- Repeated exceptions tied to the same role, shift, or location
Record only verified facts and note any missing records as a documented gap.
-
Consult HR before employee contact
The investigator reviews the proposed next steps with HR before contacting the employee.
Confirm:
- Interview purpose and scope
- Who will attend the meeting
- Whether suspension, schedule changes, or access restrictions are needed
- Any legal or policy limitations on questioning or discipline
Do not confront the employee before HR approves the approach.
-
Conduct the employee interview
The designated interviewer conducts a private, professional interview with a second authorized witness present when required by policy.
Use:
- Neutral, factual questions
- One question at a time
- Silence and follow-up prompts for clarification
Avoid:
- Threats, promises, or accusations
- Leading questions
- Discussing unverified allegations as fact
Document the employee’s responses accurately and note any refusal to answer.
-
Determine findings and escalate deviations
The investigator compares the evidence against policy, documented controls, and known tolerances.
Classify the case as one of the following:
- No substantiated issue
- Policy deviation requiring coaching or corrective action
- Non-conformance requiring HR review
- Potential theft requiring legal or executive escalation
If evidence is incomplete, document the gap and continue the investigation before closing the case.
-
Close the case with documented rationale
The investigator documents the closure decision and the basis for it.
Include:
- Summary of evidence reviewed
- Reason for closure
- Any corrective actions or monitoring steps
- Final storage location for records
Retain all records according to company retention requirements and ISO 9001 documented information controls.
-
Escalate substantiated cases for disciplinary action
The investigator submits the complete case file to HR and authorized leadership for final action.
Include:
- Allegation summary
- Evidence log and chain-of-custody records
- Interview notes
- Findings and recommendation
- Any recommended access changes or recovery steps
Do not communicate disciplinary outcomes beyond authorized personnel.
How to use this template
- 1. The case owner receives the allegation, assigns a case number, and logs the date, source, location, and initial facts in the investigation record.
- 2. The case owner notifies HR and loss prevention, confirms the investigation lead, and restricts case access to approved roles only.
- 3. The investigator preserves original evidence, secures related records, and documents chain-of-custody details for each item collected.
- 4. The investigator reviews factual indicators such as inventory records, access logs, transaction history, witness statements, and CCTV references before any employee contact.
- 5. The investigator consults HR, conducts the employee interview with approved questions, and records findings, deviations, and escalation decisions in the case file.
- 6. The case owner closes the case with a documented rationale, assigns corrective actions if needed, and retains the record according to the organization’s document control rules.
Best practices
- Log the allegation immediately and separate the original report from later analysis so the timeline stays clear.
- Limit access to the case file to the smallest practical group to reduce rumor spread and evidence tampering.
- Preserve original records before reviewing copies, especially for CCTV, badge logs, POS data, and inventory reports.
- Use a neutral interview script and avoid accusatory language until the facts are verified.
- Document every handoff, approval, and evidence transfer so the case file supports chain of custody.
- Escalate any conflict of interest, retaliation concern, or safety risk before continuing the investigation.
- Close the case only after the rationale for findings, non-conformance, or no-finding outcomes is written and approved.
What this template typically catches
Issues teams running this template most often surface in practice:
Common use cases
Frequently asked questions
What does this SOP cover, and what does it not cover?
This SOP covers the internal process for receiving an allegation, preserving evidence, reviewing records, coordinating with HR and loss prevention, interviewing the employee, and closing the case with documented rationale. It is designed for suspected employee theft, fraud, or inventory diversion where an internal fact-finding process is needed. It does not replace legal advice, criminal reporting requirements, or a broader workplace misconduct policy. If the matter involves violence, threats, or an active safety risk, it should be escalated through the appropriate emergency or security process first.
How often should this procedure be used?
Use it every time a theft allegation is raised, whether the concern comes from a manager, coworker, audit finding, inventory variance, or surveillance review. It is not a periodic checklist; it is an event-driven procedure. Many organizations also adapt it into a repeatable case-management workflow for recurring loss events. The key is to apply the same documented steps each time so the investigation is consistent and defensible.
Who should run the investigation?
The investigation is usually led by HR, loss prevention, security, or a designated manager, depending on company policy and the sensitivity of the case. A competent person should own the case file, coordinate approvals, and control access to evidence. The employee’s direct supervisor may provide facts, but should not independently conduct sensitive steps unless the SOP assigns that role. If the allegation may involve a conflict of interest, assign a different investigator.
How does this SOP support confidentiality and evidence integrity?
The SOP creates a controlled chain of actions: log the allegation, limit access, preserve records, and document each decision. That reduces the risk of evidence contamination, rumor spread, or unauthorized disclosure. It also helps the organization show that employee contact, record review, and escalation were handled through a defined process rather than ad hoc judgment. Confidentiality controls are especially important when the allegation is unverified.
What regulatory or standards considerations does it align with?
This template supports general documented information practices consistent with ISO 9001:2015, because it emphasizes controlled records, traceability, and retained rationale. It also fits governance expectations around internal investigations, confidentiality, and non-conformance handling. If the allegation touches regulated goods, food handling, or hazardous materials, the case may need to connect to HACCP, GMP, OSHA, or permit-to-work controls. The SOP should be reviewed with legal and HR to match local employment law and company policy.
What are the most common mistakes when using this SOP?
Common mistakes include confronting the employee before HR review, failing to preserve original evidence, and letting too many people access the case file. Another frequent issue is treating suspicion as proof and skipping factual verification. Teams also sometimes forget to document why a case was closed or escalated, which weakens auditability. This template helps prevent those failures by forcing a step-by-step record of the investigation.
Can this SOP be customized for different departments or sites?
Yes. You can tailor the allegation sources, evidence types, approval chain, interview participants, and escalation thresholds for retail, warehouse, office, or field operations. Many teams add site-specific inventory controls, badge access logs, CCTV references, or cash-handling records. You can also adapt the language to match union rules, local privacy requirements, or regional HR practices. The structure should stay the same even when the evidence sources change.
What systems or records should this SOP integrate with?
This SOP often connects to HR case management, access control logs, CCTV retention, inventory systems, timekeeping records, and incident reporting tools. It can also reference document control, witness statements, and evidence logs so the case file stays complete. If your organization uses a ticketing or GRC platform, the SOP can map each step to a case status or approval. The goal is to make the investigation traceable across systems without exposing the file broadly.
How is this better than handling theft allegations informally?
An informal approach often leads to inconsistent interviews, missing evidence, and undocumented decisions. This SOP gives the team a repeatable sequence for verification, escalation, and closure, which lowers the risk of bias and procedural gaps. It also helps managers avoid premature accusations or unauthorized disclosure. For serious allegations, a documented process is usually easier to defend internally and externally than a verbal-only response.
Related templates
Go deeper on the topic
-
A standard operating procedure (SOP) is a documented, step-by-step procedure for a repeatable task — the written version of "how we do this here." Good SOPs...
-
Overtime calculation is the process of applying federal, state, local, and contractual rules to hours worked to determine the correct pay — including...
-
Predictive scheduling laws — also called fair workweek laws or secure scheduling — require employers in covered industries to publish employee schedules...
-
Geofencing defines a virtual geographic boundary — a "fence" — around a work location. When an employee's mobile device enters or exits the fence, the...
-
See how customers use MangoApps Projects Module to collaborate, track progress, and share knowledge across teams.
-
Intranet file naming conventions that improve search, reduce clutter, and help employees find the right document fast.
-
AI employee self-service assistants cut HR and IT support time with instant answers, automated routing, and better employee experience.
-
MangoApps explains why vector embeddings are derived data, not source data — and why regeneration beats backup for AI-powered search reliability.
Ready to use this template?
Get started with MangoApps and use Employee Theft Investigation Procedure SOP with your team — pricing built for small business.
