Employee Theft, Inventory Shrinkage and Undercover Surveillance Investigations

Employee theft can be one of the most difficult forms of workplace misconduct for a business to identify and prove. Unlike an obvious theft caught on camera, internal theft may occur gradually and involve merchandise, cash, inventory records, point-of-sale systems, returns, discounts or other transactions that appear legitimate on the surface.

By the time a company recognizes that something is wrong, significant losses may already have occurred.

Inventory shrinkage is often one of the first warning signs. A company may discover that its physical inventory does not match its accounting or point-of-sale records. High-value merchandise may be missing, yet there is no corresponding sale. Cash deposits may not appear consistent with the number of products leaving the business. In other situations, discrepancies may repeatedly occur during particular shifts or when specific employees are responsible for handling merchandise and sales.

It is important, however, to recognize that inventory shrinkage does not automatically mean that an employee has stolen from the company. Inventory discrepancies can result from damaged goods, administrative errors, receiving problems, incorrect pricing, accounting mistakes, customer theft, shipping discrepancies or other causes. A professional investigation should therefore begin by determining what the records actually show rather than assuming that a particular employee is responsible.

When Inventory Shrinkage Becomes an Investigative Concern

Consider a retailer that sells high-value merchandise. Management conducts an inventory count and discovers that several expensive items are missing. The company's point-of-sale records do not show corresponding sales for those products. After reviewing the available information, management notices that several of the discrepancies occurred during shifts worked by the same employee.

This information may provide reasonable grounds for further investigation, but it is not necessarily proof of employee theft.

Managers should begin by examining the circumstances surrounding the missing inventory. This can include reviewing inventory records, point-of-sale information, cash reconciliation, employee schedules, product pricing, returns, damaged merchandise records and other documentation. Existing security footage or access information may also help establish when merchandise was present and when it disappeared.

The objective is to establish a factual picture of what is happening. The investigation should seek to answer questions such as whether merchandise is leaving the business without being properly recorded, whether customers are actually paying for the merchandise, whether those transactions are being entered into the company's systems and whether the money associated with those sales is ultimately reaching the business.

When these pieces of information begin to connect, an otherwise unexplained inventory shortage can become a much more significant investigative issue.

When an Undercover Operation May Be Appropriate

In some employee theft investigations, reviewing records and conducting traditional surveillance may not be enough to determine what is happening at the point of sale. If the suspected conduct involves an employee selling company merchandise for cash without properly recording the transaction, an appropriately planned undercover operation may provide an opportunity to document the transaction directly.

An undercover operation in this context is not about manufacturing evidence or encouraging an employee to commit an offence. The purpose is to observe and document conduct that is already reasonably suspected, within the authority provided for the investigation and in accordance with applicable law and professional investigative practices.

For example, suppose a company has reason to believe that an employee is selling high-value merchandise to customers for cash but failing to process the sales through the company's authorized point-of-sale system. The company may engage a private investigator to conduct an authorized undercover purchase.

The investigator may attend the business in the role of an ordinary customer and purchase merchandise under circumstances established in advance with the client. The investigator carefully documents what occurs during the transaction, including the merchandise involved, the amount paid, whether a receipt is issued, whether the sale is entered into the company's system and what happens to the payment.

The significance of the operation is not simply that an investigator purchased an item. The important issue is what happens to the transaction afterward.

If a $2,000 item is sold, the investigator pays $2,000, the employee does not enter the transaction into the point-of-sale system and the company subsequently has no record of the sale, the investigator has potentially documented an important piece of evidence. That evidence can then be compared with the company's inventory and financial records.

Connecting the Merchandise, Sale and Cash

One of the most important aspects of an employee theft investigation is corroboration. A single observation may raise questions, but multiple independent pieces of information can provide a much clearer understanding of what occurred.

For example, an investigation might establish that a particular high-value product was present in inventory before a transaction. An undercover investigator then purchases that product from the employee. The employee receives cash but does not process the sale through the company's point-of-sale system. The company's records subsequently show no corresponding sale or deposit.

The investigation can then connect several separate facts: the merchandise belonged to the company, the merchandise was provided to a customer, money was received, the transaction was not properly recorded and the company's records do not account for the merchandise or the payment.

High-Value Merchandise Can Create Significant Losses

Employee theft involving high-value merchandise can be particularly damaging because a relatively small number of unauthorized transactions may result in substantial financial losses.

A business selling electronics, jewelry, specialized equipment, luxury goods, building materials, automotive products or other expensive merchandise may experience significant losses even if only a handful of products disappear.

In some circumstances, an employee may understand that the company's inventory controls are based on periodic counts and that individual discrepancies may not immediately be noticed. If the merchandise is sold for cash and the transaction is not properly entered into the company's system, the loss can potentially remain hidden until an inventory reconciliation identifies the shortage.

For this reason, businesses should pay attention not only to the total amount of inventory shrinkage but also to patterns within the data.

If missing products repeatedly involve high-value items, particular shifts, specific locations, certain employees or unusual cash discrepancies, those patterns may warrant further investigation.

The Importance of a Pattern

A professional investigation does not necessarily depend upon one dramatic incident. In many employee theft cases, the evidence develops through a series of smaller observations that, when considered together, reveal a pattern.

For example, a company may initially discover that one expensive product is missing. A second inventory count identifies another discrepancy. A review of the records shows that both products were handled during shifts worked by the same employee.

Additional records reveal that the products were not processed through the normal sales system.

At that point, the company may have a much stronger reason to determine whether the discrepancies are coincidental or whether there is an identifiable pattern of unauthorized activity.

An undercover operation may then be used, where appropriate, to determine whether the suspected conduct can be independently documented. The purpose of the investigation is to conduct an undercover operation posing as an employee to provide evidence to our client, if they have a suspect.

What an Investigator May Examine

An employee theft investigation may involve considerably more than surveillance alone. Depending upon the circumstances, an investigator may review information supplied by the client concerning inventory counts, point-of-sale transactions, cash reconciliation, employee schedules, product records, internal policies, security footage and other relevant documentation.

Surveillance can then be used to place those records into context.

For example, a company may know that three high-value products disappeared during a particular period. Records may show which employees were working. Surveillance or an appropriately authorized undercover operation may then document conduct involving one of those products.

The evidence can subsequently be compared against the company's records.

This combination of documentary evidence and investigative observations can be particularly valuable because it allows the investigator to distinguish between what was reported by the company and what was independently observed during the investigation.

Investigations Should Be Carefully Planned

Undercover investigations involving employees require careful planning. Before an operation begins, the investigator and client should establish the investigative objective, the information already known, the evidence that needs to be obtained and the parameters of the assignment.

The investigator should also understand the company's policies and procedures surrounding sales, cash handling, inventory control and employee responsibilities. This helps ensure that the investigation is designed around the actual conduct the company is concerned about.

The goal is to observe and document events without improperly influencing the employee or creating circumstances that would not otherwise occur.

We also consider safety, privacy, applicable legislation, professional standards and the preservation of evidence. Where there are questions concerning employment law, privacy obligations or the potential use of investigative evidence in disciplinary or legal proceedings, the client should obtain appropriate legal advice.

What Happens After Evidence Is Obtained?

Once an investigation is complete, the evidence will be organized into a clear investigative report along with the physical evidence.

Where an undercover transaction has occurred, the report will document the circumstances of the transaction and identify relevant supporting information. Photographs, video, receipts, transaction information, notes, the undercover purchase and other documentation may form part of the investigative file.

The client and, where appropriate, legal counsel can then determine what action should be considered based upon the evidence.

An Investigation Can Also Exonerate an Employee

It is equally important to recognize that an investigation does not always confirm the employer's initial suspicion.

A company may believe that an employee is responsible for inventory losses only to discover that the actual problem involves receiving errors, accounting discrepancies, incorrect inventory counts, customer theft or weaknesses in internal controls.

A properly conducted investigation should therefore remain objective.

If the evidence does not support the allegation, that finding is also valuable to the client. It can prevent an employee from being wrongly accused and may allow the company to identify the actual source of the financial loss.

When Should a Business Consider Hiring a Private Investigator?

Businesses should consider obtaining professional investigative assistance when inventory discrepancies become unexplained, particularly when there are additional indicators suggesting that merchandise or cash may be leaving the business without proper authorization.

An investigation may be appropriate when high-value products repeatedly disappear, when point-of-sale records do not correspond with inventory, when cash deposits appear inconsistent with sales, when discrepancies appear concentrated around particular shifts or employees, or when management needs independent evidence before making an important employment or legal decision.

The earlier a company identifies a potential problem, the more opportunity it may have to preserve records and determine what is actually occurring.

Duncan Investigations: Evidence-Based Employee Theft Investigations

Employee theft can have a significant financial impact on a business, but allegations should be supported by evidence. Inventory shrinkage may be the warning sign that something is wrong, but a professional investigation can help determine whether the problem is theft, an internal control issue or another unexplained discrepancy.

At Duncan Investigations, surveillance and undercover investigative operations are approached as evidence-gathering assignments. Our role is to document observable facts, corroborate information wherever possible and provide clients with professional investigative reporting that can be reviewed with legal counsel and other appropriate decision-makers.

When a business suspects that an employee may be selling company merchandise for cash without properly recording the transaction, an appropriately planned undercover investigation may provide an important opportunity to document what is actually happening.

For businesses dealing with unexplained inventory shrinkage, employee theft concerns or suspected unauthorized sales, the first step is to speak with a professional investigator about the circumstances before making assumptions about what has occurred.

Duncan Investigations Inc.

AWARDS, ACCREDITATION AND INDUSTRY RECOGNITION

Duncan Investigations Inc. has been recognized for its investigative services and business leadership in Canada and internationally.

•  Awarded as the Best Private Investigation Business in Canada for six consecutive years by the Canadian Business Review Board (2021 to 2026).

•  Selected as the Best Private Investigation Firm in 2026 by Best of Best Reviews.

•  Industry accredited with an A+ Better Business Bureau rating.

•  Duncan Investigations Inc. has been awarded the 2026 Specialty Services Awards by Top 100, a global initiative recognizing excellence in over 100 countries. View the 2026 Specialty Services Award.

•  Duncan Investigations Inc. is a 2026 Trusted Business Awards Winner. Verify the 2026 Trusted Business Award.

•  Duncan Investigations Inc., a Canadian Firm with over 35 years of Experience — USA News. Read the USA News feature.

•  Janie A. Duncan, Founder of Duncan Investigations Inc., is recognized among the Top 10 Visionary Women Entrepreneurs to Follow in 2026. Read the feature on MSN.

DUNCAN INVESTIGATIONS INC.

36+ Years of Investigative Experience

Corporate Intelligence | Due Diligence | OSINT | Investigations