Employee Theft in the Workplace: When Should a Business Hire an Investigator?

Missing stock, equipment or cash can quickly create suspicion within a business. The difficulty is that identifying a loss is often much easier than proving who was responsible for it.

A warehouse may have dozens of employees with access to the same stock. Several members of staff might share keys to a storeroom. Cash may pass through different tills and managers before it is reconciled. Tools and equipment may move between vehicles, sites and employees throughout the working day. In these circumstances, discovering a shortage does not necessarily identify the person responsible.

This is where an employee theft investigation needs to be approached carefully. Acting too slowly could allow losses to continue, but accusing an employee without adequate evidence can create serious employment, reputational and legal problems.

Figures from the Home Office’s latest detailed Commercial Victimisation Survey showed that theft by an employee was reported by approximately 1% of business premises surveyed in England and Wales. Across businesses that experienced theft more generally, 69% described its financial impact as moderate or severe.^[1]

At SPS Investigations, we provide corporate investigation services to businesses across London and the Home Counties. Where an employer has reasonable concerns about internal theft but insufficient evidence to determine what has happened, we can help establish relevant facts through carefully scoped and lawful investigative work.

What counts as employee theft in the workplace?

Under the Theft Act 1968, a person commits theft where they dishonestly appropriate property belonging to another with the intention of permanently depriving the other of it.^[2] In an employment setting, the circumstances can vary considerably.

Workplace theft could potentially involve:

• Taking stock, products or materials from business premises without authority.
• Removing tools, laptops, phones or other company equipment.
• Taking cash from tills, safes, petty cash or customer payments.
• Diverting deliveries or company property for personal use or resale.
• Using company materials or stock for unauthorised private work.
• Removing physical documents or files belonging to the business.

There is an important distinction where confidential information is concerned. Confidential information itself is not automatically “property” capable of being stolen under the Theft Act. Unauthorised access to, copying or misuse of digital information can instead raise issues under other laws, including the Computer Misuse Act 1990, data protection legislation, contractual duties and the law of confidence.^[3]

A business dealing with missing confidential information should therefore avoid assuming that the matter is legally identical to somebody physically stealing stock or equipment. A solicitor or specialist adviser may need to assess the precise circumstances.

Why can internal theft be difficult to prove?

One of the biggest difficulties with workplace theft is shared access.

Imagine that £8,000 worth of specialist components has disappeared from a warehouse during a six-week period. Ten employees work in that part of the building. Supervisors, delivery drivers and contractors may also have entered the storage area. CCTV only covers the entrances and stock records are updated manually.

Even if one employee was working every time a discrepancy occurred, that does not prove they stole anything. It establishes an opportunity, not responsibility.

The same issue occurs with missing cash. A till shortage may initially appear suspicious, but several employees may have used the same terminal. There could also have been a refund error, incorrect reconciliation, customer theft, administrative mistake or another explanation that has nothing to do with employee dishonesty.

A useful investigation therefore tries to narrow the gap between loss, opportunity and evidence.

Do not assume every stock loss is employee theft

Stock discrepancies are particularly capable of producing false suspicions.

Businesses can lose inventory because of supplier shortages, picking errors, damaged goods, incorrect stock adjustments, customer theft, mislabelled products, unauthorised discounts, paperwork problems or products being transferred between locations without being recorded correctly.

There may also be innocent explanations for conduct that initially looks suspicious. An employee loading boxes into their vehicle could be stealing them, but they could equally have been authorised to transport the items to another site.

This is why an investigation should be designed to establish what actually happened rather than starting with a predetermined conclusion about a particular employee.

What should a business do when employee theft is suspected?

Before considering surveillance or confronting an employee, a business should usually secure the information it already controls. The objective is to preserve potentially relevant evidence and narrow the suspected activity as far as reasonably possible.

1. Record the loss. Identify exactly what is missing, its value, when it was last confirmed as present and when the discrepancy was discovered.
2. Preserve relevant records. This could include authorised CCTV, stock reports, till records, access logs, delivery paperwork, job sheets, vehicle records and other legitimate business records.
3. Establish who had access. Identify employees, contractors, customers, delivery personnel and others who could realistically have accessed the property.
4. Look for patterns. Consider whether losses repeatedly occur on particular dates, shifts, routes or locations rather than concentrating immediately on one individual.
5. Restrict unnecessary disclosure. Knowledge of the investigation should normally be limited to people who genuinely need to know, particularly where there is a risk that records could be altered or evidence destroyed.
6. Review HR and data protection requirements. Consider company policies, privacy information, disciplinary procedures and whether HR, a data protection adviser or employment solicitor should be involved.

Acas guidance states that workplace investigations should be fair and objective, gather a reasonable amount of information and should not simply set out to prove somebody’s guilt.^[4]

Why should an employer avoid confronting an employee too early?

A premature accusation can make an already difficult situation harder to investigate.

If an employee knows they are suspected before relevant records have been secured, evidence could potentially disappear. Other employees may begin discussing the allegation, witness accounts can become contaminated and workplace rumours may spread.

There is also the possibility that the suspicion is wrong.

Acas advises employers to carry out necessary investigations to establish the facts before disciplinary decisions are made. Employees should normally be informed of the issue and given an opportunity to respond as part of a fair process.^[5]

There can be circumstances where an employee is not immediately told that an investigation has started, particularly if there is a genuine concern about interference with evidence or witnesses. That decision should be made carefully rather than being treated as a default approach.^[4]

When can an employee theft investigation be handled internally?

Hiring an investigator is not necessary every time property goes missing.

An internal investigation may be sufficient where the relevant evidence is already within the company’s control. For example, a discrepancy might be resolved by checking stock movement records, interviewing the people involved and comparing delivery paperwork with an inventory system.

Similarly, if authorised CCTV clearly records what happened inside company premises, there may be little investigative value in conducting surveillance away from the workplace.

An external investigator becomes more useful when the internal evidence identifies a credible concern but leaves an important factual question unanswered.

When should a business hire an investigator for suspected employee theft?

A corporate theft investigator can be particularly valuable when the suspected activity extends beyond what managers can establish through normal workplace records.

Examples include circumstances where:

• Significant or repeated losses have occurred but several employees have access to the property.
• Internal records have narrowed the suspected activity to particular shifts, journeys or individuals without establishing what happens afterwards.
• There is credible information that company stock is being removed and transported elsewhere.
• A business suspects stolen stock or equipment is being offered for sale away from its premises.
• Relevant activity takes place outside the workplace where an internal manager would be easily recognised.
• The company needs independent observations that can be accurately documented and reviewed by HR, solicitors, insurers or the police.
• A senior employee or manager is involved and conducting the investigation internally could create a conflict of interest.

The important point is that the investigator should be given a defined question to answer.

For example, “find out whether any of our employees are stealing” is an excessively broad instruction. By contrast, a business might have documented losses occurring immediately after particular collections and need to establish whether a company vehicle travels to an unauthorised location after leaving a warehouse.

The second scenario creates a much clearer investigative objective and allows the work to be limited to information that is genuinely relevant.

What can a private investigator do in a workplace theft investigation?

The appropriate methods depend on the evidence already available and the circumstances of the suspected theft.

At SPS Investigations, our role is to gather and document relevant facts, not to decide that an employee is guilty before the investigation begins.

Targeted surveillance

Where there is sufficient justification, surveillance from public places or other locations the investigator is lawfully entitled to use may help establish what happens to property after it leaves a workplace.

For example, an investigator might document a relevant vehicle’s movements, an employee visiting a particular location or the transfer of identifiable company property where the activity can lawfully be observed.

Surveillance is most useful when it tests a specific allegation. Following an employee indefinitely in the hope that they eventually do something suspicious would be very different from conducting limited observations at a time and place directly connected to documented stock losses.

Open-source enquiries

Publicly accessible information can sometimes assist an internal theft investigation. Distinctive equipment or products may, for example, appear in public advertisements or on publicly accessible business or marketplace pages.

Any research involving personal information must still be conducted lawfully and proportionately. An investigator cannot hack private accounts, circumvent security settings or unlawfully obtain confidential records.

Factual evidence gathering

Good investigation reports distinguish observation from assumption.

If an investigator observes an employee remove two boxes from a vehicle and carry them into another premises, the report should record that fact. Unless the contents and ownership of those boxes can be established, the report should not simply state that the employee was seen stealing stock.

This distinction can become extremely important if the evidence is later considered by an HR adviser, employment solicitor, insurer, police officer or court.

Can an employer use covert surveillance to investigate workplace theft?

Covert employee monitoring is legally sensitive and should not be treated as a routine management tool.

Current Information Commissioner’s Office guidance states that covert monitoring is unlikely to be justifiable in most ordinary circumstances. It may potentially be justified in exceptional circumstances where it is necessary to prevent or detect suspected criminal activity or equivalent serious misconduct.^[6]

The ICO says covert monitoring should be authorised by senior management, targeted towards the suspected activity, limited to the shortest appropriate period and supported by a data protection impact assessment. Monitoring should not continue once the investigation has achieved its objective.

Workers should not be covertly filmed in areas where they would reasonably expect privacy, such as toilets or changing rooms, and private communications should not normally be captured. Where an employer instructs a private investigator to carry out covert monitoring, the ICO also states that an appropriate contract must require the investigator to collect information consistently with the employer’s data protection obligations.^[6]

Using an external investigator therefore does not allow an employer to bypass UK GDPR or the Data Protection Act 2018.

A theft allegation can itself involve sensitive personal data

Employers should also remember that recording an allegation that a named employee has committed theft can amount to processing criminal offence data, even where the allegation has not been proven.

The ICO confirms that criminal offence data includes personal information relating to suspected offenders and allegations or suspicions of criminal activity.^[7]

This is another reason why investigation files should be restricted to appropriate personnel, handled securely and not circulated casually around a business.

When should suspected employee theft be reported to the police?

A private investigator does not replace the police.

Where a business has evidence suggesting that a criminal theft has occurred, particularly where losses are substantial, offending appears organised or repeated, property may be recoverable or there is an ongoing risk to the business, police involvement should be considered.

The police have statutory powers that a private investigator does not. A private investigator cannot arrest an employee, obtain a search warrant, compel someone to answer questions or seize property simply because the business believes it belongs to them.

Businesses may lawfully be able to provide relevant personal information to the police where doing so is necessary and proportionate. ICO guidance specifically recognises circumstances where an organisation reports suspected criminal conduct and supplies evidence to law enforcement, although the organisation must still consider the appropriate data protection basis and limit disclosure to relevant information.^[8]

Non-emergency crime can be reported to the police online or by calling 101. If a crime is in progress or somebody is in immediate danger, GOV.UK advises calling 999.^[9]

If police involvement is likely, obtaining legal advice early can also help the business avoid inadvertently compromising evidence or interfering with a criminal investigation.

When should insurers be involved?

Businesses with crime, fidelity, stock or other relevant commercial insurance should check their policy as soon as a significant loss is discovered.

The insurer may have requirements concerning notification, preservation of evidence, police reports, loss calculations or the appointment of investigators and loss adjusters. The exact requirements depend on the policy, so businesses should avoid assuming that commissioning an investigation independently will automatically satisfy an insurer’s evidential requirements.

Where the loss is potentially insured, it can be sensible to establish what the insurer requires before substantial investigative expenditure is incurred.

When should HR or an employment solicitor become involved?

An investigator establishes facts. They do not replace the employer’s disciplinary procedure.

HR advice may be particularly useful when decisions are being made about suspension, employee interviews, access to workplace systems, preservation of records and the disciplinary process that could follow.

An employment solicitor should be considered where the allegations are serious, dismissal is a realistic possibility, senior employees are involved, significant personal data is being processed or the company anticipates litigation.

The current Acas Code requires employers to conduct necessary investigations, explain the basis of the issue to the employee and give them an opportunity to respond before disciplinary decisions are made. Employment tribunals can also adjust relevant awards by up to 25% where there has been an unreasonable failure to follow the Code.^[5]

What happens if the investigation finds no evidence of theft?

That is still a useful outcome.

A professional employee theft investigation is not successful only when it proves wrongdoing. It may establish that the original suspicion was unsupported, identify weaknesses in stock controls or reveal an entirely different reason for the loss.

Acas guidance makes clear that an investigation can result in no further action where there is insufficient evidence to continue with disciplinary proceedings.^[4]

That is considerably safer than forcing ambiguous evidence to fit an allegation because management already believes somebody is responsible.

Preventing further theft while an investigation is underway

An employer does not necessarily have to leave existing controls unchanged while enquiries continue.

It may be appropriate to tighten stock reconciliation, restrict access to high-value items, allocate individual till logins, improve key control, review permissions, secure CCTV footage or introduce stronger sign-out procedures for tools and equipment.

Care is needed where changes could alert a suspected employee to a covert investigation, but basic improvements to business controls can often reduce ongoing losses regardless of who was responsible.

It is also worth separating preventative changes from the evidential question. Introducing better stock controls may stop future losses, but it does not retrospectively prove who caused earlier discrepancies.

How SPS Investigations can help with suspected employee theft

At SPS Investigations, we work with businesses and solicitors dealing with situations where there is a genuine concern about employee dishonesty but the available evidence does not yet provide a reliable answer.

We provide corporate investigation services across London and the Home Counties and can assist with carefully targeted surveillance, lawful open-source enquiries and factual evidence gathering where these methods are appropriate to the circumstances.

We have experience providing clear, evidence-driven reports that can be reviewed by company directors, HR professionals, solicitors and other advisers. Our reports focus on what was actually observed and recorded rather than presenting suspicion as fact.

We will not hack private accounts, unlawfully obtain confidential records, trespass or conduct unrestricted monitoring simply to see what can be discovered. An investigation should have a legitimate purpose and its scope should remain necessary and proportionate to that purpose.

If stock, equipment, cash or other company property is disappearing and your internal investigation cannot establish what is happening, get in touch with SPS Investigations for a confidential discussion. We can consider the evidence already available and explain whether an external investigation is likely to add meaningful value.

Frequently Asked Questions

Can an employer investigate an employee for theft?

Yes. An employer can investigate credible concerns about employee theft, but the investigation should be fair, objective and proportionate. Evidence should be gathered before disciplinary conclusions are reached, and the employee should normally have an opportunity to respond to the allegation.

Can a business hire a private investigator to investigate an employee?

Yes. A business may instruct a private investigator where there is a legitimate reason for doing so and the proposed investigation is lawful, necessary and proportionate. Hiring an investigator does not remove the employer’s obligations under employment and data protection law.

What evidence can prove employee theft?

There is no single type of evidence that automatically proves workplace theft. Relevant evidence may include stock records, authorised CCTV, access records, till information, witness evidence, documentation and lawfully obtained surveillance photographs or video. The evidence should be assessed together and the employee’s explanation should also be considered.

Does being the only employee working when stock disappeared prove theft?

No. It may be relevant evidence of opportunity, but it does not necessarily prove that the employee took the stock. The investigation should consider other people with access, record-keeping errors, deliveries, customer theft and other reasonable explanations.

Can an employer secretly follow an employee suspected of stealing?

Covert monitoring may only be justifiable in exceptional circumstances, such as a credible suspicion of criminal activity or serious misconduct. It should be specifically authorised, narrowly targeted, time-limited and assessed under data protection requirements. Employers considering covert surveillance should obtain appropriate professional advice.

Can a private investigator access an employee’s private phone or emails?

No. A private investigator cannot hack an employee’s phone, email account, social media profile or other private accounts. Accessing protected computer systems or obtaining personal information unlawfully can itself breach criminal and data protection legislation.

Should employee theft be reported to the police?

Potentially. Businesses should consider contacting the police where there is evidence of a criminal offence, particularly if theft is ongoing, significant property has been taken or criminal investigation and recovery may be required. Non-emergency crimes can be reported online or through 101.

Can an employee be dismissed for stealing from work?

Theft may amount to gross misconduct, depending on the circumstances and the employer’s policies. However, an employer should still carry out a fair investigation and disciplinary procedure before deciding to dismiss. Suspicion alone should not be treated as proof.

Should an employee be suspended while theft is investigated?

Not automatically. Suspension may be appropriate where there is a genuine risk to evidence, property, colleagues or the investigation, but employers should consider whether it is necessary and whether less restrictive alternatives are available. HR or employment law advice may be appropriate before making the decision.

How long does an employee theft investigation take?

There is no standard timeframe. A straightforward investigation based mainly on existing records may be resolved relatively quickly, while repeated stock losses or surveillance enquiries may require observations over several relevant dates. The investigation should last no longer than reasonably necessary to establish the relevant facts.

Legal position as at August 2026

This article focuses primarily on businesses and employment relationships governed by English law. It provides general information and is not a substitute for advice from an employment solicitor, HR professional, data protection adviser, insurer or the police.

Acas issued updated investigation guidance in June 2026. On 30 July 2026, Acas also opened a consultation on a proposed revised statutory Code of Practice on disciplinary and grievance procedures. The revised Code was still a draft at the end of July 2026 and had not replaced the existing statutory Code.^[10] Businesses should therefore check the latest Acas guidance before commencing formal disciplinary proceedings.