Employee theft and inventory shrinkage investigations are structured inquiries that identify where a business is losing product, cash, or data from the inside, and that document it in a way that stands up to scrutiny from HR, legal, and, when needed, the courts. Shrinkage is a familiar number on a profit-and-loss statement, but the cause behind it is often anything but obvious.

Owners tend to assume missing inventory means shoplifting. Sometimes it does. Often, though, a meaningful share of loss comes from within, through theft of product, manipulation of returns or discounts, cash skimming, or collusion with outside parties. Sorting out which is which, without accusing an innocent employee or scaring off a guilty one, is precisely the work a professional investigation is built to do.

What actually counts as shrinkage?

Shrinkage is the gap between the inventory a business should have on its books and what it actually has on the shelf. It bundles together several causes: external theft, internal theft, administrative and paperwork errors, and vendor or supply-chain loss. Treating all of it as shoplifting leads companies to spend on the wrong defenses.

The financial stakes are substantial. The National Retail Federation reported that shrink represented an estimated 112.1 billion dollars in losses across the retail industry in 2022, an average shrink rate of about 1.6 percent of sales (NRF, 2023). Internal theft has long been recognized as one of the leading contributors to that total, which is why an accurate diagnosis matters before a dollar is spent on cameras or locks.

How do you tell internal theft from other losses?

The first step is analysis, not accusation. Patterns in the data usually point the way before anyone watches a single minute of video. Investigators look at when and where loss concentrates, which registers or shifts recur in the anomalies, how voids, refunds, and discounts cluster, and whether specific product categories disappear faster than foot traffic would explain.

From there, discreet documentation follows the leads. This is where the role surveillance plays in building a case becomes central, because observation, whether of a sales floor, a stockroom, or a loading dock, turns a statistical suspicion into a factual record. The goal is a clear, corroborated account of what is happening, gathered in a way that does not alert the subject or contaminate the evidence.

Why not just confront the employee?

When an owner is fairly sure who is responsible, the temptation to sit the person down and demand answers is strong. It is also one of the most common ways a solid case falls apart. A premature confrontation tips off the subject, invites the destruction of evidence, and can expose the business to claims of wrongful accusation, defamation, or an improper investigation.

There is a reason why handling an internal case alone often backfires, and it usually comes down to sequence and standards. A professional inquiry gathers the facts first, follows lawful methods, and preserves a defensible record, so that when the conversation finally happens, it rests on evidence rather than a hunch. In our 30 years of investigative work, the cases that end cleanly are almost always the ones where the business resisted the urge to act too soon.

What makes the evidence defensible?

Evidence is only as useful as it is admissible and credible. A defensible internal-theft case generally shares a few traits: it is built through lawful methods that respect employee rights and privacy law, it maintains a clear chain of custody for physical and digital items, it documents observations objectively and contemporaneously, and it is organized so that HR and counsel can act on it with confidence. Investigators who work regularly alongside employment counsel understand that the standard is not simply catching someone. It is producing a record that survives challenge.

Frequently asked questions

Is most inventory loss caused by shoplifting or employees? It varies by business, but internal theft is consistently one of the largest categories of shrinkage, alongside external theft and administrative error. That is why a proper investigation starts by diagnosing the source rather than assuming shoplifting.

Can an investigation be done without alerting the suspected employee? Yes, and discretion is often essential to the outcome. Professional inquiries are designed to gather facts quietly, so the subject does not change behavior, destroy evidence, or claim they were unfairly targeted before the picture is complete.

What kinds of evidence hold up if we need to act? Evidence gathered through lawful methods, documented objectively, and preserved with a clear chain of custody carries the most weight. This can include transaction analysis, surveillance records, and corroborating documentation, organized so HR and legal counsel can rely on it.

Should we involve law enforcement or an attorney? It depends on the case, but coordinating with employment counsel early is wise, and serious cases may ultimately involve law enforcement. A professional investigator can build the record in a way that keeps both options open without prejudicing them.

How long does an internal theft investigation take? There is no fixed timeline, because it depends on the complexity of the scheme, the volume of data, and how much discreet observation is required. A focused inquiry aims to reach a defensible conclusion efficiently rather than drag on indefinitely.

Protect your business the right way

If your numbers are telling you something is wrong and you need to know whether the loss is coming from inside, the safest first move is a professional, discreet investigation rather than a confrontation. To discuss your situation in confidence, contact National Business Investigations.

About the author

Michael D. Julian brings more than 30 years of experience in investigations, security, and protection. He served as President of the California Association of Licensed Investigators (CALI) from 2005 to 2015 and has spent his career helping businesses uncover the facts and make sound decisions based on defensible evidence. Connect with him on LinkedIn.