How Small Businesses Can Prevent, Detect and Respond to Employee Theft

Employee theft is one of those issues many owners hope will never come up, until stock starts disappearing, refunds look odd, or cash takings stop matching the till. Small businesses are especially exposed because the same trusted person often handles sales, stock, banking and records. Common mistakes include relying on trust instead of systems, checking too late when something feels off, and reacting in the heat of the moment without following a fair process.

The right response is not just about catching wrongdoing. It is about reducing the chance of theft happening, spotting warning signs early, and dealing with suspicions in a way that protects your business without creating a second problem in the form of an unfair disciplinary process, privacy breach, or weak evidence. This guide explains how small businesses in New Zealand can prevent, detect and respond to employee theft, what your employment documents should say, and where founders often get caught before they sign contracts or make disciplinary decisions.

Overview

Small businesses can reduce employee theft risk with clear rules, simple controls, good records and a fair response plan. In New Zealand, the legal challenge is usually not just proving what happened, but showing that you investigated properly, respected privacy obligations, and followed a justified disciplinary process before taking action.

• Use written employment terms and workplace policies that clearly cover theft, dishonesty, expenses, stock handling, cash management and investigations.
• Separate key tasks where possible, such as taking payments, issuing refunds, approving expenses and reconciling accounts.
• Keep reliable records, including stock counts, till reports, refund logs, access records and approval trails.
• Use monitoring tools carefully, with a lawful purpose and privacy transparency, especially for cameras, device monitoring and access logs.
• Investigate suspicions promptly but fairly, without jumping straight to dismissal or public accusations.
• Get legal advice before suspending, conducting a formal disciplinary meeting, or dismissing for serious misconduct.

What How Small Businesses Can Prevent Detect and Respond to Employee Theft Means For New Zealand Businesses

For New Zealand businesses, preventing and responding to employee theft means building practical controls into day to day operations and making sure any investigation or disciplinary action is fair, documented and legally defensible.

Employee theft can take many forms. It is not limited to cash from the till. In a small business, it may involve unauthorised discounts, fake refunds, stock taken for personal use, misuse of company cards, payroll manipulation, inflated timesheets, theft of confidential information, or using business assets for side work.

The employment law issue often starts after the owner discovers something suspicious. Even where the concern looks obvious, you still need to act as a fair and reasonable employer. That means gathering facts, putting allegations properly to the employee, giving them a genuine chance to respond, and keeping an open mind before deciding the outcome.

Prevention starts with systems, not suspicion

The best protection is to make theft harder and easier to detect. Most small businesses do not have large compliance teams, so the goal is simple controls that fit your size.

Think about the points in your business where one person has too much unchecked control. This is where founders often get caught, especially when a long serving employee handles multiple functions without review.

• One person taking cash, reconciling the till and preparing the bank deposit.
• One person ordering stock, receiving deliveries and updating inventory records.
• One person approving their own expenses or refunds.
• Shared passwords for point of sale, payroll or banking systems.
• No audit trail for discounts, voided sales or stock write offs.

You may not be able to separate every role in a small team, but you can introduce checks. A second sign off, a daily report review, weekly stock spot checks, and individual logins can make a big difference.

Written documents matter more than most owners expect

If you want to enforce standards later, your documents should say what those standards are. Before you hire your first worker, and again before you sign a new employment agreement, make sure your paperwork covers the basics.

Your employment agreements and workplace policies should deal with:

• dishonesty and serious misconduct
• cash handling and reconciliation procedures
• stock control and property use
• expenses, purchasing authority and approval limits
• use of company devices, email and systems
• confidential information and customer data
• investigation processes, including who may review records
• when suspension may be considered during a disciplinary process

Policies are not a substitute for a fair process, but they make expectations clearer and can strengthen your position if something goes wrong.

Privacy law also matters when you monitor staff

Many theft investigations involve CCTV footage, till records, swipe card data, email checks or device reviews. In New Zealand, employee information is still personal information. The Privacy Act 2020 matters whenever you collect, use or disclose that information.

That does not mean you cannot monitor workplace systems. It means you should have a lawful and work related reason, be transparent where appropriate, and avoid collecting more than you need.

For example, if you use cameras in a storeroom or till area, staff should generally know cameras are in use and why. Secret surveillance can create serious problems unless there is a very specific basis and you have taken advice first. The same goes for checking an employee's work email, messages on a company device, or access logs. A clear privacy notice or workplace policy helps, but the way you collect and use information still needs to be reasonable.

Detection is about patterns and records

Most businesses do not uncover theft through a dramatic confession. They notice patterns first. A useful detection process focuses on exceptions and trends, not just isolated incidents.

• Frequent refunds processed by the same person.
• Voided sales near closing time.
• Stock losses concentrated in one category or shift.
• Expense claims without receipts or with repeated unusual suppliers.
• Payroll changes made without approval.
• Unusual after hours access to systems, premises or records.

A founder's instinct can be useful, but suspicion alone is not enough. You need records that can be checked and, if necessary, relied on later in a disciplinary process.

Response needs to be fast, but still fair

When you suspect theft, speed matters because records can be lost and trust can break down quickly. Fairness still matters just as much. If you move straight to accusations, search a worker's belongings without basis, or dismiss on the spot, the business can face a personal grievance even where misconduct did occur.

A better approach is to secure relevant evidence, limit further risk, decide who will manage the process, and get advice before formal steps are taken. In serious cases, suspension may be appropriate, but it should not be automatic. You normally need to consider whether suspension is authorised by the employment agreement, whether there are alternatives, and whether the employee should be heard before a final decision on suspension is made.

Legal Issues To Check Before You Sign

Before you sign employment agreements, policy documents, investigation letters or disciplinary outcomes, make sure the legal framework around theft prevention and response actually works for your business.

Employment agreement terms

Your employment agreements should not just repeat generic misconduct wording. They should support the way your business actually operates. That is especially important where workers handle money, stock, sensitive information or customer accounts.

Key terms to review include:

• clear duties and authority limits
• serious misconduct wording that captures theft, dishonesty and deliberate misuse of property or data
• suspension clauses
• requirements to follow lawful and reasonable workplace policies
• confidentiality obligations
• return of company property and access credentials
• permission to deduct wages only where lawful and properly authorised, noting that deductions are tightly regulated

A weak agreement does not stop you from managing misconduct, but it can make the process harder and less predictable.

Workplace policies and procedures

Policies are where you set the practical rules. They should match the real risks in your business rather than read like generic office documents copied from another industry.

If you run retail, hospitality, trades, logistics or health related services, your policy set may need different controls. A hospitality venue may focus on till balancing, refunds, stock movements and tabs. A trades business may need stronger rules on fuel cards, tools, materials and purchase approvals. An online business may need closer controls around payment gateways, customer credits and data access.

Useful policies often include:

• cash handling and banking procedures
• stock control and wastage reporting
• expense and procurement approval rules
• IT and device use
• privacy and surveillance notices
• disciplinary and investigation procedures
• whistleblowing or internal reporting options

Privacy notices and monitoring practices

Before you accept the provider's standard terms for CCTV, GPS, point of sale software or device monitoring, check what information is being collected, where it is stored, who can access it and how long it is kept. This is not just a technical issue. It affects your ability to use the data fairly and lawfully in an investigation.

Ask practical questions such as:

• Does the system create a reliable audit trail?
• Can access to footage or logs be restricted?
• Are staff told what monitoring happens?
• Is the data stored securely?
• Can you retrieve records quickly if a concern arises?

If monitoring is poorly explained or badly managed, the evidence may still be useful, but the privacy risk goes up.

Investigation and disciplinary process

Your process should be capable of standing up if challenged. In New Zealand, the legal test usually focuses on what a fair and reasonable employer could have done in the circumstances at the time.

That usually means:

• identifying the concerns clearly
• gathering relevant evidence before making accusations
• inviting the employee to a meeting with enough information to understand the allegations
• allowing a support person or representative where appropriate
• genuinely considering the employee's explanation
• investigating further if new issues arise
• deciding the outcome only after that process is complete

Where the allegation is serious misconduct, the stakes are high. Summary dismissal may be possible in some cases, but only after a justified process. Even strong evidence can be undermined by a rushed decision.

What about reporting to Police?

Some theft matters may justify a report to Police, especially where there is significant loss, fraud, deliberate data misuse or ongoing risk. That decision is separate from the employment process. Reporting a matter does not remove your obligation to act fairly as an employer.

You should also take care with what is said internally and externally. Public accusations, group messages about suspected theft, or comments to customers and suppliers can create defamation and privacy concerns. Keep communications limited to people who genuinely need to know.

Common Mistakes With How Small Businesses Can Prevent Detect and Respond to Employee Theft

The most common mistakes are not subtle. Owners either ignore weak controls for too long, or they overreact once they suspect theft and create new legal risks.

Relying on trust instead of controls

Trust matters, but trust is not a control system. Long serving staff and family like workplaces are often where owners feel least comfortable introducing checks. Unfortunately, that is also where gaps can remain hidden for years.

Simple controls are not a sign that you distrust your team. They are a normal business safeguard.

Using vague or outdated documents

Founders often discover too late that their employment agreements say little about serious misconduct, suspension, device use or workplace monitoring. Policies may exist, but no one has seen them since onboarding.

If your business has changed, your documents should be updated too. A business that now uses cloud systems, remote access, mobile devices or customer databases needs documents that reflect those realities.

Investigating informally and off the record

A quick chat in the storeroom is not a proper investigation. Nor is asking for a resignation before the allegations are explained. Informal handling can lead to missing evidence, inconsistent treatment and disputes about what was said.

Once a concern looks serious, move to a documented process. Keep notes, preserve records and decide who is responsible for each step.

Dismissing too quickly

This is one of the biggest legal traps. Even where you feel certain, the employee still needs a fair chance to respond. Instant dismissal, taking keys and telling them not to come back, or announcing to others that they have stolen can all cause trouble if the process was not justified.

Serious misconduct can justify dismissal, but the process still matters.

Ignoring privacy issues

Checking a worker's bag, searching a phone, reading private messages or installing hidden surveillance can create serious privacy concerns. The fact that you own the premises or device does not give unlimited rights.

The main risk is using intrusive methods without a clear legal and factual basis. Take advice before using unusual or high risk monitoring steps.

Forgetting the business clean up after the investigation

Once the immediate issue is dealt with, many owners want to move on. That is understandable, but it can leave the business exposed to repeat problems.

After any confirmed or suspected theft issue, review:

• who had access to cash, stock, systems or data
• whether passwords, permissions or locks need changing
• whether insurers need to be notified
• whether internal delegations and approval levels are still sensible
• whether staff training and policies need updating
• whether the same issue could happen again through a different person or process

That review is often where the real prevention work happens.

FAQs

Can I dismiss an employee immediately if I have CCTV of theft?

Not automatically. CCTV may be strong evidence, but you still usually need to follow a fair disciplinary process, explain the allegations, provide relevant information and give the employee a chance to respond before making a final decision.

Can I suspend an employee while I investigate?

Sometimes, yes. Suspension should usually be authorised by the employment agreement or otherwise justified by the circumstances. You should consider whether it is necessary, whether alternatives exist, and whether the employee should first have a chance to comment.

Can I check an employee's work email or company phone?

Often you can for legitimate business reasons, especially where the device or account is company provided and your policies are clear. Even then, privacy obligations still apply, so the review should be proportionate and connected to a genuine workplace issue.

Should I report employee theft to Police?

That depends on the seriousness, the evidence and the commercial impact. Some matters are better handled as employment issues first, while others justify immediate external reporting. A Police report does not replace the need for a fair employment process.

What if I only have suspicion and no clear proof yet?

Do not jump straight to accusations. Secure records, review audit trails, limit further risk where appropriate, and investigate carefully. Weak evidence and a rushed process can create more problems than the original suspicion.

Key Takeaways

• Employee theft risk is best managed through practical controls, clear employment documents and consistent record keeping.
• In New Zealand, a fair and reasonable investigation and disciplinary process is essential, even where misconduct appears obvious.
• Employment agreements and policies should clearly cover dishonesty, serious misconduct, monitoring, confidentiality, expenses, stock and cash handling.
• Privacy obligations matter when using CCTV, device checks, access logs and other monitoring tools.
• Small businesses should act quickly to preserve evidence and reduce risk, but should avoid snap accusations, public comments or instant dismissal without process.
• After any incident, review your systems, access controls, documents and training so the same gap does not stay open.

If you want help with employment agreements, workplace policies, privacy notices and monitoring issues, or disciplinary process steps, you can reach us on 0800 002 184 or team@sprintlaw.co.nz for a free, no-obligations chat.