Employee Theft Policy: Prosecute or Terminate?

By awareretailgroup.com Editorial· Edited by Tom Walsh· Published 2026-11-02

When a stockroom associate is caught walking out with a case of energy drinks, an employee theft policy tells every store manager whether to discharge, pursue restitution, or refer the case to police. Discharge is the default. Restitution with reassignment away from cash applies only to a small first offense, fully admitted, by an employee past the first year. Referral is reserved for losses at or above a set threshold, collusion, or a manager-level perpetrator. A standing committee decides that, not the store manager.

Why consistency matters more than the severity of any single case

The EEOC’s compliance manual on discharge and discipline tells investigators to test a theft discharge against how the employer treated comparable employees. Comparators are usually employees “charged with misconduct identical or similar in kind or magnitude” to the person who filed a charge (EEOC), and investigators weigh comparison evidence from “within the past 3 years” (EEOC) more heavily than older cases. Wells’s Corporate Fraud Handbook separates fraud from abuse by intent, not dollar size: “each offense requires a dishonest intent on the part of the employee to victimize the company” (Corporate Fraud Handbook, Fourth Edition) (p. 22). Because intent, not dollar size, is what makes conduct internal theft, a small loss still belongs in the matrix; the amount sets the tier, not whether the policy applies. As a general rule, the EEOC says, an employer may discharge or discipline for any reason, provided the decision rests on something other than a discriminatory motive or an acknowledged policy with an adverse impact on the employee’s Title VII class (EEOC). A store that fires one employee for a small register theft and keeps another on staff after a similar one has handed an investigator exactly the comparison the manual asks for, and that gap can become the evidence an investigator relies on if the two employees differ by race, sex or another protected class.

What the data says about how theft cases actually end

A policy that assumes every theft case ends in a police referral does not match how cases actually close. The ACFE’s 2026 Report to the Nations, which examined 2,402 occupational fraud cases across 143 countries (ACFE), found that 68% of fraudsters were terminated (ACFE), and separately, that 54% of cases were referred to law enforcement (ACFE). These figures come from CFE-investigated occupational fraud cases with a median loss of $104,000 (ACFE), so they describe large frauds more than store-level merchandise theft. In the 2024 edition, organizations that did not refer cases most often said internal discipline was sufficient punishment (49%), followed by fear of bad publicity (34%) and private settlements (24%) (ACFE 2024 Report to the Nations). The referral decision belongs with the committee, on written criteria, so it is not left to whoever closes the case.

How tenure changes the stakes

Longer tenure can bring more access, and ACFE’s 2024 data shows median losses climbing with time on the job: $50,000 for perpetrators with less than a year of tenure, $100,000 for those with one to five years, $200,000 for those with 6 to 10 years, and $250,000 for those with more than 10 years (ACFE 2024 Report to the Nations). A trusted ten-year employee can have a longer run before anyone checks the pattern. The decision matrix in the next section lets tenure widen the options only for the smallest first offense, and tenure never moves a case to a lower tier or stands in for evidence of good intent. Why do good employees steal? covers the opportunity side of that trust.

How do we decide between firing, restitution, and prosecution so every store handles theft the same way?

A written matrix should set the outcome. Build it on two axes: a case tier the company sets based on conduct and loss, and a tenure band matched to ACFE’s published groups so the company can compare its own outcomes against them. Discharge is the default for every tier and every tenure band. Restitution paired with reassignment to a role with no cash handling and no high-shrink access is available only in the smallest tier, for a first offense with a full admission by an employee past the first year. Tenure opens that option because a proven employee is costly to replace: Hamblett & Kerrigan, a New Hampshire law firm, lists “the cost of replacement of that employee” among the factors an employer should weigh before firing (Hamblett & Kerrigan). The Handbook of Loss Prevention and Crime Prevention notes that “if reinstatement is to a position not vulnerable to theft, the message may get across” (Handbook of Loss Prevention and Crime Prevention, Fourth Edition) (p. 74).

A single incident without a full admission goes to Tier 2, and a case that fits more than one tier takes the higher one.

No outcome below discharge is a store manager’s call. A standing committee of the LP or AP director, HR, and counsel signs every restitution, reassignment, or referral decision and logs it. The committee sets the outcome, including whether restitution applies, before restitution is ever put to the employee, and that separation exists so repayment is never tied to a decision not to prosecute. Have counsel review the matrix state by state before rollout, and see what legal rights apply during an employee theft investigation for the rules that govern the interview itself.

Keeping restitution and prosecution on separate tracks

In New York, compounding covers anyone who solicits, accepts or agrees to accept a benefit upon an agreement or understanding to refrain from initiating a prosecution, and anyone who confers, offers or agrees to confer one on that basis. Compounding a crime is a Class A misdemeanor in Kentucky (Kentucky Revised Statutes 519.030). New York and Kentucky both allow a defense, an affirmative one in New York, when the benefit did not exceed an amount the defendant reasonably believed was due as restitution or indemnification for harm caused by the crime or offense (New York Penal Law 215.45; Kentucky Revised Statutes 519.030). A defense is argued after a charge is filed; it is no reason to raise repayment and prosecution in the same conversation. California’s statute reaches “every person who, having knowledge of the actual commission of a crime, takes money or property of another, or any gratuity or reward, or any engagement, or promise thereof, upon any agreement or understanding to compound or conceal that crime, or to abstain from any prosecution thereof, or to withhold any evidence thereof, except in the cases provided for by law, in which crimes may be compromised by leave of court” (California Penal Code 153). In Florida, a person who proves by clear and convincing evidence an injury from a theft or exploitation violation has a cause of action for threefold actual damages, a $200 minimum, and reasonable attorney’s fees and court costs, after first making a written demand for $200 or the treble damage amount (Florida Statutes 772.11). A person who complies within 30 days must get a written release from further civil liability for that specific act (Florida Statutes 772.11), which is why a civil demand can run as its own track, apart from any referral decision. In Texas, a civil theft suit cuts both ways: each person who prevails in a suit under that chapter is awarded court costs and reasonable and necessary attorney’s fees (Texas Civil Practice and Remedies Code 134.005).

Communication after a case closes, and union-store rules

Communicate a closed case only to people who need to act on it: the committee, HR, and the store’s chain of command. Brief associates on the policy itself, never on the person it was applied to.

Union stores carry an extra rule. The NLRB recognizes a right, on request, for an employee to have a representative present during an interview the employee reasonably believes could lead to discipline (NLRB), though under current Board law that right belongs only to union-represented employees, and the NLRB’s Weingarten page, posted by the General Counsel’s office, says the General Counsel has asked the Board to return to its earlier rule covering all employees (NLRB). A meeting held only to announce a decision that was already made falls outside that right (NLRB), which is one more reason to hold the fact-finding interview and the disposition meeting on separate days.

Building the 3-year outcome log

A matrix only proves consistency if someone checks it against itself over time. The outcome log should cover the same window the comparator check above uses, and get reviewed by district every quarter. Hollinger and Clark’s NIJ-funded research, based on 9,175 employee survey responses from retail chains, hospitals and manufacturers, found that theft and counterproductive behavior “can be minimized through a conspicuous and consistent climate of management control” from all relevant departments (Hollinger and Clark). An outcome log is how a chain proves that climate exists past a single store.

• Log tier, tenure band, conduct type, and loss amount for every closed case
• Record admission (yes/no), outcome, and restitution amount and channel
• Note the referral decision and the committee’s stated reason
• Name the decision-maker for every non-discharge outcome
• Review the log by store and district every quarter for unexplained gaps