Why Do Good Employees Steal? The Fraud Triangle for Retail Managers

By awareretailgroup.com Editorial· Edited by Tom Walsh· Published 2026-10-24

Why do good employees steal?

Trusted retail employees steal when three conditions line up, a pattern the fraud triangle describes. A shift lead with a clean count record can start shorting the register once she has a bill she cannot mention, a count gap nobody checks, and a story that makes it feel acceptable. The triangle, from Cressey’s research, names those conditions: a perceived non-shareable financial need, a perceived opportunity to resolve it secretly, and a rationalization that makes the act feel justified (Corporate Fraud Handbook (p. 32)).

How much of retail shrink actually comes from employee theft?

Internal employee theft accounted for 29% of shrink loss in the National Retail Federation’s 2023 survey of 177 retail brands representing more than 97,000 locations (NRF), the last National Retail Security Survey of its kind, reporting on 2022 shrink data. Internal and external theft together made up nearly two-thirds, 65%, of everything retailers lost to shrink (NRF). A separate share, 27%, came from process and control failures, with 6% unknown and 1% other causes (NRF). That split matters for where a manager spends attention inside total retail loss. A broken price-check process and a dishonest cashier both land on the same shrink line, but one needs a process fix and the other needs the mechanics below.

Who actually built the fraud triangle, and does it still hold up?

The ACFE’s Fraud 101 page says the fraud triangle “was developed by Dr. Donald Cressey, a criminologist whose research on embezzlers produced the term ‘trust violators’” (ACFE). The National Whistleblower Center credits a different name: Steve Albrecht, who “coined the term” drawing on research from Edwin Sutherland and Cressey (National Whistleblower Center). Accounts of the underlying study also differ. The ACFE’s manual says Cressey interviewed about two hundred inmates at Midwest prisons (ACFE), while a SAGE encyclopedia entry on his work counts 133 male inmates from three named prisons, interviewed for about 15 hours each (SAGE). Either way, the three conditions are the part a store manager can use. PCAOB’s AS 2401 tells auditors that “even otherwise honest individuals can commit fraud in an environment that imposes sufficient pressure on them” (PCAOB), describing three conditions that match the triangle.

What are Cressey’s six non-shareable problems, and how do they show up on the sales floor?

Cressey divided non-shareable problems into six basic subtypes (ACFE). None of the six require a villain going in; the manual calls the typical offender an otherwise law-abiding citizen who crosses the line into illegal conduct for a variety of reasons (ACFE).

A gap that shows up in the count data is the one worth a closer look. The six categories above can help explain why it happened once the count has found it.

Which sides of the fraud triangle can a manager actually move?

Opportunity is the side a manager controls most directly, and perceived detection is part of it: the triangle’s second condition is a perceived opportunity to act secretly. Need and rationalization can move too. Hollinger and Clark’s 1983 survey of 9,175 randomly sampled employees found that a worker who perceives a low certainty of detection is over three and one-half times more likely to steal from an employer (Hollinger & Clark). The finding turns on how certain an employee thinks getting caught is. Visible checks raise that certainty. Rationalization moves too. Among the rationalizations the ACFE’s manual says caught embezzlers repeat is this one: “I was only borrowing. I was going to pay everything back” (ACFE). Inconsistent consequences can let that excuse survive. The same manual tells managers to watch for employees who “seem disgruntled or who feel they have been treated unfairly or passed over for promotions” (ACFE). An unresolved grievance can keep a “get even” excuse alive. The mechanics of stopping theft at the register cover the controls themselves.

How do you raise perceived detection without a bigger budget?

The ACFE’s manual calls this “the key to preventing fraud”: employees are less likely to commit fraud “when they believe that the company will detect it” (ACFE). Two tactics need no budget line. The manual recommends “conducting random audits or cash counts (letting employees know that random tests will be conducted, but not indicating when)” and “establishing a management presence wherever cash or merchandise is handled” (ACFE). An unpredictable count can make every shift feel like one that might get checked. Detection does not have to come from a manager alone. The ACFE’s 2026 global study found that 43% of frauds were caught after a tip, and more than half of those tips came from employees (ACFE). A store that makes reporting easy can raise perceived detection too.

Why does a trusted employee’s tenure raise risk instead of lowering it?

The ACFE’s small business manual is blunt about who actually commits fraud in small organizations: “when fraud occurs in a small business, it is usually committed by a long-term, trusted employee” (ACFE). The ACFE’s 2026 global study backs the pattern at scale: “fraud risk increases significantly with authority, tenure and collusion” (ACFE). Part of the reason is mechanical. The CPA Journal’s review of the fraud diamond notes that when someone performs the same function repeatedly, such as bank reconciliations or setting up new vendor accounts, their capability to commit fraud grows as their knowledge of that function’s controls expands over time (CPA Journal). A long-tenured cashier can learn which void reasons never get questioned. The fix is procedural: PCAOB’s AS 2401 flags a “lack of mandatory vacations for employees performing key control functions” as a weakness auditors watch for (PCAOB). Make sure the person who reconciles the safe takes time off and someone else covers it, even if she has never once been short.

How should a manager respond to visible financial pressure?

PCAOB’s AS 2401 notes that personal financial obligations may create pressure on employees with access to cash or other theft-susceptible assets (PCAOB). Start with support. California’s Labor Code bars an employer or prospective employer from using a consumer credit report for employment purposes unless the position falls into a listed category, such as a managerial position (Cal. Lab. Code §1024.5). In California, a manager who notices a cashier stressed about a bill is on firmer ground opening a conversation than pulling a credit file. Other states and federal FCRA rules set different limits. The ACFE’s manual frames the right move as an open-door policy that gives employees a place to discuss problems and seek help before they turn to fraud (ACFE). A referral to an Employee Assistance Program can extend that same open door. Review the FCRA rules on background checks with HR before running any credit check.

What can a store manager check this week to shrink opportunity and raise perceived detection?

Opportunity controls only work when someone owns them past opening week. PCAOB’s AS 2401 lists inadequate access controls over automated records, including “controls over and review of computer systems event logs” (PCAOB), and a “lack of timely and appropriate documentation of transactions, for example, credits for merchandise returns” (PCAOB), as conditions that let misappropriation happen. Match each control to a side of the triangle and a single owner.