What Should Employee Theft Awareness Training Actually Cover?

By awareretailgroup.com Editorial· Edited by Tom Walsh· Published 2026-09-24 · Updated 2026-09-25

What Should Retail Employee Theft Awareness Training Actually Cover?

Employee theft accounts for roughly 29% of shrink dollars, the second-largest source behind external theft at 36% (LPRC). Effective training has to cover cash, merchandise, and transaction procedures, and it has to build the reporting habit that surfaces what those procedures miss.

How big is the employee theft problem, really?

NRF’s 2023 National Retail Security Survey, the last edition to measure the shrink split by source, found retailers attributed 36% of shrink to external theft, 29% to employee theft, and 27% to process and control failures and errors (LPRC). Unknown sources accounted for 6% and other sources for 1% (LPRC). Appriss Retail’s 2026 benchmark repeats the 29% figure as $26 billion, inside a different taxonomy built from inventory errors, operational inefficiencies, and organized retail crime rather than a customer-versus-employee split (Appriss). Appriss counts those four causes as the 73% of its shrink figure that is preventable, and puts returns at an additional 20% and unknown causes at 7% (Appriss). The two numbers describe the same underlying measurement, not two independent confirmations. Calling employee theft the largest shrink category overstates NRF’s own data. Calling it the largest category a retailer controls directly, through its own people, cash drawers, and procedures, is the claim training should actually make. External theft, including organized retail crime, is a separate problem with its own training approach.

What internal theft actually looks like on the sales floor

Training that assumes employee theft is mostly a register problem is teaching the wrong scheme mix. NRF’s top four reported methods of internal theft were merchandise theft, refund fraud, cash and deposit theft, and passing merchandise to friends through sweethearting, sliding, or free bagging (ASIS). Plain merchandise walking out in an apron pocket or a backroom bag ranks ahead of any single transaction scheme. A dishonest-employee case averaged $1,136.93, well below the losses that make headlines (ASIS). That average matters for how training gets pitched to a store team: most internal theft is small and repeated, so routine procedure and routine reporting catch more of it than a once-a-year fraud seminar. Cover pocketed merchandise and sweethearting in the same sitting as voids and refunds so the mix matches what actually walks out.

The cash and merchandise procedures training has to cover

NRF’s own guidance to retailers is direct: train associates thoroughly on inventory procedures and cash handling, and build a workplace where reporting suspicious activity feels normal rather than risky (NRF). That guidance names inventory receipt, recording sales, and handling returns and damages as the core procedures, plus a written policy on employee and friends-and-family discounts enforced the same way every time (NRF). Point-of-sale controls that require a second person to verify a void or override, and opening and closing rules that require two associates on site, close the gap a single dishonest employee would otherwise work alone (ASIS). A policy binder nobody enforces is not a control. The store that skips the surprise audit because the scheduled one already happened this month is the store where a discount policy quietly becomes whatever the closing shift decides it is.

• Cash handling: drawer counts, deposits, and one person accountable per drawer
• Returns and refunds: who can authorize one without a receipt, and where the override gets logged
• Discount policy: a written rule for employee, friends, and family pricing, enforced identically every shift
• Receiving and inventory adjustments: what gets logged when a case or pallet comes up short
• Two-person verification on every void, override, and no-sale key
• Surprise cash counts and inventory checks on the calendar, not only the announced ones

Why tips catch more theft than any control by itself

Tips are the most frequently used fraud detection method in ACFE’s 2026 study, accounting for 43% of cases, and more than half of those tips came from employees (ACFE). That is why the session on drawer counts and refunds should also name who receives a tip and what happens next, rather than saving reporting for a separate video. Organizations that trained employees received more than twice as many tips from them as organizations that did not (ACFE). The table below shows ACFE’s median fraud loss per case, a different measure from the NRF average cited earlier; it was lower where both staff and management were trained. A store relying on cameras and counts alone is leaving the cheapest detection method, a coworker who already noticed something wrong, untrained and unprompted to say so.

Naming retaliation honestly

Most training tells associates to speak up and stops there, as if silence were only a matter of not knowing the policy exists. Seventy-two percent of employees who observed misconduct did report it (ECI), so most people already do the right thing once they see something. Retaliation is the risk training rarely names out loud: 46% of employees say they experienced retaliation after reporting misconduct (ECI). A training script that promises no retaliation and then lets a manager freeze out the associate who reported a coworker teaches the opposite lesson to everyone who was watching. Say the retaliation fear out loud, spell out the exact steps managers take when a report lands, and enforce those steps the first time someone files one.

Give associates more than one way to report

A single hotline number on a break room poster is not a reporting culture. Web-based tips (46%) and email (34%) have both passed the phone (23%) as reporting channels in ACFE’s report (ACFE). Employees also say they prefer reporting to someone they already know, not a form (ECI). That means the fastest fix most stores can make is not a new app. It is telling associates explicitly who their trusted person is, by name, at the same huddle where cash and merchandise procedures get covered, alongside whatever anonymous channel corporate already provides. A weekly huddle format for loss-prevention talking points is a cheap, recurring place to keep that name current when a manager changes.

What the training should not do

Behavioral red flags belong in awareness training, not in an accusation script. ACFE found 84% of perpetrators displayed at least one behavioral red flag before they were caught (ACFE), which sounds like a detection tool until a manager uses it to confront a coworker who is simply going through a hard year. A red flag is a reason to watch a process more closely, never proof on its own. Training also should not turn associates into an internal investigations team: their job is to follow the procedure and report a concern to the manager who owns that file, not to confront a coworker, search a bag, or build a case. Keep the manager’s role limited the same way: receive the report, log it, and route it, without conducting the investigation from the sales floor.

Hollinger and Clark’s retail-inclusive study of over 9,000 employees found roughly one-third self-reported stealing from their employer (OJP), which means most employees on any shift are not stealing. Training that frames every associate as a suspect, or opens with “everyone steals a little,” insults the two-thirds who do not and gives the coworker who does steal cover inside a culture of mutual suspicion.

What to do this week

• Rewrite the shrink stat in your own materials to say employee theft is the largest source the store controls directly, not the largest source overall.
• Walk the cash and merchandise checklist above against your current store and flag every unchecked box.
• Schedule one surprise cash count and one surprise inventory check this month, not next quarter.
• Name the trusted person each shift reports to, out loud, at the next huddle.
• Tell your team what happens after a report is filed, then keep that promise the first time someone tests it.