What should a company do in the first 48 hours after discovering employee theft?

The discovery of internal theft produces a strong urge to act immediately, and acting immediately is almost always what turns a recoverable loss into an unrecoverable one plus a lawsuit. The sequence below is ordered by what decays fastest and what damages most.

What has to happen in the first hours?

• Preserve video. Your own system is on the same retention clock as any other; if the relevant period is near the edge of the window, export it now rather than planning to.
• Preserve access and system data. Badge logs, till data, network logs, email, file access records and any audit trail. Many systems purge or roll these automatically.
• Preserve documents. Invoices, approvals, schedules, purchase orders and inventory counts for the relevant period, secured where the suspected employee cannot reach them.
• Restrict who knows. Ownership and, where litigation is plausible, counsel. Nobody else, and specifically not the suspected employee's colleagues.

Why should you not confront the employee?

Because a confrontation is the single most destructive thing you can do at this stage. It tells the subject exactly what you know and what you have not found, gives them time to delete, return or reposition evidence, and lets them prepare an account. It also frequently produces a denial you then cannot disprove, which makes any later termination look like it followed an unsubstantiated accusation — which is the shape of a wrongful termination claim.

There is a narrow exception for immediate safety or ongoing large-scale loss, where you may need to suspend access. Even then, do it quietly and on a neutral stated basis, with counsel's input.

Why quantify beyond the incident you found?

Because the incident that gets noticed is almost never the first one. A discrepancy discovered in one month's inventory routinely traces back through prior periods once someone examines them with the pattern in mind. This matters practically: the total changes whether you pursue restitution, file an insurance claim under a fidelity or crime policy, or refer for prosecution, and all three require the full figure rather than a sample. Underestimating early also tends to cap what you can later recover.

Should counsel engage the investigation?

If there is any realistic chance of litigation, an agency response or a contested termination, yes. An investigation performed at the direction of counsel generally falls within the attorney work-product doctrine, which protects the investigative file — including any interim finding that turns out to be wrong or unhelpful — from discovery. An investigation the company commissions directly usually does not carry that protection. The decision costs nothing at the outset and cannot be made retroactively.

What does a proper investigation look like from here?

Documentary first, interviews second, subject last. The records establish the timeline and the scope before anyone is spoken to, which means interviews are informed rather than exploratory. Peripheral witnesses come before central ones. The suspected employee is interviewed at the end, if at all — and by then the documentary picture, not their answers, is what carries the case.

What about calling the police straight away?

A report presented to a district attorney with the loss quantified and the evidence organized is treated very differently from a complaint that asks a department to investigate from nothing. Police involvement is often the right end point, but arriving there with a documented case rather than a suspicion materially changes what happens next. It also does not preclude the civil and insurance routes, which frequently recover more.