Small losses rarely announce themselves clearly. A box of fittings disappears from a construction trailer. A stockroom count is off again, but not enough to trigger a crisis. A tenant service desk keeps running through supplies faster than expected. In many properties and workplaces, stealing at work starts as a pattern of small inconsistencies that someone feels before they can prove.
That instinct matters. Managers usually notice the friction first. Something doesn't reconcile, a process feels too loose, or one person seems to have unusual control over a task that should require oversight. The mistake is treating that discomfort as either paranoia or purely a personnel issue. Most theft problems are operational problems long before they become disciplinary ones.
That Unsettling Feeling When Things Don't Add Up
A retail manager may see returns that don't line up with inventory movement. A construction superintendent may notice that smaller tools disappear more often after subcontractor turnover. A commercial property manager may realize that janitorial or maintenance supplies are being reordered too frequently without a matching increase in use.
Those situations feel different on the surface, but they usually point to the same issue. Controls are too loose, visibility is incomplete, or accountability breaks down between handoffs.
The scale of the problem is real. In U.S. retail alone, the National Retail Federation reported $112.1 billion in inventory losses in 2022, with employee theft accounting for 29% of that figure, as cited in this overview of employee theft costs.
Why managers often miss the pattern
Most workplace theft isn't a dramatic one-time event. It hides inside routine activity.
- Small removals: A few items at a time are harder to flag than one large loss.
- Process noise: Busy sites already have returns, breakage, transfers, and access requests.
- Shared responsibility: When several people touch the same inventory or records, no one sees the whole chain.
Practical rule: If losses are recurring but explanations are always informal, treat that as a controls review issue first.
That's good news, because controls can be strengthened. A manager doesn't need to assume the worst about every employee. They need a system that makes exceptions visible, creates documented handoffs, and limits the chance for one person to take, alter, and conceal without review.
Defining Workplace Theft Beyond the Cash Register
Many managers hear "employee theft" and think of cash from a drawer or merchandise leaving through a back door. That's still part of the picture, but it's no longer enough.
Workplace theft includes time theft, payroll manipulation, data theft, unauthorized service use, skimming, and kickbacks, not just physical items, according to this breakdown of common types of employee theft. That changes how you prevent it. Cameras alone won't solve a timesheet problem. A locked storeroom won't stop a file export.
Physical loss is only one category
Physical theft is the most visible form. It includes merchandise, tools, equipment, consumables, keys, fuel, and supplies.
For a retail center, that might mean stock leaving without documentation. For a construction site, it may be material diverted during delivery or pickup. In a commercial building, it can be service supplies, access devices, or maintenance inventory used without authorization.
Time and payroll issues count too
A lot of stealing at work doesn't involve carrying anything out the door.
Time theft can include extended breaks, falsified hours, buddy punching, or routine personal errands during paid time. Payroll manipulation can involve changing hours, allowances, or approvals in ways that bypass normal review. These issues often sit inside ordinary workflows, so they require audit trails and approval controls more than physical deterrence.
A manager who only watches the exits may miss the losses happening inside software, schedules, and approvals.
Data and service misuse are now part of the risk
In office, facilities, and hybrid environments, theft often takes the form of access misuse. That can involve customer data, vendor lists, pricing files, lease information, internal reports, or confidential operating documents. It can also include unauthorized use of company services, systems, vehicles, or vendor relationships for personal benefit.
A simple way to think about it is this:
| Category | What it often looks like | What usually helps |
|---|---|---|
| Physical assets | Missing tools, stock, supplies | Access control, counts, patrols, cameras |
| Time and payroll | Inflated hours, weak approvals | Time audits, approval separation, log review |
| Financial manipulation | Skimming, false adjustments, kickbacks | Transaction monitoring, dual approval, vendor review |
| Data theft | File copying, forwarding, downloads | Access limits, logging, offboarding controls |
| Resource misuse | Personal use of vehicles, services, equipment | Clear policy, supervision, documented sign-out |
Once managers broaden the definition, the response gets sharper. Instead of asking, "Who stole something?" they start asking, "Where can someone remove value without immediate detection?"
Recognizing the Common Warning Signs of Theft
Theft usually leaves clues before it leaves proof. Good managers train themselves to spot red flags without jumping to accusations.
Some signs are operational. Others are behavioral. The strongest signal often appears when both show up together.
What the operation is telling you
Look for inconsistencies that repeat, especially in areas with fast transactions or frequent handoffs.
- Cash and transaction anomalies: Unusual voids, refunds, manual overrides, or register discrepancies.
- Inventory friction: Repeated count variances, unexplained stockouts, damaged goods with poor documentation, or deliveries that don't reconcile cleanly.
- Access irregularities: Off-hours entry, doors left unsecured, exits opened without a work reason, or vehicles positioned near loading or service exits.
- Vendor concerns: Unexplained favoritism, rushed receiving, or one person controlling ordering, receipt, and reconciliation.
These aren't proof by themselves. They are reasons to review logs, approvals, and physical controls more closely.
What behavior can signal
Behavior should never be the sole basis for a conclusion, but it can help managers know where to verify process.
A few common examples:
- Unusual ownership of a task: Someone resists cross-training or doesn't want others reviewing their area.
- Odd working patterns: Frequent off-hours presence without a clear business need.
- Defensiveness around routine checks: A normal count or audit triggers outsized resistance.
- Boundary testing: Repeated exceptions, casual bypassing of sign-out procedures, or "I'll fix it later" documentation habits.
Peer dynamics matter more than most policies admit
Culture shapes theft risk. Research found that workplace theft can be contagious and strategic, and that new employees exposed to stealing peers in their first five months were more likely to become habitual thieves, as described in this Washington University summary of the research.
That matters for high-turnover settings. If a new hire sees loose checkout practices, casual inventory borrowing, or supervisors ignoring shortcuts, they may read that as the actual rule.
The first months of employment often matter more than the handbook. People learn the actual standard by watching what gets ignored.
For managers, that means warning signs aren't only about one suspect employee. They can point to a crew norm, a weak supervisor handoff, or an onboarding gap that needs correction before the pattern spreads.
A Proactive Approach to Theft Prevention
The most useful shift a client can make is this one. Treat stealing at work as a controls failure problem before treating it as a character judgment problem.
Loss-prevention guidance consistently points to inventory reconciliation, transaction monitoring, segregation of duties, access control, and surprise audits because theft usually succeeds when one person can initiate, conceal, and reconcile a transaction without independent review, as outlined in this controls-focused prevention guidance.
Start with the workflow, not the incident
If a site has repeated losses, review the points where value changes hands.
That means receiving, storage, checkout, returns, key control, payroll approvals, visitor access, and offboarding. In many properties, a primary weakness isn't that nobody cares. It's that too many tasks depend on trust without verification.
A practical prevention model usually includes:
- Clear handling rules for cash, inventory, tools, credentials, and sensitive records.
- Separated responsibilities so no one person controls every step.
- Routine checks plus occasional surprise reviews.
- Fast documentation so missing details don't become permanent blind spots.
The controls that usually work
Some controls are simple, but they need consistency.
- Inventory reconciliation: Count what matters on a schedule that matches the risk. Fast-moving stock needs tighter review than slow-moving material.
- Role-based access: Give people access to the systems, rooms, or supplies they need, not broad convenience access.
- Documented handoffs: Require sign-out, return verification, and receiving logs for sensitive assets.
- Transaction review: Watch manual overrides, credits, voids, and unusual adjustments.
- Visible oversight: Uniformed officers, patrol checks, and monitored entry points make concealment harder.
For properties reviewing physical deterrence and camera placement, a practical outside reference is this security camera guide for property owners. Cameras don't replace process, but they can support documented workflows when positioned around loading areas, stock rooms, docks, and other transfer points.
Site design still matters
A weak layout creates opportunities. Poor lighting near service corridors, unsecured storage, unmonitored side entrances, and hidden staging areas all make theft easier to attempt and easier to deny.
Many of the most effective fixes come from visibility and movement control. In this regard, crime prevention through environmental design principles become useful. If people can move assets through blind spots or linger in sensitive areas without challenge, the process is already working against you.
A strong security program doesn't rely on catching people late. It makes the wrong action harder to perform, easier to spot, and simpler to document.
In practice, that may involve revising post orders, tightening key control, changing delivery routes, restricting stockroom access, or assigning patrol verification to vulnerable zones. Overton Security's onsite officers, vehicle patrols, GPS-tracked tours, and digital activity reporting are one example of how organizations can add visible oversight and time-stamped documentation to those workflows without relying on memory or informal notes.
Tailored Prevention Strategies for Your Industry
Theft risk doesn't look the same in a shopping center, a construction project, and a Class A office building. The controls shouldn't look the same either.
Retail and shopping center operations
Retail losses often happen where speed and routine create cover. Returns, register exceptions, stock transfers, receiving, and after-hours back-door activity deserve the closest attention.
A retail manager usually gets the best results by tightening a few high-friction points:
- Back-of-house access: Limit who can enter stock rooms, manager offices, and receiving areas.
- POS exception review: Make someone independent review voids, refunds, and manual adjustments.
- Delivery accountability: Match receipts, transfers, and floor placement without delay.
- Visible deterrence: Uniformed officers near entrances and loading zones change behavior for both external and internal actors.
For teams focused on shopping centers and standalone stores, retail security planning is most effective when it connects customer safety, employee accountability, and loss prevention into one operating routine instead of treating them as separate issues.
Construction sites and yard operations
Construction theft has a different rhythm. Tools move daily. Materials arrive in stages. Multiple trades share space. Temporary staff and subcontractors increase the number of people with reasons to be on site.
The sites that stay under control usually do a few things well. They centralize tool sign-out. They lock down fuel, copper, wire, and high-value equipment. They define exactly who can access trailers, storage containers, gates, and laydown areas after hours.
A practical setup often includes a mix of:
| Risk area | Better control |
|---|---|
| Tools and small equipment | Sign-out logs, return checks, locked storage |
| Materials deliveries | Verified receiving, photo documentation, supervisor confirmation |
| Large perimeter exposure | Vehicle patrols, gate checks, lighting review |
| Crew turnover | Fast credential updates, badge recovery, supervisor accountability |
Commercial properties and facilities
In office towers, mixed-use properties, healthcare facilities, and administrative environments, theft is often less visible. It may involve records, devices, credentials, building access, or service misuse rather than boxed inventory.
Digital exfiltration is a major modern vector. Security guidance highlights patterns such as mass file downloads, off-hours access, unauthorized cloud sharing, USB use, and failed offboarding controls, with practical mitigations including immediate deprovisioning, endpoint logging, and alerting on abnormal file movement, especially during offboarding, as described in this guidance on preventing data theft from exiting employees.
For facility leaders, the takeaway is straightforward. Badge access, concierge logs, visitor records, endpoint monitoring, and key control all belong in the same conversation. A front desk log is a security control. So is disabling a departing employee's credentials immediately. So is checking whether a vendor escort policy is being followed.
How to Respond When You Suspect Theft
Suspicion is the moment when many organizations create unnecessary risk. They move too fast, say too much, or fail to preserve the records that matter.
A better response is controlled, documented, and boring. That's usually what protects the business.
Secure facts before you confront anyone
Start by preserving the record. Pull the relevant logs, footage, access events, inventory counts, delivery records, key control forms, timesheets, or transaction reports. Save them in a way that keeps the timeline clear and limits later disputes about what changed.
Then narrow the question. Don't begin with "Who stole?" Begin with "What event appears inconsistent with policy, and what records can confirm or disprove it?"
A short response checklist helps:
- Preserve evidence: Save video, screenshots, system logs, and written records promptly.
- Limit discussion: Keep the matter confidential among the people who need to evaluate it.
- Use policy language: Focus on possible policy violations until facts are established.
- Document every step: Note who reviewed what, when, and why.
Bring in HR and counsel early
The legal and employee-relations side matters as much as the security side. HR should help ensure consistency. Counsel can advise on interviews, suspension decisions, and documentation standards when the facts may lead to termination, recovery efforts, or police involvement.
This is also where many teams discover the underlying problem wasn't only theft. It was poor accountability, vague role ownership, or inconsistent supervision. For leaders working on those broader management issues, this piece on addressing workplace clarity problems offers a useful management lens.
Keep accusations out of the early conversation. Facts travel farther than assumptions.
Use neutral, professional documentation
If a security officer or supervisor is involved, their notes should stick to observations, timestamps, actions taken, and records preserved. Opinions and loaded labels create avoidable problems.
Strong field reporting helps. Time-stamped patrol records, checkpoint scans, incident photos, and concise narrative reports can give HR and counsel a much cleaner record than memory-based reconstruction after the fact. That's one reason disciplined reporting standards matter even on quiet days.
Building a Culture of Security with an Experienced Partner
Theft prevention isn't a one-time crackdown. It's a management discipline built into hiring, onboarding, access, supervision, reporting, and offboarding. When those pieces work together, stealing at work becomes harder to attempt and much easier to detect early.
For many properties, the biggest improvement comes from consistency. Officers follow post orders. Managers review the same exception reports each week. Access rights change when roles change. Deliveries and returns get documented every time, not only after something goes missing.
Overton Security has 26 years of experience supporting California clients across retail centers, construction sites, office properties, residential communities, and other high-accountability environments. That matters because durable prevention comes from steady supervision, low-friction reporting, and managers who stay close enough to the account to correct small gaps before they become expensive ones.
Training also deserves more attention than many organizations give it. Policies only work when employees understand them, supervisors reinforce them, and reporting channels feel usable. For teams modernizing how they deliver policy and compliance education, this article on transforming compliance with AI video is a useful example of how format can improve engagement without changing the underlying standard.
If you're evaluating physical loss, access misuse, or internal accountability concerns, loss prevention specialists can help turn broad concern into a site-specific plan. The right outcome isn't just fewer incidents. It's better visibility, cleaner documentation, and more confidence in how your property operates day to day.
If you're managing a retail center, commercial property, construction site, HOA, or multi-site portfolio in Los Angeles, San Jose, San Diego, Sacramento, Oakland, Long Beach, Fresno, or elsewhere in California, Overton Security can help you evaluate theft risk, tighten site controls, and build a practical prevention plan around your operations.
