Before You Accuse Anyone: The Sequence

Purpose

To get from "something is wrong" to a decision without destroying an innocent person, tipping off a guilty one, or creating a claim against the shop. Detection and accusation are separate activities, and the failure mode here is doing them in one motion: an owner notices a gap on Tuesday, is certain by Wednesday, and has said the word out loud by Thursday to someone who had nothing to do with it. Most gaps are recording errors, so the sequence establishes that first and cheaply, and it produces what every later option needs: a record built before the subject knew anyone was looking.

Scope

Covers suspected loss caused by someone inside the shop: stock, cash, time, tools, payments, payroll. It runs from the first signal to the interview and stops there, because what you do once evidence exists is a separate decision.

It does not cover control design, an accusation a customer makes against your tech, or the prosecution question. Nothing here is legal advice, and step 6 is where a shop should stop acting on an article. See related: Separating Duties in a Shop With Four People.

Roles and responsibilities

Procedure

1. Establish that a loss happened at all, from a source you did not create

Do: Reconcile one item or account against a document produced outside the system you suspect: a supplier statement, the bank feed, the settlement report. Set the materiality floor before you look at the number, because one chosen afterwards is an opinion. A common starting point is 5 percent of the relevant base. Accept when: The gap is written as a count and as a share of a named base over a named period, from a document nobody inside the shop can edit. Wrong / stop rule: The gap shrinks when you widen the period, or the only evidence is a report the suspect can edit. Stop, and treat it as the recording problem most of them turn out to be. Hazard: None, it is desk work. The procedural hazard is what counts: a suspicion acted on before this step often lands on an innocent person, and it cannot be taken back.

2. Bound it in time, in quantity and in kind

Do: Establish when the gap starts, whether it continues, and what specifically goes. Plot it by week or pay period, not as a total: a steady trickle, a step change on a date, and a concentration in a few periods are three cases with three different suspect sets. Accept when: You can state the first period the gap appears, the last, and the share sitting in the highest few periods, each with its source. Wrong / stop rule: The gap runs at the same rate as far back as the records go. That is a process or pricing problem rather than an event; re-scope it as a control review. Hazard: None. The risk is anchoring: an owner with a name in mind reads a concentration as confirmation, when it equally follows a job type, a route or a season.

3. Preserve the records before anyone knows you are looking

Do: Export and date-stamp every relevant record to a copy only you hold: transaction history, edit logs, timesheets, dispatch data, processor detail, email in accounts the shop owns. Do it before widening the circle, because a deleted row leaves no trace in most shop software. Accept when: A dated read-only copy sits off the live system, and you can say for each source whether it carries an audit trail of changes. Wrong / stop rule: A source allows retroactive edits with no audit trail. It cannot prove anything, so demote it to a lead and go back to step 1 for a source outside the shop. Hazard: None physical, one legal. Reaching into an employee's personal email, cloud account or phone can breach the federal Stored Communications Act (18 U.S.C. 2701) and stricter state analogues. Company accounts on company systems are a different question, and that line is where you ask.

4. List who had access and who had opportunity, and keep the two apart

Do: Write two columns. Access is who could reach the thing at all; opportunity is who could reach it unobserved in the periods step 2 found. Include yourself, your family and your bookkeeper: a list with a convenient omission is the first thing an outsider notices. Accept when: Every name is accounted for against every concentrated period from a roster, a login record or a schedule, not from memory. Wrong / stop rule: The list comes back with one name and you feel relief. Re-check the scope: a one-name list usually means access was defined around the person already suspected. Hazard: None. The exposure is discrimination: where the list is long and you look at part of it, be able to say from the record why, in terms of periods and access rather than of who seemed like the type.

5. Test the innocent explanations, on the record, before the guilty one

Do: Write down every explanation that does not involve dishonesty - unlogged usage on a named job, a warranty return never credited, a damaged batch, a credit posted to the wrong account - and test each against a document, without asking anyone on the list. Accept when: Each explanation carries the document that settled it, and the residual gap is restated on the same base as step 1 so the two figures compare. Wrong / stop rule: An innocent explanation covers most of the gap. Stop, fix the process, re-measure a full period before reopening. A gap that halves under testing usually halves again. Hazard: None. The failure mode is the flattering comparison: correct the gap downward and the concentration gets corrected on the same basis, or you are reading a corrected number against an uncorrected one.

6. Set the standard of proof for the action you want, then decide who else is in this

Do: Name the action and match the standard to it, because they genuinely differ: a conversation needs a documented anomaly, a termination in an at-will state needs a good-faith, documented, consistently applied basis, and a police report needs facts a stranger can follow without your inference filling the gaps. Then make the calls that apply, counsel for a termination or a report and your agent if you carry crime coverage. Accept when: The action, its evidence standard and each outside instruction are written into the plan before any interview is scheduled. Wrong / stop rule: The evidence meets the conversation standard and you are planning a termination, or you cannot describe the loss to an outsider without saying "I just know". Take the lower action or go back to step 5. Hazard: None. The exposure is a wrongful-termination or defamation claim built on the gap between what you can prove and what you said, plus the crime-policy condition that ends cover on a person the moment you know of a dishonest act by them.

7. Plan the interview before you plan what to say in it

Do: Set the room, the second person and the rules: two from the shop, one asking and one writing, a room the employee can leave, no accusation stated as a fact you cannot support. Where the employee is in a union, Weingarten rights (NLRB v. J. Weingarten, Inc., 1975) give them the right, on request, to a representative at an investigatory interview they believe could lead to discipline; the Board has held it does not reach non-union shops (IBM Corp., 2004). Accept when: Room, second person, opening sentence and question list are written, and no question requires the employee to prove a negative. Wrong / stop rule: You are planning a confrontation, with a confession demanded and a document waved. Rewrite it as questions; a confession taken that way is worth less than the file you have. Hazard: Two, both real. Never position anyone between the employee and the door and never say or imply they may not leave, which is how an interview becomes a false-imprisonment claim. And do not raise a polygraph: the federal Employee Polygraph Protection Act (29 U.S.C. 2001 and following) bars a private employer from requesting one outside a narrow ongoing-investigation exemption.

8. Run it, take the answer, and close the innocent outcome properly

Do: State the subject neutrally, then ask open questions before closed ones: walk me through how stock gets logged, tell me about the week of the fourteenth. Narrow only once their account is on the record. If you record, get consent on the recording: federal law allows one-party consent (18 U.S.C. 2511) while California, Pennsylvania, Illinois and Maryland require all parties to agree. Accept when: The notes carry the employee's own account in their words, signed and dated by the note-taker, and every planned question has an answer or a documented refusal. Wrong / stop rule: New information changes the analysis, usually an innocent explanation nobody had thought of. End the interview, say you will come back to them, return to step 5. Hazard: A person who has realised they may lose their job. End the meeting if anyone becomes hostile, and never run it alone or after hours in an empty building. The second hazard is the silence afterwards: an employee left uncertain for weeks resigns, and you have lost an innocent person to your process.

The record this produces

Five things in one dated folder nobody else can edit: the step 1 reconciliation with its outside source document; the step 2 period distribution; the step 3 export set, noting which sources carry audit trails; the access and opportunity table with each innocent explanation and the document that settled it; and the interview notes, signed and dated.

It gets read by four audiences, which is why it is built this way: an insurer, whose crime form generally will not accept a loss proved by inventory computation alone; a lawyer deciding whether the shop acted reasonably; a detective deciding whether there is a case; and you, in eighteen months, trying to remember whether you were fair.

A worked pass

A three-tech shop. The signal is a supply-house rep mentioning that purchases of one common fitting look heavy against last year. At step 1, purchases for the quarter were 620 units against job records accounting for 500, so the gap is 120, which is 19 percent of purchases of that item across the thirteen weeks, taken from the supplier's statement rather than the shop's own system. That clears the 5 percent floor set before looking. Step 2 distributes it: 95 of the 120 fall in weeks 5 to 9.

Step 3 fails. The inventory app lets any of three users edit historical counts with no audit trail, so its usage history cannot support a conclusion about a person. The stop rule fires: the app is demoted to a lead, its export kept as a dated snapshot of what the system said that day, and the supplier statement plus the job photos become the spine.

Step 4 returns four names with stockroom access in those weeks, the owner among them. Step 5 then tests the innocent explanations: two large jobs in weeks 6 and 7 used the fitting and never logged it, and counting the fittings visible in those jobs' as-built photos accounts for 45 units. So 120 minus 45 leaves 75, which on the same 620-unit base is 12 percent rather than 19. The concentration is corrected on the same basis, since all 45 recovered units sit in weeks 5 to 9: 95 minus 45 leaves 50 of the remaining 75 there, which is 67 percent of the residual gap inside 5 of 13 weeks.

Step 6 finds this meets the conversation standard and comes nowhere near a police-report standard. The pass ends there, correctly, with a bounded anomaly rather than a conclusion.

References

• Employee Polygraph Protection Act, 29 U.S.C. 2001 to 2009, enforced by the U.S. Department of Labor Wage and Hour Division
• Stored Communications Act, 18 U.S.C. 2701; federal one-party recording consent, 18 U.S.C. 2511, with all-party consent in several states
• NLRB v. J. Weingarten, Inc., 420 U.S. 251 (1975); IBM Corp., 341 NLRB 1288 (2004)
• See related: When You Have Proof and Have to Decide What to Do; Prosecute or Handle It Internally