Prosecute or Handle It Internally

Why this matters

Owners agonise over this one longer than over anything else in a theft, and they agonise over the wrong question. The question in the room is usually moral: does this person deserve a criminal record, am I being soft, what would my father have done. The question that actually decides it is a set of five conditions, four of which you can check in an afternoon, and one of which is sitting in a policy or a contract you have not read since it was bound.

It is worth saying plainly that most small shops handle this internally, and that this is usually correct rather than cowardly. A referral is not a stronger version of a termination; it is a different action with a different owner, a different standard, and consequences that do not stop when you want them to.

Employment proof and criminal proof are not the same standard

You can lawfully terminate on a good-faith, documented, consistently applied belief. That is a long way below what a prosecutor needs to charge, which is probable cause, and further still below what a conviction needs, which is proof beyond a reasonable doubt. A civil claim sits in between, at the preponderance standard. Four different bars, and a file that clears the lowest one tells you nothing about the others.

The practical consequence is that "I know it was him" and "a stranger can prove it was him" are different states of the world, and only the second one survives a referral. Get that gap wrong and you do not simply fail; you create a new exposure, because a malicious-prosecution claim generally requires proceedings begun without probable cause, brought with malice, and ended in the accused's favour. A weak case that collapses has assembled two of those three elements for them.

Gate one: does the file survive a detective's reading

A detective triages. What gets worked is a file that is bounded, documented from records the suspect did not control, and points at one identified person. What gets filed and forgotten is a folder of internal reports and a conviction.

Three properties carry almost all of the weight. Third-party records, meaning statements, processor data, card transactions, supplier invoices, anything produced outside your systems. A bounded period and a bounded quantity, so the loss is a figure rather than an impression. And an access analysis that eliminates other people rather than merely naming your favourite. If your file has all three, hand it over as a written summary with the documents attached and numbered. If it has two, you are asking a busy stranger to do your investigation.

The inverse matters too: a strong file is what makes the police interested at all, and owners routinely read a lukewarm response as police indifference when what they handed over was unworkable. See related: Before You Accuse Anyone: The Sequence.

Gate two: the amount, against your state's felony line and its aggregation rule

Theft grading is state law, and the line between a misdemeanour and a felony moves enormously across the country: New Jersey is at the low end, Texas and Wisconsin are among the highest, and the thresholds themselves move, as when Virginia raised its grand-larceny threshold in 2020. There is no national number to know, and the figure that matters is the one in your state's current criminal code.

The rule that decides more of these than the threshold itself is aggregation. Internal theft is almost never one act; it is a hundred small ones. Many states allow a continuing course of conduct against one victim to be charged as a single aggregated offence, which turns fourteen months of small takings into one felony. States that do not allow it leave you with a pile of individual misdemeanours that no prosecutor will pick up. Same facts, same total, completely different answer, and it is a question for a local criminal attorney or the detective you would be handing it to.

Several states also grade theft by a person in a position of trust more seriously, or charge it under a separate embezzlement provision, which is why a bookkeeper and a helper who took the same value can face different exposure.

Gate three: has a policy or a contract already decided this

This is the gate shops skip, and it is the only one that can take the decision away from you.

Commercial crime and employee dishonesty forms carry duties in the event of loss. Notice to the insurer promptly, a sworn and detailed proof of loss within the period the form states, records made available, and in the common forms a requirement to notify the police where you have reason to believe the loss involves a violation of law. Where that condition exists and you decline to report, you have chosen to forgo the only route that pays the loss in full.

Two more conditions in the same family. Crime forms generally will not accept a loss proved by inventory computation or profit-and-loss computation alone, which is why the evidence discipline earlier in this group has a second payoff. And most carry a provision ending coverage as to any employee once you know of a dishonest act by them, so the shop that keeps someone on a quiet repayment plan is running uninsured on that person from the day it learned.

Client contracts can carry their own clause, particularly in property management and institutional work, where the requirement to hold crime coverage usually arrives with a notice obligation attached. See related: The Employee Dishonesty Coverage Most Shops Do Not Carry.

Gates four and five: public harm, and what you actually want

Is repetition a foreseeable harm to someone other than you? A person leaving your shop for the same role somewhere else, with keys, customer access or a payment function, carries the exposure with them. That is the honest argument for a referral, and it is a different argument from wanting the money or wanting to be believed.

What do you actually want? Answer it before you choose, because the paths deliver different things. If you want repayment, understand that prosecution is not a collection mechanism: restitution ordered through a criminal court is slow, partial and dependent on the defendant's means, and the civil route is generally faster at getting to an enforceable number. If you want it over, a referral is the option that lasts longest. If you want the crew to see that this is not survivable, a consistently applied control change does more of that work than a case nobody can talk about.

What the referral path costs that nobody warns you about

You cannot withdraw it. The charging decision belongs to the prosecutor, not to you. A victim's wishes are considered and are not controlling, so an owner who reports in week one and regrets it in week six has no button to press.

Your time, on somebody else's calendar. Statements, a preliminary hearing, dates that move twice and land in your busiest month.

Discoverability. Everything you collected can be pulled into the case, including the parts you would rather not show: the control gaps that made the theft possible, the messages you sent while angry, and the parts of your own record-keeping that do not stand up. Defence counsel's job is to make your process the issue, and in a small shop there is usually material for it.

Publicity. Criminal matters are public record. Your shop's name is in it, and a customer can find it as easily as you can.

The weak-case tail. A case that falls apart is where the malicious-prosecution exposure from the top of this card becomes real.

The case that reversed at gate three

A nine-person shop finds fuel-card spending badly out of line with route miles. The reconstruction runs on third-party records only: the card processor's transaction file, the vehicle's odometer readings from service records, and the fleet's own measured consumption of about 14 miles per gallon.

Over fourteen months, 41 transactions on one card exceed the van's 25-gallon tank capacity, the largest at 34 gallons, which is a physical impossibility rather than an opinion. A further 19 sit at a station 22 miles off any route that vehicle ran on the day. The 41 over-capacity fills carry an average excess over tank capacity of about 8 gallons, which is 328, and the 19 off-route fills average about 14 gallons, which is 266; together 594, against an odometer-and-consumption reconstruction that independently puts the unaccounted volume near 600. Across the 60 flagged transactions that is just under 10 gallons each, consistent with a second vehicle being topped up rather than with a meter fault.

Gate one passes comfortably: third-party records, a bounded period, one cardholder. Gate two is genuinely unresolved, because the answer turns on whether the state aggregates a continuing scheme, and the owner does not know. On gates four and five the owner leans internal: the man is leaving for another driving job rather than a role with customer keys, and what the owner wants is the money back.

Then gate three. The shop bought crime coverage two years earlier because a property-management client required it, and the form's duties in the event of loss include notifying the police where there is reason to believe a law was violated. The insurance claim is the only route that pays this loss in full, and its condition is a police report. The decision reverses, and it reverses on a document nobody in the shop had opened since it was issued.

Two details worth taking from it. The owner's instinct was not wrong on the moral question; it was simply not the question that governed. And the coverage-ends-on-knowledge condition means the quiet repayment plan the owner had been drafting would have left the shop uninsured on that employee from the day it learned, which is the opposite of what it felt like.

Why internal is usually right, and the case where it is not

Internal handling is the majority answer because the majority of cases fail gate one. The loss is real, the person is almost certainly responsible, and the file rests on internal records that allow retroactive edits, an access list of three, and an owner's certainty. That case is unworkable for a prosecutor, and pushing it forward spends months to reach the same termination you could have done in a week, with more exposure.

It is also the right answer where the loss is bounded, the person is leaving a role they cannot repeat elsewhere, and no policy or contract requires otherwise. Nothing about that is soft. The control change you make afterwards protects more money than the case would have recovered.

The case where internal handling is genuinely wrong has three markers, and they tend to arrive together: a file that stands on third-party records, a role the person will hold again somewhere else with the same access, and a policy or client contract whose payment depends on the report. Where all three are present, the internal route is not mercy, it is the shop absorbing a loss it insured against and passing the risk to whoever hires them next.

References

• State criminal codes set theft grading, felony thresholds and aggregation rules; they vary widely and change, so the operative text is your state's current code
• Commercial crime and employee dishonesty policy conditions: notice, sworn proof of loss, the inventory-computation limitation, and coverage ending as to an employee on knowledge of a dishonest act
• Malicious prosecution and defamation are state common-law claims turning on probable cause and on what was said; both are questions for your own attorney
• See related: Before You Accuse Anyone: The Sequence; When You Have Proof and Have to Decide What to Do; The Employee Dishonesty Coverage Most Shops Do Not Carry