Updated September 14, 2026
1. Preserve relevant records
Identify records that may be altered or routinely deleted, such as access logs, transaction records, inventory data, video, schedules, communications or other business records. Preserve material lawfully and consistently.
2. Define the suspected loss
Determine what appears to be missing, when the discrepancy began, who had legitimate access and which systems or processes were involved. Avoid treating access alone as proof of responsibility.
3. Build a timeline
Compare transactions, access records, staffing, inventory movements and other relevant events. A timeline can help distinguish a one-time anomaly from a repeated pattern.
4. Corroborate before concluding
Where possible, important findings should be supported by more than one source: records, interviews, physical observations, surveillance or other lawful evidence.
5. Coordinate sensitive decisions
Employment action, interviews, device access, searches, reporting to police and civil recovery can raise legal issues. Legal or human-resources advice may be appropriate before consequential steps are taken.
6. Document the investigative record
Maintain clear notes of what was reviewed, when information was obtained, who provided it and how conclusions were reached. Good documentation supports fairer and more defensible decisions.
Related service: Fraud Investigations.