Most theft never touches the safe — it hides inside voids, comps, refunds and no-sales that make the drawer balance perfectly. Here are the schemes, the report that catches each one, and how to investigate without blowing up your team.
September 2, 2026
Restaurant employee theft almost never looks like someone walking out the back door with a case of ribeyes. It looks like a drawer that balances to the penny, a void report nobody reads, and a bartender everyone loves. That is what makes it hard: the schemes that cost real money are designed to keep the nightly numbers clean, so an operator who only checks whether the cash matches the tape can be losing money for months and see nothing. The good news is that every scheme leaves a signature somewhere in the POS — and once you know which report shows which scheme, finding a problem takes minutes a week, not a stakeout.
One caution before any of it: most variance is not theft. Sloppy training, a manager who comps too easily, a recipe nobody follows — these produce the same ugly numbers as stealing does. Treat every anomaly as a process question first and a people question second. You will be right more often, and you will not torch the trust of an honest crew by accusing the wrong person.
Forget the exotic stuff. A handful of patterns account for nearly all of it, and they cluster around the places where money or product changes hands without a guest-facing record:
This is the part most advice skips. “Watch your reports” is useless until you know which number moves when something is wrong. The mapping is fairly clean:
| Scheme | Where it shows | What to look for |
|---|---|---|
| Skimming | Inventory variance vs. sales mix | Usage on high-velocity items outrunning what the POS says you sold |
| Void-after-payment | Void report by employee and time | Voids after the kitchen fired, late in the shift, one name over-represented |
| Comp abuse | Comp report by employee and reason | One person comping multiples of the house average, vague reason codes |
| Refund fraud | Refund and tip-adjust log | Refunds outside service hours, refunds with no matching original ticket |
| No-sale habit | No-sale count by drawer and employee | Counts far above the house norm for the same daypart |
| Bar leakage | Pour cost by category, weekly | Liquor variance rising while food variance stays flat |
| Time theft | Punch report vs. schedule | Clock-ins that always beat the schedule by the same few minutes |
Two habits make the table work. First, look weekly, on a set day, so you are comparing like with like — a Saturday void count means nothing next to a Tuesday. Second, always compare people to the house average for the same role and daypart, not to zero. Every server voids things. The signal is never “voids exist”; it is one name sitting at three times the norm for weeks.
Prevention is mostly plumbing — unglamorous settings and routines that remove the easy openings. If you already run tight cash handling and closeout, you are halfway there. The rest:
Suppose the comp report shows one bartender at four times the house average. The worst move is a confrontation on the floor with a hunch and a printout. Work the sequence instead. Start with process: is there an innocent explanation — a promo they were told to honor, a manager routing all comps through their login, a training gap? Ask the managers before you ask the employee. Then narrow the window: pull the specific checks, dates and times, and see whether the pattern survives contact with detail. A real scheme usually concentrates — same daypart, same transaction type, often when the same manager is off. If you have cameras, match the three or four worst transactions to footage before you say a word.
If it still looks deliberate, document everything, keep the circle small, and talk to an employment lawyer before you act — wrongful-dismissal claims are real, rules differ by state and province, and a mishandled accusation can cost more than the theft did. In a multi-location group, run the same reports across stores from one console; a scheme that looks like noise in one location becomes obvious when the same signature repeats at two.
A restaurant that treats everyone like a suspect leaks something worse than cash. The operators who keep shrinkage low for years do three things: they pay attention visibly (weekly numbers, announced counts, reports everyone knows exist), they fix the process failures that create temptation (unlogged drawers, shared PINs, comps with no policy), and they act quickly and quietly the rare time it really is theft. What guts a crew is not the controls — it is watching obvious stealing go unpunished while everyone honest carries the shortage.
Cash-adjacent schemes dominate: skimming unrung sales, voiding paid checks, and comp abuse, with bar leakage close behind in venues with heavy liquor volume. They persist because each one keeps the drawer balanced — the loss hides in usage and write-off reports instead, which is exactly where you should be looking weekly.
Pull the void, comp and no-sale reports by employee for the last few weeks and compare each person to the house average for the same role and shift. A real scheme concentrates on one name and one pattern. Verify the worst transactions against camera footage or manager memory before any conversation, and rule out training and process causes first.
They close one specific door: an employee who knows the expected drawer total can skim to the target and hand you a perfect count. When staff count blind and a manager reconciles against the POS separately, a skim shows up as a shortage the same night instead of vanishing into a balanced drawer.
Not on suspicion alone. Document the pattern, verify specific transactions, and get advice from an employment lawyer or HR professional before acting — requirements around cause and process differ across states and provinces. Move fast once you have evidence, but a public accusation you cannot support damages the whole team and exposes you legally.