Four controls stop most restaurant theft before it starts: locked-down POS permissions with exception reporting, daily cash reconciliation with dual sign-off, weekly counts on high-cost inventory, and a written policy staff actually sign. Independent restaurants lose an estimated 3 to 6 percent of gross revenue to theft and shrinkage. Nearly all of it traces back to gaps in these four areas. The rest of this guide breaks each one into steps, thresholds, and templates you can put in place this week.
TL;DR:
- Cash reconciliation and exception reports should be conducted daily, with variances over $15 requiring immediate explanation and manager signature.
- Unique POS logins, manager overrides for voids or refunds, and auto-locking registers are key controls to prevent cash and transaction theft.
- High-cost inventory items should be counted multiple times weekly, and delivery matching with photos and vendor slips reduces food and liquor shrinkage.
- Employee background checks, adherence to written policies, and ongoing manager engagement during onboarding cut down internal theft risks.
- Regular video surveillance focused on key points and linked to POS data helps quickly verify suspicious activities and supports early theft detection.
Table of Contents
- What Are the Most Common Types of Employee Theft in Restaurants?
- How Do You Set Up Cash-Handling and POS Controls?
- Which Inventory Controls Stop Food and Bar Shrink?
- How Do Hiring, Onboarding, and Culture Reduce Theft?
- Where Should You Invest in Monitoring and Analytics?
- What Audit Cadence and Diagnostic Steps Catch Theft Early?
- How Should You Document and Investigate Suspected Theft?
- What Does a Practical Weekly Controls Checklist Look Like?
- Leadership's Role in Preventing Theft
- How Wits' End Solutions Turns These Controls Into a Working System
- Where to Go for Deeper Guidance
- Sources
- FAQ
What Are the Most Common Types of Employee Theft in Restaurants?
Employee theft in restaurants clusters around six patterns, and each one leaves a different trail. Cash skimming happens when a server pockets a cash payment and never rings the sale. Void and refund fraud looks like a legitimate transaction reversal but covers up a stolen item or a pocketed payment. Sweetheart comps give friends and family free food under the cover of a manager discount code. Food and liquor pilferage ranges from a to-go container of shrimp walking out the back door to a bartender pouring double shots for tips. Timecard abuse means clocking in early, clocking out late, or having a coworker "buddy punch" a shift never worked. Vendor collusion, the least visible of the six, involves a receiving manager approving inflated invoices or short deliveries in exchange for a kickback.
Certain red flags show up consistently across restaurants dealing with internal theft:
- One employee's void or comp rate runs several times higher than the shift average.
- Inventory variance on a specific item spikes without a matching sales increase.
- A register consistently comes up short only on shifts one particular person closes.
- Comps cluster around the same tables, times, or "regulars" tied to a single server.
- Deliveries from one vendor show recurring shortages that never get disputed.
Bartenders and servers enable the highest-frequency theft (skimming, comps, overpours) because they touch cash and product directly. Managers and receiving staff enable lower-frequency but higher-dollar theft (comp overrides, vendor fraud) because they hold approval authority. Knowing which role sits behind which risk tells you where to put the first control.
How Do You Set Up Cash-Handling and POS Controls?
Cash and POS controls are where you get the fastest return on effort, because most of them cost nothing beyond a manager's attention. Start with reconciliation: every drawer gets counted at shift close, compared against POS-reported sales, and any variance beyond roughly $15 gets a same-day explanation with a manager's signature, not a shrug. Deposits should require two people, a photo of the counted cash before it leaves the building, and a sealed drop bag logged into a safe rather than a manager's car.
POS permissioning does the rest of the work automatically. Every employee needs a unique login, no shared codes, and voids or refunds above a small dollar threshold should require manager override with a reason code entered at the terminal. Registers that sit idle for more than a couple of minutes should auto-lock. Run an exception report daily that flags voids, comps, and no-sales by employee, and a deeper weekly report that ranks staff by exception rate against the team average, a practice POS vendors themselves recommend as a first line of defense.
Here is what to lock down in the next 24 to 72 hours:
- Assign every staff member their own POS login and disable shared credentials.
- Set manager-approval thresholds for voids, comps, and refunds.
- Turn on daily exception reports for voids, no-sales, and discounts.
- Require dual sign-off on all cash deposits with a photo record.
- Write down the cash variance threshold that triggers an investigation and post it where managers can see it.
Pro Tip: Run the exception report before you run the sales report each morning. Owners who check sales first tend to skip the exception data entirely once the top-line number looks fine.
Which Inventory Controls Stop Food and Bar Shrink?
A perpetual inventory system, one that subtracts theoretical usage from every recipe sold and compares it against what is actually on the shelf, catches shrink that a monthly physical count alone will miss. Tie it to your POS so every plate sold automatically deducts the ingredients that recipe calls for, then count your highest-cost items (proteins, top-shelf liquor, specialty cheeses) two to three times a week instead of once a month.
Bar operations need their own layer of control because pours are harder to police visually than plate costs:
- Use metered pour spouts or a jigger policy enforced through spot checks, not just training.
- Weigh open bottles at shift change to catch overpours in ounces, not guesses.
- Keep the walk-in and liquor cage locked with a key log showing who accessed it and when.
- Rotate who receives deliveries so the same person isn't ordering, receiving, and approving invoices every week.
Receiving is often the weakest link because it happens fast, at odd hours, with one person signing off alone. Match every delivery invoice against a photo or short video of the actual boxes coming off the truck, and require the vendor's packing slip to stay attached to the invoice before it goes to accounting. A partner workflow guide on ordering fresh food lays out how tightening the ordering-to-receiving handoff cuts both waste and disputed shortages. Pairing that with recipe-level yield tracking closes most of the gap between theoretical and actual food cost.
Pro Tip: If your bar's liquor cost creeps up two points over three months with no menu change, that is rarely a supplier problem. Pull the pour logs before you call the distributor.
How Do Hiring, Onboarding, and Culture Reduce Theft?
Theft prevention starts before a new hire ever touches a register. Run legally compliant background checks appropriate to the role, consistent with state and local rules, and never skip them for "just a few shifts a week" hires, since inconsistent screening is itself a liability. From there, onboarding does more work than most owners give it credit for.
A written employee meal and comp policy, signed during onboarding, removes the gray area that lets "sweetheart" comps hide behind confusion about the rules. Pair that with early manager check-ins, because restaurant staffing research points to the first 30 to 90 days as the window where turnover, and the conditions that make theft more likely, get decided. A structured onboarding process that includes a 30-day and 90-day manager conversation catches disengagement before it turns into resentment and resentment turns into a shortcut at the register.
Culture does the rest. Manager training should cover how to read a variance report and how to have an evidence-based conversation with staff, not an accusatory one, since most theft starts small and escalates only when nobody says anything. Build an anonymous reporting channel, whether that's a simple hotline number or a shared document a shift lead can access, and protect whoever uses it. A few operational habits lower the underlying motive to steal in the first place:
- Pay fairly and on time, without surprise deductions staff didn't sign off on.
- Post schedules at least a week out so people aren't guessing at their hours or income.
- Recognize good performance publicly, which costs nothing and reduces the "nobody notices anyway" mindset that precedes small thefts.
Where Should You Invest in Monitoring and Analytics?
Camera placement matters more than camera count. Coverage over registers, the walk-in door, the receiving dock, and every exit catches the transactions and movements that actually correlate with loss, while cameras aimed at dining room tables mostly just watch guests eat. OSHA's guidelines on workplace security recommend this kind of targeted engineering control over relying on staff behavior alone, since a fixed camera doesn't get tired or distracted the way a manager on a busy Friday does.
The real value shows up when POS data and video are linked. A POS-video integration lets a manager click a flagged void or comp and watch the exact thirty seconds of footage tied to it, turning a suspicion into evidence in under a minute instead of scrubbing through hours of tape.
Run these on a fixed schedule rather than only when something feels off:
- Daily: void, comp, and no-sale report by employee.
- Weekly: cash variance dashboard across all shifts and registers.
- Monthly: prime cost trend by category, watching for slow creep rather than sudden spikes.
Multi-location operators should build a remote review cadence, ideally a standing 20-minute weekly session per site, so exception data doesn't sit unread until a P&L surprise forces the question.
What Audit Cadence and Diagnostic Steps Catch Theft Early?
Run audits on a layered schedule: daily drawer checks at shift close, weekly exception report reviews, a monthly theoretical-versus-actual inventory count, and a quarterly reconciliation done by someone outside daily operations, whether that's a bookkeeper, a fractional CFO, or an owner who normally stays hands-off. Separation of duties between ordering, receiving, and reconciling is what actually makes this cadence work, since one person controlling the whole cash cycle is exactly the setup embezzlement depends on.
When the numbers look wrong but nothing obvious explains it, run this three-step check before assuming the worst:
- Compare theoretical ingredient usage against actual inventory pulled, item by item, for your top five cost drivers.
- Pull voids and comps by employee and rank them against the shift average.
- Spot-reconcile cash across three random days in the past month rather than just the most recent shift.
This three-step diagnostic is what experienced operators actually run before calling in outside help. Investigate when a single shift's cash variance exceeds roughly $15, when one employee's comp rate runs three times higher than peers doing the same job, or when bar prime cost climbs two points over three consecutive months with no menu or pricing change. Past that point, bring in a fractional CFO or forensic accountant for the numbers, and loop in law enforcement once you have documented evidence rather than a hunch.
How Should You Document and Investigate Suspected Theft?
Build a documentation file the moment suspicion turns into an active concern: relevant video clips, the transaction logs tied to those clips, an inventory snapshot from before and after the suspected activity, and timestamped notes from anyone who witnessed something. Keep a clear chain of custody on anything you might hand to police or an attorney later.
- Interview to gather facts, not to accuse; ask open questions before presenting evidence.
- Loop in HR or legal counsel before any termination tied to suspected theft, especially before deducting anything from a final paycheck.
- Check state law before searching an employee's belongings or locker, since rules vary widely and getting this wrong creates liability of its own.
- File a police report once you have documented evidence, since prosecutors generally need the transaction logs, footage, and a written timeline, not just an accusation.
What Does a Practical Weekly Controls Checklist Look Like?
A workable routine assigns a specific person, a specific task, and a specific amount of time, because vague ownership is why most control checklists die within a month. One version that works across independent restaurants: the owner spends 10 minutes daily reviewing the cash variance report, the general manager spends 45 minutes weekly on the exception report, and a back-of-house lead spends 30 minutes weekly counting the highest-cost inventory items. Codifying who does what and when is what separates a checklist that actually runs from one that sits in a binder.
- Daily (owner, 10 min): review cash variance and any flagged voids or comps.
- Weekly (GM, 45 min): run the full exception report and rank staff against peer averages.
- Weekly (BOH lead, 30 min): count top five highest-cost inventory items against theoretical usage.
- Monthly (owner or bookkeeper): reconcile full inventory and review prime cost trend.
- As triggered: freeze further access, preserve video and logs, and escalate to counsel or a fractional CFO once thresholds are crossed.
A ready-made operations checklist template gives you a starting structure if you'd rather adapt one than build from scratch.
Leadership's Role in Preventing Theft
Controls exist to protect two things at once: your margins and the reputation of the staff who never touched a dime that wasn't theirs. Treat every variance as a question before it's an accusation, and lead with coaching and evidence, not suspicion. The owners who get this right build systems that catch the rare bad actor without making everyone else feel policed.
— Chris
How Wits' End Solutions Turns These Controls Into a Working System
Reading a controls checklist is one thing. Running it consistently across every shift, every location, every week, is where most operators actually lose the fight against shrinkage. Wits' End Solutions built its analytics reporting specifically to replace the guesswork in variance tracking with a dashboard that flags exception patterns before they become a line item you can't explain. If you suspect theft but can't prove it, secret shopper audits give you an outside set of eyes on cash handling and comp behavior without tipping off staff. And when a situation has already escalated into a real crisis, whether that's a manager under suspicion or a location bleeding margin fast, a task force engagement puts experienced operators on-site to stabilize the business while you sort out next steps. Some consultants have run these controls inside their own restaurants before recommending them. If your variance reports have been raising questions you can't answer, request a controls audit through the Wits' End Solutions services page and get a clear read on where your exposure actually sits.
Where to Go for Deeper Guidance
For the primary standards and checklists behind the controls above, start with OSHA's workplace security guidelines for physical safety and access control, the National Restaurant Association for staffing and hiring benchmarks, and Plante Moran's internal controls checklist for segregation-of-duties frameworks you can adapt to a single-location or multi-unit operation.
Sources
- OSHA — Workplace Violence: Guidelines and Prevention (employer checklist)
- Level CFO — Restaurant financial controls: theft, dine-and-dashes, and cash shrinkage
- Plante Moran — Internal controls checklist: 7 strategies for restaurants
FAQ
What Is the 30/30/30 Rule for Restaurants?
There's no single, standardized "30/30/30 rule" in restaurant finance. It's sometimes used informally to describe rough prime cost splits (roughly 30 percent food, 30 percent labor, plus other costs), but definitions vary widely by segment and region, so treat it as a loose rule of thumb rather than a fixed standard.
What Should I Do if Someone Keeps Stealing My Food at Work?
Document the pattern with timestamps, dates, and specifics before raising it with a manager, since a vague complaint is hard to act on. If it involves company inventory rather than a personal lunch, loop in ownership so it can be tracked as part of the broader theft-prevention routine rather than treated as an isolated annoyance.
How Can a Business Prevent Employee Theft?
The most effective approach combines POS permissioning and exception reporting, daily cash reconciliation with dual sign-off, regular inventory counts on high-cost items, and clear written policies staff sign during onboarding. Layering these controls, rather than relying on any single one, is what catches most theft before it grows, and firms like Wits' End Solutions build audits specifically around this layered approach.
Why Can't Store Employees Stop Shoplifters?
Retail theft and internal restaurant theft are different problems: shoplifting is an external threat that store policy often limits staff from physically confronting, while restaurant employee theft is an internal control issue solved through POS permissions, reconciliation, and inventory tracking rather than confrontation. The prevention tools in this guide target the internal risk, not external shoplifting.
What Inventory Variance Should Trigger an Investigation?
A useful trigger point is a shift cash variance beyond roughly $15, a comp rate running three times higher than peer averages, or a bar prime cost that climbs two points over three consecutive months without a menu change. Any of these three, confirmed with the three-step diagnostic covered earlier, is enough to escalate.