Theft in the Workplace: Legal Steps for Employers in Australia

Discovering or even suspecting theft in the workplace is stressful for any small business owner. Beyond the immediate financial loss, you’re dealing with trust, team morale and the risk of making a misstep that creates bigger legal headaches.

The good news is that with a calm, methodical approach, you can investigate properly, protect your business, and reduce the chance it happens again. In this guide, we’ll walk through what counts as employee theft in Australia, how to respond, the legal boundaries for any investigation, employment law steps (including standing down, show cause and dismissal), and practical options to recover losses and prevent future incidents.

We’re here to help you navigate the legal side so you can focus on running your business with confidence.

What Counts As Theft In The Workplace?

Employee theft can be obvious or subtle. It’s more than just taking cash from a till. In an Australian small business context, theft can include:

• Stealing stock, tools, equipment or cash (including “borrowing” without permission that’s never repaid)
• Unauthorised discounts or refunds, skimming, or manipulating point-of-sale records
• Misuse of company credit cards, fuel cards or expense accounts
• False timesheets, ghost shifts or inflating hours
• Unauthorised transfer or sale of company property or confidential information
• Diverting customers or sales to a competing side business during work time

Legally, this behaviour can amount to serious misconduct. In many cases it’s also a criminal offence. But it’s crucial to avoid jumping straight to conclusions or penalties without proper process - doing so can expose you to unfair dismissal claims or other disputes.

First Steps If You Suspect Employee Theft

When you first spot an issue, it’s natural to feel angry or betrayed. Try to slow things down and follow a clear plan. This reduces risk and preserves evidence.

1) Secure The Situation (Quietly)

Limit access to systems, cash drawers, credentials or areas if needed and practical. Change passwords or suspend specific user permissions. If the suspected person handles money or stock, roster them away from that function while you assess next steps.

2) Preserve Evidence

Don’t edit, delete or overwrite data. Export and safely store relevant POS logs, transaction records, time and attendance data, inventory reports, email records and CCTV footage. Keep an evidence log of what you did and when.

3) Conduct A Preliminary Review

Look for objective indicators of loss: missing stock, duplicate refunds, exception reports, unexplained manual adjustments, or unusual patterns tied to a particular user or timeframe. Keep your initial circle small to minimise gossip and protect procedural fairness.

4) Decide Whether A Formal Investigation Is Needed

If there’s a credible basis, move to a formal, documented process. This will usually involve a show cause process and an opportunity for the employee to respond (more on this below). If the situation is serious and you need the person away from the workplace, consider whether standing them down on pay pending investigation is appropriate.

Can You Investigate Lawfully? Surveillance, Privacy And Evidence

It’s important to investigate in a way that’s lawful and fair. The rules can vary by state and by the type of surveillance. If in doubt, get advice before you act.

Using Cameras And Monitoring

Most businesses rely on CCTV or other monitoring to check for theft. You must comply with workplace surveillance laws, including notice requirements and signage. If you’re assessing your current setup, a good place to start is understanding cameras at work and broader CCTV laws in Australia.

Audio recording (for example, microphones near a till) can be more restricted than video. If you plan to record or monitor calls with customers or staff, make sure you comply with recording calls rules, which differ across states and may require disclosure or consent.

Accessing Emails And Devices

Many businesses control company email and devices. You can usually access business-owned accounts and hardware for legitimate reasons, but this should be covered in your policies and communicated to staff. Keep the review proportionate and focused on what’s necessary for the investigation.

Collecting And Handling Personal Information

During an investigation, you may collect personal information (e.g. names, footage, statements). Handle it securely and limit access to only those who need to know. Keep notes factual. If you run a website or digital platform, make sure you have a clear Privacy Policy and internal practices to protect data.

Working With Police

If the suspected conduct appears criminal (for example, cash theft or large-scale fraud), you can report it to police. Provide copies of your evidence and timelines. If police are involved, coordinate your internal process with any police request so you don’t compromise their investigation.

Managing The Employment Process: Stand Down, Show Cause And Dismissal

Even if you believe the evidence is strong, fairness matters. Employers who rush to dismiss without a proper process risk unfair dismissal claims and other disputes. Here’s a sensible framework.

Standing An Employee Down Pending Investigation

Where appropriate, you can consider temporarily removing an employee from certain duties or from the workplace while you investigate. This is a sensitive step and should be used reasonably. For guidance on when this is appropriate and the practical steps involved, read about standing down an employee pending investigation.

Provide A Show Cause Opportunity

Before taking disciplinary action, issue a clear, written invitation to respond (often called a show cause letter). Set out the specific allegations, the evidence you’re relying on, and give a genuine opportunity for the employee to respond, provide their version of events, and submit any relevant information.

Consider The Response And Decide An Outcome

Assess the response with an open mind and test it against your records. Consider whether the conduct is substantiated and, if so, the appropriate outcome (e.g. warning, training, demotion, termination). Keep your decision notes and the reasons for your decision.

Dismissal For Serious Misconduct

Theft will often amount to serious misconduct that can justify summary dismissal. However, the Fair Work Commission will look closely at whether the dismissal was harsh, unjust or unreasonable. It weighs factors such as whether you had a valid reason, whether you notified the employee, allowed them to respond, and whether dismissal was proportionate, which are the core unfair dismissal factors under the Fair Work Act.

Get the basics right: give clear allegations and evidence, allow a reasonable response time, permit a support person if requested, and keep a paper trail. This procedural fairness greatly reduces risk if your decision is later challenged.

Recovering Losses And Protecting Your Business

Once you’ve addressed the employment side, you’ll naturally turn to recovering any loss and shoring up your systems. Your options will depend on the size of the loss, the evidence available and the employee’s cooperation.

Can You Deduct From Final Pay?

As a rule, you can’t unilaterally deduct money from wages to “penalise” an employee - even if you suspect theft. Deductions are tightly regulated and must fit within the Fair Work Act framework (for example, they must be authorised in writing and principally for the employee’s benefit, or required by law or a court order). If you are considering a deduction or set-off, make sure it aligns with section 324 of the Fair Work Act and your award or agreement. If it doesn’t fit, seek another recovery path.

Repayment Agreements And Settlement

If the employee admits wrongdoing, a practical approach can be a written repayment plan. This might be formalised in a Deed of Settlement that sets timelines and consequences if payments are missed. Keep the repayment terms realistic and ensure the document is properly drafted and signed.

Insurance And Police Reports

Check your insurance policies. Some business insurance covers employee dishonesty or theft. Insurers will require evidence and, in many cases, a police report. Lodge claims promptly and keep records of your correspondence.

Civil Recovery

For significant losses, consider civil recovery options. This could include issuing a letter of demand and, if unresolved, commencing proceedings. Take a commercial view: weigh legal costs, evidence strength and the likelihood of recovery before you proceed.

Strengthen Prevention Measures

The best outcome is to reduce the chance of a repeat. Focus on people, process and tech:

• Segregate duties: separate cash handling, reconciliation and refunds where possible
• Limit permissions: set role-based access to POS, accounting and inventory systems
• Use exception reports: monitor voids, manual price overrides, after-hours access and high-risk transactions
• Audit regularly: conduct random and scheduled stocktakes; reconcile cash and EFT settlements daily
• Rotate rosters: avoid a single person controlling a process end-to-end for extended periods
• Update surveillance: ensure your CCTV is placed lawfully and actually reviewed when exceptions occur
• Reinforce policies: train staff on code of conduct, conflicts of interest, handling cash/stock and consequences for breaches

Get Your Contracts And Policies Working For You

Clear paperwork helps prevent issues and supports you if you need to act. Consider whether your current suite covers:

• Employment Contract: Include clear duties, confidentiality, conflicts of interest, and consequences for serious misconduct.
• Workplace Policies: Set expectations around acceptable behaviour, cash and stock handling, surveillance, IT use and investigations. If you need a tailored set, speak to us about a comprehensive Workplace Policy suite.
• Confidentiality And IP: Use confidentiality clauses (or an NDA for contractors and third parties) to protect sensitive information and client lists.
• Technology And Security: Internal policies for device use, password management and acceptable use make it easier to manage access and audit trails if something goes wrong.

Finally, ensure any monitoring practices are consistent with the law and your own documents. If you update CCTV or introduce new monitoring tools, check your obligations under workplace surveillance and recording laws and make sure staff are notified in the correct way.

Key Takeaways

• Act quickly but calmly: secure systems and evidence, then follow a documented process before making any decisions.
• Investigate lawfully: use surveillance and monitoring within legal boundaries and keep your evidence clean and proportionate.
• Respect procedural fairness: consider standing down an employee pending investigation, provide a proper show cause letter, and keep the unfair dismissal factors firmly in mind.
• Recover losses the right way: don’t make unlawful deductions - check section 324, consider repayment deeds, insurance and (for larger losses) police or civil action.
• Prevent future incidents: strengthen processes, access controls and surveillance, and keep your cameras at work and CCTV laws compliance up to date.
• Use strong documents: robust Employment Contracts and a practical Workplace Policy suite set expectations and make it easier to act when needed.

If you’d like a consultation on handling or preventing theft in the workplace, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.