A discrepancy is a signal, not a conclusion.
A manager runs a till audit at the end of a shift and finds the drawer is $42 short. What happens next determines whether the business handles the situation like a professional operation — or creates a much bigger problem than the $42.
Most managers make one of two mistakes:
- They ignore the discrepancy entirely.
- They assume theft immediately.
Both are wrong. Both create risk. One quietly normalizes loss. The other damages morale, exposes the business to wrongful- accusation claims, and — worst of all — almost never resolves the actual cause.
"A failed till audit is not proof of theft."
Effective loss prevention is built on facts, documentation, coaching, accountability, and root-cause analysis. A till variance is the start of that work, not the end of it.
Section 1 — The Biggest Mistake Managers Make
The single biggest mistake in operational accountability is treating an outcome like a verdict. A short drawer is an outcome. A missing case of product is an outcome. An audit that didn't reconcile is an outcome. None of those things, by themselves, identify a cause.
Why immediate accusations damage the business
- They destroy trust with honest employees, who almost always outnumber dishonest ones.
- They expose the business to defamation, wrongful-termination, and discrimination claims if the accusation turns out to be wrong.
- They prematurely close the investigation — once you've accused, you stop looking, and the real cause stays in place.
- They teach the team that the manager reacts emotionally to numbers. People stop reporting their own mistakes.
Why ignoring shortages is just as dangerous
- Small variances become "normal" — until they are large enough that nobody can explain them.
- Employees learn that accountability is optional. Performance drifts in every other operational area.
- When real theft does occur, there is no documentation history to support corrective action.
How operational issues mimic theft
A short drawer can look identical to skimming. A missing pallet can look identical to shrinkage. The job of the manager — and of the LP function — is to separate facts from assumptions before deciding what kind of problem this actually is.
Section 2 — Understanding What a Failed Till Audit Actually Means
Before you can respond to a variance, you have to understand what kind of variance it is. They are not all the same.
| Finding | What it often indicates |
|---|---|
| Shortage | Cash missing — could be a mis-ring, a customer dispute resolved off-receipt, a refund handled incorrectly, a register-sharing error, or, in rare cases, dishonesty. |
| Overage | Cash more than expected — frequently a mis-ring or a customer who waved off change. Overages can be just as indicative of dishonesty as shortages and should never be dismissed. |
| Single-event variance | A one-time discrepancy with no prior pattern. Most often a process or training issue. |
| Repeated variance | A pattern across days, shifts, or registers. Always warrants pattern analysis — by employee, register, day, and shift. |
| Variance with refund / void / no-sale spike | A combination that demands transaction-level review. Often a signal to escalate from coaching to investigation. |
| Variance with register sharing | Accountability gap. Cannot reliably be assigned to one person and is typically a process failure. |
What a failed audit identifies — and what it doesn't
A failed audit identifies that a problem exists and where it showed up. It does not identify who caused it, why it happened, or whether intent was involved. That work comes next.
Section 3 — Step 1: Gather Facts Before Coaching
Coaching without facts is just opinion. Before you speak to the employee, review the operational picture:
- The till audit findings (counted twice if necessary)
- Transaction history for the shift
- Voids — frequency, amounts, manager approvals
- Refunds — receipts attached, returns logged, customer present
- No-sales — frequency and timing
- Shift coverage — who else used the drawer, any handoffs
- Customer volume and operational pressure during the shift
- Any operational challenges (system outage, short staffing, training shift)
- Previous coaching records on this employee or register
Practical example
A drawer is $30 short. Before any conversation, the manager pulls the journal and sees three voids in a 20-minute window during the lunch rush, all on the same register, all approved by an off-shift supervisor by phone. Two cashiers used the drawer in that window. That is a process problem, not a personnel problem — and now the coaching conversation is about register accountability and void protocol, not honesty.
Section 4 — Step 2: Conduct the Coaching Discussion
Coaching is a structured conversation. It has a purpose, a format, and an outcome. It is not a confrontation, an interrogation, or a hallway comment.
How to run the conversation
- Pick a private space. Don't coach on the floor.
- State the facts, not the assumption.
- Ask open-ended questions and listen.
- Focus on behavior and process — not motive.
- Document the employee's explanation in their words.
- End with a clear expectation for what changes next shift.
Good coaching questions
- "Walk me through how the close went tonight."
- "Were there any transactions that gave you trouble?"
- "Did anyone else use the drawer during your shift?"
- "How were the voids handled when the supervisor wasn't on-site?"
- "Is there anything about the process that you'd change?"
Poor coaching questions (avoid)
- "Did you take it?"
- "Why are you stealing from us?"
- "Do you have something to tell me?"
- "Everyone says it's you."
Coaching: "Your drawer was $42 short tonight. I reviewed the journal and saw two voids and one no-sale during the dinner rush. Talk me through what happened so we can figure out where the variance came from."
Accusation: "You're short $42. Where is it?"
A printable, professionally designed PDF toolkit containing the Employee Coaching Form, Failed Till Audit Review Worksheet, Manager Coaching Guide, and the Coaching-or-Investigation Decision Tree.
Section 5 — Step 3: Document Everything
Documentation is what turns a one-off conversation into a defensible record of operational accountability. Verbal coaching that isn't written down didn't happen.
What every coaching record should include
- Date and time
- Location / store
- Employee name and position
- Manager conducting the coaching
- Observed issue (specific, factual)
- Facts reviewed (audit, journal, voids, refunds, no-sales, coverage)
- Employee explanation, in their words
- Corrective action provided
- Follow-up expectation and date
- Both signatures, if the company's policy supports them
Good documentation vs. bad documentation
| Bad documentation | Good documentation |
|---|---|
| Cashier was short. | On 06/12 at 22:14, Register 2 audit showed a $42 shortage at end-of-shift count, manager S. Lee. |
| Talked to her about it. | Reviewed transaction journal: 2 voids and 1 no-sale during 18:40–19:05. Two employees used the drawer during that window without re-count. |
| Said she didn't do anything. | Employee explained: register was shared with co-worker R. Patel during dinner rush; voids approved by phone by off-site supervisor. |
| Told her not to do it again. | Coaching provided on register-sharing protocol and void documentation. Expectation: no shared drawers without a mid-shift recount. Follow-up audit scheduled within 7 days. |
Who documentation protects
- The business — defensible records support fair corrective action and reduce legal exposure.
- The manager — protects against "you never told me" claims and uneven enforcement allegations.
- The employee — protects honest performers from being unfairly suspected later by capturing process context in the record.
Section 6 — Step 4: Determine Corrective Action
Corrective action should match the facts. Process problems get process responses. Performance problems get performance responses. Dishonesty problems get investigations.
| Situation | Appropriate response |
|---|---|
| First-time variance, no pattern, plausible operational cause | Additional training and verbal coaching, documented. |
| Recurring variances without a clear cause | Written coaching, expectation reset, follow-up audit within a defined window. |
| Pattern of variances despite coaching | Performance Improvement Plan with measurable accountability and a monitoring period. |
| Variance plus transaction anomalies (voids, refunds, no-sales) | Escalate to investigation; pause the assumption that this is purely performance. |
| Falsified records, policy violations, evidence of intent | Investigation, with HR and/or legal involvement as appropriate. |
Progressive accountability — coach, document, retrain, monitor, escalate — protects the business at every stage and gives honest employees the chance to improve.
Section 7 — When Coaching Becomes an Investigation
Coaching is for performance. Investigations are for evidence. The line between the two is not about how serious the variance is — it is about what the pattern tells you.
Escalation triggers
- Repeated shortages tied to the same employee or register
- Excessive voids without documentation
- Refund abuse — no customer, no merchandise, or fake receipts
- No-sale abuse — opening the drawer without a transaction
- Falsified counts or paperwork
- Behavioral indicators inconsistent with a performance issue
- Policy violations (e.g., voiding own transactions, accessing another cashier's drawer)
- Pattern behavior across days, shifts, or locations
Performance vs. negligence vs. policy violation vs. theft
| Category | Definition | Typical response |
|---|---|---|
| Performance issue | Employee makes mistakes due to skill, training, or process gaps. | Coaching + documentation. |
| Negligence | Employee knows the standard but fails to follow it. | Written coaching + monitoring. |
| Policy violation | Employee violates a defined operational rule. | Progressive discipline per policy. |
| Potential theft | Pattern of behavior and transactional evidence suggest intent. | Investigation — not a coaching conversation. |
Section 8 — The My LP Portal Philosophy
The purpose of Loss Prevention is not to catch employees. The purpose of Loss Prevention is to identify and reduce risk. Sometimes the root cause is theft. More often, the root cause is:
- Training gaps
- Process failures
- Operational weaknesses
- Lack of accountability
- Unclear standards
- Inconsistent enforcement
Great managers don't chase symptoms. They solve root causes.
Coaching, documentation, and accountability are the operational backbone of every business that successfully reduces shrink without turning every variance into a confrontation. Treat the first $42 like it matters and you rarely have to deal with the $4,200 later.
Free Toolkit — Built for This Conversation
The Manager Coaching & Documentation Toolkit gives you the exact tools used in this article — printable, branded, and ready for any small business operation:
- Employee Coaching Form
- Failed Till Audit Review Worksheet
- Manager Coaching Guide (one-page quick reference)
- Coaching-or-Investigation Decision Tree
Till audits, incidents, coaching logs, and pattern analysis in one place — built for small business owners and multi-location operators. Free to start.
21+ years in Loss Prevention, Investigations, and Behavioral Analysis. Hundreds of internal theft investigations and millions of dollars in documented loss prevention and risk reduction across retail and small business operations. Ray built My LP Portal to give independent owners the same operational accountability tools large retailers spend entire departments to maintain.
Printable Employee Coaching Form, Failed Till Audit Review Worksheet, Manager Coaching Guide, and Decision Tree — branded, professional, ready to use.
Frequently asked questions
Does a failed till audit mean an employee is stealing?+
No. A shortage or overage is a discrepancy — it is a signal that something didn't reconcile. The cause could be a training gap, a process failure, a customer distraction, a mis-rung transaction, register sharing, or, in some cases, dishonesty. The job of the manager is to gather facts before drawing a conclusion.
What should I do first after a failed till audit?+
Don't speak to the employee yet. First review the till count, transaction history, voids, refunds, no-sales, who else used the register, customer volume, and prior coaching records. The coaching conversation should be based on facts you've already verified — not on the variance number alone.
How do I coach an employee about a shortage without accusing them?+
Stay objective. Describe the facts (date, register, variance, what you reviewed), ask open-ended questions, and document the employee's explanation. Focus on process and behavior, not motive. Coaching addresses what should happen next shift — accusations belong to investigations, and investigations require evidence.
What information should be documented after coaching?+
At minimum: date, time, location, employee, manager, the observed issue, the facts you reviewed, the employee's explanation, the corrective action provided, and the follow-up expectation. Good documentation protects the business, the manager, and the employee — and it is what turns a single conversation into a defensible pattern record.
When does a coaching situation become an investigation?+
Escalate when patterns appear: repeated shortages on the same employee or register, transaction anomalies (excessive voids, refunds, no-sales), falsified records, policy violations, or behavioral indicators that don't match performance issues. Investigations require objectivity, evidence, and — depending on the action — legal review.
Why is documentation so important if no theft is suspected?+
Because operational accountability is built one conversation at a time. Documented coaching turns a one-off mistake into trackable performance data. It supports fair corrective action, protects honest employees from being unfairly suspected later, and gives the business defensible records if the pattern ever escalates.
Related reading
- How to Properly Conduct a Random Till Audit
- How to Identify Cash Register Theft in Small Businesses
- Employee Theft Usually Starts With Process Failure
- Most Employee Theft Starts With Behavior, Not Inventory
- 5 Warning Signs of Employee Theft Owners Miss
- Most Businesses Don't Have LP — They Have Loss Reaction
Run all of this inside one place
My LP Portal turns checklists, audits, incidents, and trackers into a single working system — built for small business owners. Free to start.