Investigate Employee Theft: HR’s Step-by-Step Guide

The Magnitude of the Problem

Employee theft is one of the most financially damaging challenges facing American businesses. According to the Association of Certified Fraud Examiners (ACFE), organizations lose an estimated 5% of their annual revenue to occupational fraud [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. Applied to the global economy, that translates to roughly $5 trillion in losses each year [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. In the United States alone, employee theft costs businesses an estimated $50 billion annually [2]Verified Employee Theft Statistics and Costs to U.S. Businesses
Confirms $50 billion annual employee theft cost, 75% employee theft admission rate, and U.S. Chamber of Commerce estimates..

The ACFE's Occupational Fraud 2024: A Report to the Nations analyzed 1,921 actual fraud cases from 138 countries, revealing total losses exceeding $3.1 billion [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. The median loss per case was $145,000, and the average loss per case reached $1.7 million [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. These figures represent a 24% increase in median losses compared to the 2022 report [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases., underscoring the growing severity of the problem.

The U.S. Chamber of Commerce estimates that three out of four employees have stolen from their employers at least once [2]Verified Employee Theft Statistics and Costs to U.S. Businesses
Confirms $50 billion annual employee theft cost, 75% employee theft admission rate, and U.S. Chamber of Commerce estimates.. An astonishing 95% of U.S. businesses have been affected by employee theft at some point [2]Verified Employee Theft Statistics and Costs to U.S. Businesses
Confirms $50 billion annual employee theft cost, 75% employee theft admission rate, and U.S. Chamber of Commerce estimates.. Employee theft is a contributing factor in 33% of corporate bankruptcies in the United States [3]Verified Employee Theft: Legal Aspects — Estimates of Cost
Confirms U.S. Department of Commerce estimate that one-third of all business failures trace to employee theft., and one-third of all business failures each year can be traced to employee theft and other employee crimes [3]Verified Employee Theft: Legal Aspects — Estimates of Cost
Confirms U.S. Department of Commerce estimate that one-third of all business failures trace to employee theft..

Types of Occupational Fraud

The ACFE classifies occupational fraud into three primary categories. Asset misappropriation — the theft of company resources such as cash or inventory — is the most common, occurring in 89% of all cases with a median loss of $120,000 [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. Corruption, including kickbacks, bribes, and extortion, is involved in 48% of cases with a median loss of $200,000 [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. Financial statement fraud is the least common at just 5% of cases, but it is by far the most costly, causing a median loss of $766,000 per incident [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases..

Notably, 38% of cases involve more than one type of fraud, with the most common overlap occurring between asset misappropriation and corruption at 35% of cases [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. Time theft alone costs employers billions annually, and buddy punching affects 75% of U.S. businesses according to the American Payroll Association [4]Verified Employee Theft Statistics: Time Theft and Buddy Punching Costs
Confirms American Payroll Association finding that buddy punching affects 75% of U.S. businesses.. For more on how polygraph testing helps businesses address fraud, see our guide to polygraph testing for corporate fraud investigations.

How Theft Is Detected

Tips are the most effective fraud detection method, uncovering 43% of all fraud cases — more than three times the next most common method [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. More than half (52%) of those tips came from fellow employees, with customers contributing 21% and vendors 11% [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. Internal audit discovered 14% of cases, and management review caught 13% [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases..

Organizations with anonymous fraud reporting hotlines detected fraud significantly faster and suffered lower losses. In the 2024 study, 71% of victim organizations had a reporting hotline in place, and those organizations experienced median fraud losses of $100,000 compared to $200,000 for organizations without hotlines [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. Reporting methods have shifted dramatically: web-based forms (40%) and email (37%) now surpass telephone hotlines (30%) as the preferred reporting channels [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases..

Critically, the median fraud scheme lasted 12 months before detection [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases., meaning significant damage may already have occurred by the time an investigation begins. Eighty-four percent of fraudsters displayed at least one behavioral red flag before detection, with the most common being living beyond their means (39%), financial difficulties (27%), and unusually close associations with vendors or customers (20%) [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases..

The Employee Polygraph Protection Act (EPPA)

The Employee Polygraph Protection Act of 1988 (EPPA) is the cornerstone federal law governing workplace polygraph use [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. Effective December 27, 1988, EPPA generally prevents most private sector employers from using lie detector tests, either for pre-employment screening or during the course of employment [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. Employers may not require, request, or suggest that an employee or job applicant take a lie detector test, and may not discharge, discipline, or discriminate against anyone for refusing a test or exercising other rights under the Act [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action..

Government agencies at the federal, state, and local level are exempt from EPPA [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. The Act also permits limited exemptions for certain private employers, including security firms (armored car, alarm, and guard companies), pharmaceutical manufacturers, distributors, and dispensers, and employers conducting specific ongoing investigations [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. Understanding these exemptions is essential before introducing polygraph testing into any theft investigation. For a comprehensive overview, see our complete EPPA guide for employee rights.

Leonard Saxe's analysis of EPPA two decades after its passage confirmed the Act successfully banned most private employer polygraph use while maintaining carefully defined exceptions for government, security, and pharmaceutical industries [7]Verified Employee Polygraph Protection Act: 20 Years Later
Confirms EPPA successfully banned most private employer polygraph use while maintaining defined exceptions for government, security, and pharmaceutical industries..

EPPA's Ongoing Investigation Exemption

For HR managers conducting theft investigations, the most relevant EPPA provision is the ongoing investigation exemption under Section 7(d). This exemption permits an employer to request (but never require) an employee to submit to a polygraph test if four specific conditions are met [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.:

1. The test is administered in connection with an ongoing investigation involving economic loss or injury to the employer's business, such as theft, embezzlement, misappropriation, or industrial espionage or sabotage. 2. The employee had access to the property that is the subject of the investigation. 3. The employer has a reasonable suspicion that the specific employee was involved in the incident or activity under investigation. 4. The employer executes a written statement, provided to the examinee before the test, that sets forth with particularity the specific incident, the basis for testing, is signed by an authorized company representative (not the polygraph examiner), and is retained by the employer for at least three years [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action..

The Department of Labor regulations make clear that this exemption is limited to specific incidents. Random polygraph testing is prohibited, and ongoing general inventory shortages alone are not sufficient basis for testing [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. However, testing is permitted when additional evidence identifies specific missing items through intentional wrongdoing and reasonable suspicion exists that the employee to be tested was involved [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. Learn more about when polygraph testing is appropriate in our workplace theft investigation guide.

Penalties and Compliance

EPPA violations carry serious consequences. There is a $10,000 penalty for each violation of the law [6]Verified Employee Polygraph Protection Act (EPPA) — American Polygraph Association Summary
Confirms $10,000 penalty per EPPA violation, employer and examiner compliance checklists, and specific conditions for ongoing investigation testing.. Employees and prospective employees may also bring civil actions against any employer who violates the Act [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. The employer must display an EPPA poster in the workplace explaining the Act's provisions [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action..

Before administering any polygraph test under an exemption, the employer must provide extensive written notice to the examinee, including the right to consult legal counsel before each phase of the test, the nature and characteristics of the examination, a list of prohibited questions, the examinee's right to terminate the examination at any time, and the right to file a complaint with the Department of Labor [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. Failure to provide this information will result in the employer's inability to claim the exemption [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. For additional guidance on workplace polygraph policies, consult our EPPA guide for employers.

Common Warning Signs

Recognizing the early signs of employee theft is essential for timely intervention. The ACFE found that 84% of fraudsters displayed at least one behavioral red flag before their fraud was detected [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. The most common behavioral indicators include:

Living beyond means (39% of perpetrators), financial difficulties (27%), unusually close associations with vendors or customers (20%), and refusal to share duties or take vacations [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. More than half of occupational frauds occurred due to a lack of internal controls or an override of existing internal controls [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases..

Financial red flags include unexplained inventory shortages, cash register discrepancies, missing or altered financial documents, unusual vendor payments, and unexplained adjustments to accounting records. Operational red flags include employees who resist audits, insist on working alone, or refuse to take time off. The longer tenure a fraudster has, the more costly the scheme: losses by owners and executives averaged a median of $500,000 — more than seven times greater than those committed by employees at $60,000 [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases..

When to Launch a Formal Investigation

Not every anomaly warrants a full investigation. HR should establish clear thresholds for triggering formal inquiries. A formal investigation should be initiated when there is a credible tip from an employee, customer, or vendor; when financial discrepancies exceed normal variance thresholds; when audit findings reveal unexplained patterns; or when surveillance or monitoring systems detect suspicious activity.

The decision to investigate should be documented from the outset. Create a written investigation plan that identifies the scope, timeline, team members, and specific allegations being examined. This documentation becomes critical if polygraph testing is later considered under EPPA's ongoing investigation exemption, as the employer must demonstrate that a specific incident is under investigation before any testing can occur [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action..

Core Team Members

An effective internal theft investigation requires a carefully assembled team to ensure objectivity, legal compliance, and thoroughness. The core team should include:

An HR lead to coordinate the investigation, manage interviews, and ensure procedural fairness. An employment attorney (internal or external) to advise on legal compliance, EPPA requirements, and potential liability. A financial or forensic analyst if the theft involves financial records, embezzlement, or complex accounting manipulation. A senior business leader or executive sponsor to authorize investigation steps and make final decisions.

For larger or more complex cases, consider engaging an outside investigator. Independent investigators bring objectivity and specialized experience that can strengthen the investigation's credibility — particularly important if the matter proceeds to litigation or criminal prosecution.

Roles and Responsibilities

Each team member should have clearly defined roles. The HR lead manages day-to-day investigation activities, coordinates interview scheduling, and maintains the investigation file. Legal counsel reviews all employee communications, ensures EPPA compliance before any polygraph testing is requested, and advises on discipline and termination decisions.

The financial analyst examines transaction records, reconciles accounts, and identifies patterns consistent with theft. The executive sponsor provides authority for accessing records and systems, approves investigation expenditures, and makes final employment decisions based on the team's findings.

Confidentiality agreements should be signed by all team members. Information about the investigation must be shared only on a strict need-to-know basis to prevent evidence tampering, preserve the integrity of the investigation, and protect the organization from potential defamation claims.

Types of Evidence to Collect

Before confronting any suspect, secure all available evidence. Evidence in employee theft cases typically falls into several categories:

Financial records: bank statements, general ledger entries, accounts payable and receivable records, payroll data, expense reports, purchase orders, and canceled checks. The ACFE found that funds theft was the most common embezzlement scheme, followed by check fraud [2]Verified Employee Theft Statistics and Costs to U.S. Businesses
Confirms $50 billion annual employee theft cost, 75% employee theft admission rate, and U.S. Chamber of Commerce estimates..

Electronic evidence: email communications, computer access logs, electronic file transfers, security system data, badge swipe records, and surveillance footage. Physical evidence: inventory records, shipping and receiving logs, physical access records, and any tangible items related to the theft.

Witness information: statements from coworkers, supervisors, customers, and vendors who may have observed suspicious activity or have relevant knowledge.

Chain of Custody and Documentation

Proper evidence preservation is critical for both internal decision-making and potential legal proceedings. Establish a chain of custody for all evidence collected. Document who collected each piece of evidence, when it was collected, where it was stored, and who has accessed it.

Electronic records should be preserved through forensic imaging where possible, not simply copied. Surveillance footage should be secured immediately, as many systems overwrite recordings on a rolling basis. Financial records should be obtained from original sources rather than relying on summaries or reports prepared by the suspected employee.

Never alter, annotate, or mark original evidence. Create working copies for analysis and keep originals secured. If the investigation may lead to criminal prosecution, consult with law enforcement about evidence preservation requirements before proceeding.

Interview Strategy and Sequencing

Interview witnesses before suspects. Begin with peripheral witnesses — employees who may have observed unusual behavior or have knowledge of relevant procedures. Progress to direct witnesses who can provide specific information about the alleged theft. Interview the suspect last, after you have gathered maximum corroborating information.

Prepare a detailed interview outline for each witness, tailored to their role and potential knowledge. Ask open-ended questions that allow the interviewee to provide narrative responses rather than yes-or-no answers. Document all interviews in writing, noting the date, time, location, persons present, and a summary of the information provided. For more on the types of questions used during examinations, see our guide to the most asked questions during lie detector tests.

Interviewing the Suspect

The suspect interview is the most sensitive phase of the investigation. Two company representatives should be present for all suspect interviews. Inform the employee of the purpose of the meeting and their right to have a representative present if applicable under company policy or collective bargaining agreements.

Present the evidence you have gathered in a calm, professional manner. Avoid accusations — instead, ask the employee to explain the discrepancies or anomalies identified during the investigation. Allow the employee to tell their side fully before asking follow-up questions.

Document any admissions carefully and precisely. If the employee makes admissions, consider asking them to provide a written statement. Never use threats, coercion, or promises of leniency to obtain admissions. Any confession obtained through improper means may be inadmissible and could expose the organization to liability.

Meeting EPPA's Four Conditions

Polygraph testing is a powerful investigative tool when used appropriately and lawfully. Under EPPA, a private employer may request an employee to submit to a polygraph test during an ongoing investigation only when all four statutory conditions are satisfied [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.:

First, there must be an ongoing investigation involving a specific economic loss or injury, such as theft, embezzlement, or misappropriation [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. Second, the employee must have had access to the property that is the subject of the investigation [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. Third, the employer must have a reasonable suspicion that the particular employee was involved [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. Fourth, the employer must execute and provide a detailed written statement before the test that identifies the specific incident, describes the employee's access and the basis for suspicion, and is signed by an authorized company representative [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action..

This documentation must exist before the test is requested, not after. The written statement must be retained by the employer for at least three years [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. For employers in security and armored car industries, additional exemptions apply — see our theft polygraph guide for security and armored car companies.

The Polygraph as Part of a Broader Investigation

Polygraph testing should be introduced as a late-stage investigative tool, after documentary evidence, witness interviews, and other investigation steps have been completed. The test serves as one component of a comprehensive investigation, not as a standalone determination of guilt or innocence.

The APA's meta-analytic survey of polygraph validity research confirms 89% accuracy for single-issue diagnostic tests based on 38 peer-reviewed studies encompassing 3,723 examinations [8]Verified Polygraph Validity Research — APA Meta-Analytic Survey
Confirms 89% accuracy for single-issue diagnostic tests, 87% combined accuracy across all validated techniques, based on 38 peer-reviewed studies and 3,723 examinations.. This makes the polygraph a valuable tool for identifying deceptive responses and corroborating other evidence gathered during the investigation.

Early research by Winter (1936) demonstrated that physiological measurement showed higher diagnostic accuracy than word association testing for detecting deception in theft cases [9]Verified A comparison of the cardio-pneumo-psychograph and association methods in the detection of lying in cases of theft
Foundational research demonstrating higher diagnostic accuracy of physiological measurement over word association for detecting deception in theft cases.. Modern polygraph technology, enhanced by computerized scoring systems, has significantly improved upon these foundational methods. Learn more about the evolution of polygraph technology in our guide to how software changed the lie detector test.

Selecting a Qualified Polygraph Examiner

Choosing the right polygraph examiner is essential for both legal compliance and accurate results. The examiner should be APA-accredited, having completed a minimum of 400 hours of instruction at an accredited training program [8]Verified Polygraph Validity Research — APA Meta-Analytic Survey
Confirms 89% accuracy for single-issue diagnostic tests, 87% combined accuracy across all validated techniques, based on 38 peer-reviewed studies and 3,723 examinations.. Verify the examiner holds valid state licensure where required, carries professional liability insurance, and has specific experience with EPPA-compliant workplace investigations.

The examiner must comply with all EPPA examiner requirements, including providing proper notices to the examinee, conducting the test according to established protocols, and maintaining appropriate records. A qualified examiner will also ensure the examination environment meets professional standards and that the examinee's rights are fully protected throughout the process.

LieDetectorTest.com provides examiners trained to APA standards experienced in EPPA-compliant workplace investigations at 140+ locations across 23 states. All examiners understand the specific documentation and procedural requirements for lawful employer-requested testing.

Weighing the Evidence

After completing interviews, reviewing documents, and receiving any polygraph results, the investigation team must analyze all evidence and reach a conclusion. The standard of proof in most internal workplace investigations is preponderance of the evidence — meaning it is more likely than not that the misconduct occurred — rather than the criminal standard of beyond a reasonable doubt.

When evaluating the evidence, consider the consistency and credibility of witness statements, documentary evidence supporting or contradicting the allegations, any admissions or confessions obtained during interviews, patterns of behavior or access that align with the theft timeline, exculpatory evidence suggesting the employee was not involved, and polygraph results as one component of the overall evidentiary picture.

EPPA Limitations on Polygraph Results

Under EPPA's ongoing investigation exemption, an employee cannot be discharged, disciplined, denied employment or promotion, or otherwise discriminated against based solely on the analysis of a polygraph test chart or the refusal to take a polygraph test [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. Additional supporting evidence is required [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action.. The evidence used to establish the four conditions for the exemption may serve as that additional supporting evidence [5]Verified Employee Polygraph Protection Act of 1988 (29 U.S.C. 2001-2009)
Confirms EPPA's four conditions for the ongoing investigation exemption, prohibitions on employer use, voluntary nature of testing, and restrictions on using polygraph results as sole basis for adverse action..

This means the polygraph should always be one component of a broader investigation that includes documentary evidence, witness statements, and other corroborating information. The investigation team should document how each piece of evidence — including but not limited to the polygraph results — contributed to the final determination. For more on how polygraph fits into broader workplace policy, see our workplace polygraph policy guide.

Disciplinary Actions

Once the investigation reaches a conclusion supported by adequate evidence, the organization must decide on appropriate action. Options range from verbal or written warnings, suspension, demotion, restitution agreements, termination, or referral for criminal prosecution — depending on the severity and circumstances of the theft.

Consistency in discipline is critical. Apply the same standards regardless of the employee's position, tenure, or personal relationships within the organization. The ACFE found that owners and executives are least likely to be punished for fraud, while staff-level employees are most likely to be terminated [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases. — a disparity that can expose organizations to discrimination claims if not managed carefully.

Document the rationale for every disciplinary decision, including the specific evidence relied upon, the standards applied, and the involvement of legal counsel in the decision-making process.

Financial Recovery and Law Enforcement Referral

Organizations should pursue recovery of stolen assets wherever feasible. Options include negotiated restitution agreements, civil litigation, insurance claims under fidelity bonds or crime policies, and attachment of assets through legal proceedings.

The ACFE reports that nearly half of victim organizations never recover any losses due to fraud [2]Verified Employee Theft Statistics and Costs to U.S. Businesses
Confirms $50 billion annual employee theft cost, 75% employee theft admission rate, and U.S. Chamber of Commerce estimates.. This underscores the importance of swift action and the value of having appropriate insurance coverage in place before incidents occur.

Regarding law enforcement referral, 57% of fraud cases in the ACFE study resulted in a criminal referral [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. The decision to involve law enforcement should be made in consultation with legal counsel, considering factors such as the strength of evidence, the amount of loss, the likelihood of recovery, and the potential impact on the organization's reputation.

Building Effective Anti-Fraud Controls

Prevention is more cost-effective than detection and recovery. The ACFE consistently demonstrates that every anti-fraud control tested was associated with lower fraud losses and faster fraud detection [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. Key preventive measures include:

Establishing an anonymous reporting mechanism (hotline, web-based form, or email channel) — organizations with hotlines experienced 50% lower fraud losses [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. Implementing proper separation of duties so no single employee has end-to-end control of financial transactions. Conducting regular surprise audits and management reviews. Requiring mandatory vacations, which can expose fraud schemes that require the perpetrator's continuous presence.

Fraud training combined with a formal reporting mechanism dramatically increases the likelihood that an organization will receive fraud tips [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases.. Training should cover common schemes relevant to the organization's industry, behavioral red flags to watch for, and how to report suspicious activity without fear of retaliation. For organizations in specific industries, our guides to restaurant employee theft polygraph, warehouse theft investigation, and construction site theft provide tailored strategies.

The Role of Polygraph in Deterrence

Beyond its investigative application, the existence of a well-communicated polygraph policy can serve as a powerful deterrent to employee theft. When employees know that polygraph testing is available as an investigative tool for specific theft incidents under EPPA guidelines, it creates a perception of high detection probability — which the ACFE identifies as one of the most effective fraud deterrents [1]Verified Occupational Fraud 2024: A Report to the Nations
Confirms median fraud loss of $145,000, 12-month median detection time, 43% tip detection rate, 89% asset misappropriation prevalence, 5% annual revenue loss estimate, and $3.1 billion total losses across 1,921 cases..

For organizations in exempt industries — such as security firms, pharmaceutical companies, and high-value asset transport services — pre-employment polygraph screening offers an additional layer of protection. These screenings help ensure that employees with access to valuable assets and sensitive materials are trustworthy before they are placed in positions of responsibility. Our guide to employee reliability and polygraph testing explores these applications in detail.

The combination of strong internal controls, an active reporting culture, and the availability of polygraph testing as an investigation tool creates a comprehensive framework that significantly reduces the risk and cost of employee theft.