Restaurant Theft and Cash Control: How to Find It and Stop It

What is small-scale employee theft in a restaurant?

It's the steady taking of small things: a drink that isn't rung in, a to-go portion, a bill from the drawer, a bottle that never gets logged. No single shortage looks serious, which is why it lasts. In Mexico it has a name, robo hormiga, "ant theft," and the national business-victimization survey (ENVE 2024) defines it as theft of goods or supplies on the premises, without violence, done frequently and in small amounts.

Two things to know about that definition. It doesn't say who steals, so it covers employees, customers and suppliers alike. And the survey doesn't separate restaurants from other industries. With that caveat, here are INEGI's figures for 2023: 1,002 small-scale thefts per 10,000 establishments, the third most frequent crime after extortion (1,562) and theft or robbery of goods, money or supplies (1,030). In the commerce sector it was the most frequent. And over 94% of these thefts were never reported or never opened a case file, which INEGI calls the "hidden figure." We couldn't verify an equivalent restaurant-specific figure for the US.

To see what happens inside a business with its own people, the best public source we found is the ACFE's Occupational Fraud 2026 report. The ACFE is the association of certified fraud examiners. The report analyzes 2,402 real cases from 143 countries and territories, investigated between January 2024 and September 2025. It has limits: these aren't restaurant cases (the food service and hospitality row has only 50), they're cases that were already investigated rather than a random sample of businesses, and the dollar figures are in US dollars. Treat it as a map of how theft tends to happen, not as your restaurant's rate. One number that does travel: the typical case ran 12 months before anyone caught it.

Where do restaurants lose money to theft?

They lose it in three places: the cash that comes in, the entries made to take it back out, and the product that leaves through the back door. The ACFE sorts asset theft cases like this:

The shares add up to more than 100% because some cases involved more than one scheme. The ACFE also counts false or inflated invoices (21% of cases, median $90,000) and payroll fraud (10%, $63,000), which in a restaurant means orders to a vendor that doesn't exist and hours nobody worked.

Those categories land in specific places in a restaurant. The list below is operating practice, not a statistic; we found no public data on how much each one weighs in a restaurant:

• The register. Taking payment without ringing it in, or pulling cash at close.
• Comps and discounts. Given to friends or entered without approval.
• Voids after payment. The ACFE's own example: voiding a sale and keeping the cash.
• Receiving. Less product arriving than the invoice says.
• The bar and the kitchen. Bottles that aren't logged, bigger portions for someone.
• Purchasing and payroll. Vendors that don't exist, hours that never happened.

What looks most like small-scale theft is inventory theft and cash taken in small amounts. Inventory theft is the most common scheme in the table, and it's the one a weekly count can see.

How do you control cash, comps and voids?

You control them by splitting three roles that shouldn't sit with one person: who rings, who approves and who counts. These are the practices we'd start from; they're operating practice, not the result of one study:

1. One drawer per cashier. With a signed opening count. If two people share a drawer, a shortage has no owner.
2. Blind close. The cashier counts what's there without seeing the expected total, and the manager compares afterward. That way nobody adjusts a count to make it balance.
3. A reason and a signature on every comp, discount and void. The reason comes from a short, closed list, and a manager other than the person entering it signs. Nobody approves their own.
4. A daily review by employee and by approver. Look at how many voids and comps each person has, and who signs them. In the ACFE's 2026 cases managers committed 41%, so checking only cashiers leaves out a big part.
5. Complete, on-time deposits. The person who deposits isn't the person who counts.
6. A way to tell you. A number or email that reaches you directly. 43% of the frauds in the report were caught by tips, and more than half of those tips came from employees.

Two controls have numbers behind them. Surprise audits were in place in 44% of the ACFE cases; where they were, the median loss was $74,000 versus $149,000, and detection took 8 months instead of 16. Job rotation or mandatory vacation was in place in 27%, with $65,000 versus $128,000 and 8 months versus 12. These are associations from a case study, not proof that the control caused the result.

One study was done in restaurants. Pierce, Snow and McAfee studied 392 locations from five firms that adopted a theft-monitoring IT product. They found less theft and more productivity, and they attribute the effect mainly to changed worker behavior rather than to workers leaving. Our reading: when people know someone checks, they act differently.

We found no void or comp percentage that works as a reliable threshold. Compare each person to your own history and to peers on the same shift, not to a number from the internet.

How do you catch inventory theft?

You catch it by comparing what should have been used with what was used, product by product, starting with what's worth the most and easiest to carry out. An order that works:

1. Count the same items every week. Proteins, seafood, liquor, cheese. Have someone who doesn't receive the product count it, without looking at the book.
2. Work out expected usage. What you sold, by each dish's recipe, against what actually went down: opening inventory, plus purchases, minus closing inventory. The gap is the variance.
3. Check receiving. Compare what arrived to the invoice and the order, with someone other than the person who placed it.
4. Log waste with a reason. Waste with no reason is the most comfortable place to hide a loss.
5. Rule out error before you think theft. A shortage often has a simpler cause: mixed-up units (pounds versus cases), portions not followed, outdated recipes, waste nobody logged, a mis-keyed invoice. Accusing someone over a units mistake damages trust across the whole team.

Behavioral signs help less than you'd expect. In the ACFE's 2026 report, 84% of perpetrators showed at least one red flag: living beyond their means (39%), financial difficulties (29%), unwillingness to share duties (12%). But 16% showed none. A red flag proves nothing; a repeated shortage you can't explain does deserve a conversation.

If your count is by eye today, start with a fixed sheet so you always count the same things in the same order:

Food cost & finance

Inventory Count Sheet with Variance

A count sheet and Excel workbook that compares actual usage to POS theoretical usage, so a variance number means something instead of just a total.

ExcelPDF

For the full method, including the actual-usage formula, see the guides on how to take restaurant inventory and on food waste and inventory.

What should you do when you find a theft?

Document before you talk, consult a lawyer before you fire, and move quickly, because in Mexico the window to dismiss for the offense is one month. A case stands on records: the count, the void report, the time, who was on shift, and what you saw yourself. A suspicion isn't a case. What comes next depends on the country.

United States. Every state except Montana allows at-will employment: either side can end it at any time for any reason that isn't illegal. It doesn't apply to people working under a signed contract or a union agreement, or in the public sector (USA.gov). The reason can't be illegal, which includes discrimination and retaliation. We didn't cover state rules on final pay and deductions. And if you claim a tip credit, deducting cash shortages, walkouts or breakage is illegal (Department of Labor, Fact Sheet 15). At-will doesn't excuse sloppy paperwork: write down what you found, when, and who saw it, and keep the reports.

Mexico. Article 47, fraction II, of the Federal Labor Law (LFT) lets an employer end the relationship without liability when a worker commits "faltas de probidad u honradez," breaches of probity or honesty, during work; fraction XV adds analogous causes of equal gravity. The article doesn't use the word theft, so whether a given case qualifies is a question for your lawyer. Separately, article 135, fraction III, bars workers from taking tools, raw material or finished product out of the business.

Procedure matters as much as cause:

• The employer must give written notice stating the conduct and the dates. It's delivered to the worker personally at the moment of dismissal, or communicated to the labor court within five business days (article 47, final paragraphs). Without that notice, the law presumes the separation was unjustified unless proven otherwise.
• In a dispute, the employer has to prove the cause of dismissal and that it gave written notice (article 784, fractions IV and VI).
• If the employer can't, the worker can ask for reinstatement or three months of salary, plus back pay for up to twelve months (article 48).
• The clock runs: an employer's actions to dismiss or discipline expire in one month, from the day after learning of the cause (article 517, fraction I).

Colombia. Article 60, number 1, of the Substantive Labor Code (CST) bars workers from taking tools, raw materials or finished product out of the establishment without the employer's permission. Article 62, letter A, numbers 5 and 6, lists as just causes for termination an immoral or criminal act at the workplace and a serious breach of the article 60 prohibitions. Article 115, as amended by article 7 of Law 2466 of 2025, sets a procedure for disciplinary sanctions: formal notice that the process is open, the facts in writing, the evidence shared with the worker, at least five days to respond, a reasoned decision, and a right to appeal. Employers with fewer than ten workers only have to hear the worker first (paragraph 6). Whether that procedure also governs a for-cause dismissal is a question for your lawyer; we didn't settle it.

Criminal reporting is a separate decision from firing. In the ACFE's 2026 report, 54% of cases were referred to law enforcement, and 72% of those ended in a conviction. Among those that didn't refer, 51% thought internal discipline was enough. Decide with your lawyer, not in the office the same day.

How do you prevent theft across multiple locations?

You prevent it with the same controls and the same numbers at every location, and by comparing one location against another, because a gap between locations often points to the problem before any suspicion does. With one restaurant you see the register. With three you don't, and that's where managers end up alone with the cash and the stock.

• Measure the same things weekly, by location. Cash over and short, voids and comps as a share of sales, variance on your ten most valuable products, waste by reason, and food cost against target.
• An outlier is a question, not a conclusion. Before suspecting anyone, check for an event, a menu change or a new hire.
• Have someone from another location count. A surprise audit by a neighboring manager, or by you. In the ACFE report it's among the controls associated with lower median losses, 50% lower.
• Rotate managers now and then. Someone arriving at a new location often sees what the last person stopped seeing. Rotation was in place in 27% of the ACFE cases, with a lower median loss.
• Don't let one person run the whole cycle. The same person shouldn't order, receive and pay. In the report, frauds with three or more perpetrators had a median loss of $324,000 versus $55,000 for one; splitting tasks makes collusion harder.
• Put the controls in writing. Who counts, who approves, which reasons are valid. If the procedure lives in the head of a manager who left, the new location starts with none. The guide on running a multi-location restaurant group gives you a starting point.

And the risk isn't only below you. In the ACFE cases, owners and executives were 16% of cases but had the highest median loss, $475,000. Having someone else look at the numbers above you is part of the control too.

Where do you start this week?

Start with what costs almost nothing and shows quickly. Five steps:

1. Give each cashier their own drawer and a signed opening count.
2. Make the close blind, with the manager comparing afterward.
3. Pick a short list of reasons for comps and voids, and require a second manager's signature.
4. Count five expensive products without warning and compare them to expected usage.
5. Open a channel for your team to tell you directly, and tell them it exists.

That gives you a month of data. If something doesn't add up, use the section above: rule out error, document, and talk to your lawyer before you act.

Where Restaurant Codex fits

Restaurant Codex isn't a POS, accounting software or cameras, and it doesn't analyze your voids or comps. What it does is the counting and the record-keeping. In Inventory, counts are done blind on a phone, by area or store. The system flags counts above book and faster-than-usual use, and a manager confirms or reverts each flag with a reason. It also keeps a waste log by reason, with totals by reason, item and shelf over 7, 30 and 90 days, and shows food cost status, trend and the dollar gap to target, by location. That lets you compare one location against another, which is the hard part.

In Operations, closing lists can require photo proof, and you can compare completion by location. It's a record that something was done, not proof that nobody stole. Meanwhile, a shift handoff log with fixed fields already puts the cash, deposits and comps in writing, with both managers' signatures:

Operations

Manager Shift Handoff Log

A one-page form the outgoing manager fills at close and the incoming manager reads before the floor: staffing, 86's, cash, comps, tomorrow's must-knows.

PDFWord