Most restaurant theft does not look like a hand in the register. It looks like voids after a check is closed, comps handed to friends, refunds pushed to a personal card, manual discounts, and no-sale drawer opens, all of it recorded in your point of sale. Pull five reports every week, sort them by employee and by time of day, and the patterns show themselves. The Association of Certified Fraud Examiners finds asset misappropriation in about nine of ten fraud cases, and the most common way anyone catches it is a tip followed by a look at the records. Your POS is the record.
In this article
01Why does theft hide in the POS instead of the register?02Which five reports actually matter?03What patterns should make me stop and look?04How do I set the POS up so theft is hard in the first place?05What do I do when a report looks wrong?06How often should I actually look at this?07Questions restaurant owners askWhy does theft hide in the POS instead of the register?
Because the cash drawer is the one thing everybody watches, and the transactions are the thing nobody does. A system trusts whoever is logged in. When a server voids an item, comps a plate or refunds a card, the software assumes there was a reason, and it records the action without arguing.
That is where the money leaves. Not in a dramatic grab, but in small adjustments repeated over months. A comped appetizer here, a voided round there, a refund to a card that never bought anything. Each one is a few dollars, which is exactly why it survives. It is too small to notice on any single night and too regular to miss once you add a month of it up.
The good news is that every one of those actions leaves a line in a report. The theft and the evidence are the same event. You are not investigating, you are reading.
Which five reports actually matter?
Voids. Items removed from a check. A few are normal, a kitchen misfire, a guest who changed their mind. A lot of them, especially after a check has already been paid, are not.
Comps and discounts. Anything given away or marked down by hand. Comps should have a reason attached and a manager behind them. Manual percentage discounts entered by a server on their own tickets are worth a close read.
Refunds and returns. Money sent back to a card or the drawer. A refund with no matching original sale is one of the clearest signals there is.
No-sale drawer opens. The register opening without a transaction. There are honest reasons, making change for the phone till, but a pattern of them on one person's shift is not one of them.
Reopened or adjusted closed checks. A ticket that was paid and then edited. Once a check is closed the total should be settled, and a habit of reopening them to change amounts deserves an explanation.
What patterns should make me stop and look?
The single most useful move is to sort every one of those reports by employee, then by hour. Theft concentrates. It clusters on one person's shifts, and it clusters at the quiet end of a shift when a manager has gone home.
Watch for voids and refunds that spike at close, high-value voids on one server compared to the rest of the team, refunds to a card with no original sale behind them, and the same table number or the same dollar amount showing up again and again. Loss prevention people call this exception-based reporting, which is a formal name for a simple habit: decide what normal looks like, then let the outliers raise their hand.
One number on one night proves nothing. A pattern across three or four weeks, tied to the same person and the same time of day, is a different thing. You are looking for the pattern, not the incident.
A real person calls you back within two hours, Monday to Saturday, 8am to 7pm Central.
How do I set the POS up so theft is hard in the first place?
Require manager approval for voids, comps and refunds above a small threshold, so no single person can remove money from a check alone. That one control does more than any report, because it turns a private action into a two-person one.
Give every employee their own login, a PIN or a fingerprint, and ban shared logins completely. If three servers share one code, your reports cannot tell you who did anything, and every pattern above turns to mush. Individual logins are what make the reports readable in the first place.
Make comps carry a required reason, and keep your auto-gratuity off the tip line where it belongs on its own category, because a POS that blends charges together hides more than tips. If any of that sounds like configuration nobody did when your current system was set up remotely, it usually is, and it is the part we fix in person on install.
What do I do when a report looks wrong?
Slow down. A weird number is a question, not a verdict. Pull the transaction detail behind it: the timestamps, the itemized check, the login that did it. Look at whether it is a one-off or a habit that goes back weeks.
Most of what you find is process, not crime. A manager who voids instead of comping because nobody showed them the difference. A refund workflow so clumsy that staff improvise. Fix the process and a lot of the noise disappears.
For the part that is not process, document what the reports show before you have a conversation, and bring in the right help. This is where you talk to your accountant or an employment attorney rather than acting on a hunch, because how you handle it matters as much as what you found.
How often should I actually look at this?
Weekly, and it takes about fifteen minutes. The trap almost every owner falls into is saving this for the month-end reconciliation, by which point a small habit has had four weeks to grow and to feel normal to the person doing it.
A short weekly read does two things at once. It catches problems while they are still small, and the fact that you do it, and your team knows you do it, is most of the deterrent. Rotate who reviews if you can, so the review itself is not sitting with one unwatched person.
None of this assumes the worst of your staff. Good controls protect the honest majority from suspicion as much as they catch the rest. If you want help setting the reports up so they take fifteen minutes instead of an afternoon, that is a normal part of how we configure a system.
A real person calls you back within two hours, Monday to Saturday, 8am to 7pm Central.
Questions restaurant owners ask
What is the most common way employees steal through a POS?
Adjustments, not the drawer. Voids on checks that were already paid, comps handed to friends, and refunds pushed to a card with no original sale behind them are the everyday methods, because each one is small enough to survive a single night's notice. They add up in the reports over a month, which is exactly where you catch them.
Can I not just trust my managers to watch this?
You can trust them and still build the control, because managers are usually the ones holding void and comp authority in the first place. Requiring a second person for high-value adjustments and giving everyone an individual login is not about suspicion, it is about making sure the reports can actually tell you who did what.
Does requiring manager approval for voids really help?
Yes, more than any single report does. It turns a private action into a two-person one, and most casual theft does not survive needing a second person to sign off. Set the threshold low enough to matter and high enough that it does not slow down a busy Friday for a fifty cent correction.
How do I know what a normal void or comp rate is?
Baseline your own. Pull a few months, work out what your voids and comps run as a share of sales across the whole team, and use that as your normal. You are not chasing an industry number, you are looking for the employee or the shift that sits well outside your own average and stays there.
Is running these reports basically accusing my staff of stealing?
No, and it is worth saying so out loud to your team. Controls and weekly reviews protect the honest majority from ever being under a cloud, because clean reports clear people as surely as messy ones flag them. Most of what a review turns up is a broken process to fix, not a person to confront.
Is this legal or HR advice?
No. It is operational guidance on reading your own system so you can ask better questions. If a review turns up something that looks deliberate, how you handle discipline, accusation and any recovery is a matter for your employment attorney and your accountant. Confirm before you act on anything that affects a person's job.
Vendor pricing and tax rates change without notice. Confirm current figures with the vendor, the city or your accountant before you rely on them. Not tax, legal or accounting advice.
Every number on this page traces to a primary source
- Occupational Fraud 2026: A Report to the Nations, asset misappropriation share and detection by tipacfe.com