A missing deposit, inventory variance or questionable vendor payment can create pressure to confront an employee. Yet the same discrepancy may arise from a posting error, incomplete reconciliation or a broken process. Naples business owners are better served by preserving the right records, narrowing the question and obtaining appropriate advice before drawing conclusions. This checklist explains a measured, lawful approach.

Describe the discrepancy without naming a culprit

Write a neutral statement such as “three refunds lack matching return records” or “the closing cash count differs from the point-of-sale report.” Record the dates, locations, systems and amounts involved. Keep allegations out of a shared team chat until the facts are established. A narrow question makes review faster and reduces the risk of unfairly targeting one person. Separate confirmed facts from explanations, assumptions and missing information. A refund approved by one manager may have been entered by another; a delivery may have been logged a day late. Test alternatives rather than adopting a preferred theory.

Secure business records before they disappear

Preserve authorized copies of relevant point-of-sale reports, inventory adjustments, invoices, vendor master changes, payroll approvals, shift rosters, delivery logs and bank reconciliations. Include the report period and settings used to export each item. For physical records, retain originals in a controlled location and work from copies. Some systems overwrite logs or recycle video according to retention settings. Ask the administrator or counsel to implement an appropriate preservation hold promptly. Do not delete unfavorable entries, alter timestamps or clean up a database before review. If litigation is reasonably anticipated, obtain legal guidance on preservation duties.

Identify access rights and control weaknesses

Review the company’s approved permission matrix: who could issue refunds, adjust stock, change vendor bank details or close the register? Compare role permissions with dated system events. A username alone may not identify the person who performed an action if credentials were shared, terminals remained logged in or approvals were delegated. Check written policies for access, cash handling, dual approval and incident reporting. Document policy exceptions objectively. The investigation should examine process weaknesses alongside individual actions; a control failure can explain repeated discrepancies even when no theft occurred.

Reconcile independent records, not one spreadsheet

For a retail or hospitality operation, compare transaction records with deposit slips, inventory movements, purchase orders and receiving documents. For a professional office, match invoice approvals to vendor contracts and bank payment confirmations. Each source answers a different question; agreement across independent sources is stronger than one spreadsheet. Record exceptions in a table showing transaction identifier, amount, system source, supporting document and status. Flag unresolved entries without converting them into a loss total. An unexplained amount is not automatically stolen money, and an estimate should never be presented as a proven financial finding.

Plan interviews without intimidation

Have counsel or an appropriately trained manager plan interviews. Decide who will ask questions, what records will be discussed and how the conversation will be documented. Start with process questions: who handles returns, when are corrections made and how are exceptions approved? Give people a fair opportunity to clarify a discrepancy. Avoid threatening criminal charges to force repayment or a confession. Do not disclose suspicions to customers, vendors or employees without a legitimate need to know. Employment decisions, reporting and recovery efforts can involve labor, contract and criminal-law considerations beyond a private investigator’s role.

Respect Florida recording and account-access rules

Florida’s Section 934.03 generally restricts interception of protected communications, with specified exceptions including consent from all parties. Do not assume that being the employer permits secretly recording a private conversation. Ask counsel to assess any proposed recording, monitoring or interview procedure. Section 934.21 addresses unauthorized access to stored communications. A business investigation is not permission to open an employee’s private email or personal accounts. Use only systems and records the business is lawfully entitled to access, and preserve existing access controls.

Maintain a custody and review log

For each retained item, note the custodian, collection time, source system, original filename or physical identifier and every transfer. Where appropriate, a qualified digital specialist can make forensic copies and document integrity checks. Ordinary screenshots may be useful leads, but cropped images can omit context or metadata needed for later review. Restrict access to those with a legitimate business need. Store sensitive employee, customer and financial information securely and follow applicable retention and privacy requirements. If litigation is possible, counsel should coordinate preservation rather than leaving managers to gather conflicting versions.

Know when to involve counsel, police or specialists

An attorney can assess reporting duties, employment decisions, insurance notice provisions and whether a suspected loss should be referred to law enforcement. Florida’s theft statute defines criminal theft, but a private internal discrepancy does not establish that its elements are met. Avoid promising a particular criminal outcome. A forensic accountant may be appropriate for complex financial reconstruction; a digital forensics professional for disputed system activity. The right sequence depends on urgency, retention, employee safety and whether ongoing access needs to be restricted through lawful company procedures.

How a licensed Naples investigator can assist

A licensed investigator can develop a factual chronology, compare public and authorized business records, document relevant connections and assist with lawful interviews or scoped inquiries. Spyglass Investigations does not guarantee that a suspect will be identified or money recovered. Reports should distinguish what was verified, what remains disputed and what requires expert interpretation. Our business investigations and identity verification can complement counsel’s plan. For preventive research, see our Naples business identity checklist and partner due diligence guide. Request a confidential consultation with the discrepancy, date range and systems involved.