Your Till Balances. That Doesn’t Mean Nobody’s Stealing.

I was sitting in my Wimpy one lunchtime and counted eight occupied tables. I took a turnover reading on the till. An hour later, with the restaurant still busy, I took another one. Turnover hadn't moved.

Eight tables of people eating and paying, and the system said nothing had happened. That gap was the first sign of a scheme that had been running quietly for a while, and it had been built by people who understood our point-of-sale system better than I did.

If you are leaving a corporate career to buy a franchise, open a shop or run a restaurant, this is the part nobody prepares you for. In an office, theft is rare, controls are someone else's job and the numbers on the screen are broadly true. In a store, theft is a constant pressure on your margin, the controls are yours alone, and the numbers on the screen are only as honest as the people typing them in. You have to assume theft is happening, and you have to stop assuming your system will tell you when it is.

The numbers

• Organisations lose an estimated 5% of annual revenue to occupational fraud (ACFE, Occupational Fraud 2026: A Report to the Nations, 2,402 cases across 143 countries).
• Businesses with fewer than 100 employees had the highest median loss of any size band, at US$126,000 per case (ACFE, Occupational Fraud 2026).
• Frauds involving three or more perpetrators had a median loss of US$324,000, almost six times the US$55,000 median for a single perpetrator (ACFE, Occupational Fraud 2026).
• A typical fraud ran for 12 months before it was detected, and 43% of frauds were uncovered through a tip (ACFE, Occupational Fraud 2026).
• South Africa ranked third highest of 36 countries for retail shrinkage in the 2008 Global Retail Theft Barometer, at almost 2% of sales, with employee theft responsible for about 37% of it (as cited by Henley Business School Africa researchers, 2023).

Your till is a witness that can be coached

A point-of-sale system records what staff tell it, and in my Wimpy the staff had learned to tell it something convenient. Cashiers were using a manager's override code to void retail bottles of tomato sauce against customers' bills. The bill shrank in the system, the customer paid the full amount in cash, and the difference went into someone's pocket.

What impressed me, in a grim way, was how well the scheme covered its own tracks. A void on a retail line doesn't send a docket to the kitchen, so nobody on the line saw anything strange. When we did stocktakes, the tomato sauce came out over, which looked like customers were simply using less of the free sauce on the tables. Every individual report looked plausible. The till balanced. Stock was, if anything, better than expected.

Notice that a manager's code was involved. That is collusion, and it is the risk that corporate people most underestimate. Segregation of duties works when the people on either side of a control are independent of each other. Once a cashier and a supervisor are working together, the control becomes a rubber stamp. The ACFE's 2026 study found frauds with three or more people involved cost almost six times more than solo ones, and in a small store with a handful of staff on a shift, three people is often the whole team on duty.

The practical implication: never treat a clean system report as proof that nothing is wrong. It proves only that whoever entered the data was consistent.

Look for the things that don't make sense

The scheme in my store fell apart because two pieces of information disagreed: a full restaurant and a flat turnover reading. No single report would have caught it. The lesson I took is that theft hides inside individual data sets and shows up in the gaps between them.

So the job is to keep putting two things side by side that should agree, and to take it seriously when they don't. Some of the cross-checks I would use in any food or retail business:

None of these takes much time once it is a habit. The skill is noticing when something feels off and refusing to accept the first explanation that makes the problem go away.

Count what matters every day

At Wimpy we did stocktakes on key items every day, and it is the single control I would insist on in any food business. You don't need to count everything daily. You need to count the high-value, high-volume items that act as a proxy for the rest.

A menu is a recipe, which makes one shortage a clue to several others. If you are one hamburger patty down, you have probably also lost a bun, a slice of cheese, the garnish and a portion of chips, because those all go out together on a plate. One missing patty is a whole unpaid meal. Counting patties every day tells you far more than the patty count alone.

The same logic applies outside food. A hardware store can track a handful of fast-moving items. A clothing shop can count a rail of its most-taken lines. Pick the items that are valuable, easy to resell or easy to consume, count them at the same time every day, and compare against what the till says you sold.

Daily counts matter because of what the ACFE found on duration: the typical fraud ran 12 months before detection. A monthly or annual stocktake gives a scheme weeks of cover. A daily count of key items gives it a day.

Watch everything that leaves the building

Most of the energy in a store goes into the front door and the till, but a lot of stock goes out the back. In my experience, the places to check are the ones nobody wants to touch.

Waste is the obvious one. A black bag of rubbish going to the bins is a perfect container for sealed product, and nobody wants to open it. We found sealed stock hidden in dirty mop buckets too. Staff bags, the back door during a delivery and the end of a late shift when the owner has gone home are all moments when product can leave without passing a till.

Receiving is the other weak point. Stock that is signed for but never arrives, or arrives and leaves again, never shows on a sales report at all. The Labour Appeal Court considered exactly this in Matsekoleng v Shoprite Checkers (2012), a case built around a receiving clerk and a delivery of milk that was never booked in properly, where the store had brought in an outside company to check deliveries because of high losses at receiving.

The practical step: decide who is allowed to take what out of the building, when and how, and then check it at random. Bags get opened. Waste gets looked at. Deliveries get counted against the invoice by someone other than the person who received them.

Understand why it happens, without excusing it

A 2023 study by Henley Business School Africa and the University of Johannesburg, funded by the W&R Seta, interviewed managers and staff at South African FMCG retailers about why employees steal. The drivers they identified included low salaries, wider economic pressure and peer pressure from colleagues.

That matches what I saw. Staff on low wages, handling cash and stock all day, have a strong incentive to find loopholes, and enough time on the floor to find them. Peer pressure explains why collusion is so common: once a group on a shift is involved, the honest person in that group is the one under pressure.

Understanding this should shape how you design your controls. How you respond when you catch someone is a separate question. Pay fairly, treat people well and make honest work the easier path. Then build controls on the assumption that some people will steal anyway, because some will.

Theft has to be black and white

This is the hardest adjustment for people from corporate environments. Dismissing someone for taking a pie or a few rand from a bill feels disproportionate, especially when you know them and know what they earn. The instinct is to give a warning.

I think that instinct is wrong, and South African labour law broadly agrees. In De Beers Consolidated Mines v CCMA (2000), the Labour Appeal Court held that dismissal for dishonesty is a response to operational risk, and wrote that a dismissal is "not an expression of moral outrage." In Miyambo v CCMA (2010), the same court upheld the dismissal of an employee with about 25 years of clean service at Pretoria Portland Cement for removing a few pieces of scrap metal, and rejected the idea that "technical" theft deserves softer treatment.

The reasoning is the one I came to on my own. Dismissal is about the breakdown of trust, which matters far more than the value of what was taken. And the first time you catch someone is very rarely the first time they did it. If my sauce scheme had been running for months, the bill I caught was one of hundreds.

Being black and white on the outcome doesn't mean being casual about the process. In Shoprite Checkers v Makaloi (2024), the Labour Court upheld the reinstatement of a baker accused of taking sugar, because Shoprite relied on CCTV footage that didn't show every element of the alleged theft and had no stocktake to back it up. The court's problem was with the evidence, and nothing in the judgment suggests taking sugar is acceptable.

So write down that theft of any value leads to dismissal, and make sure every staff member has seen and signed it. Apply it consistently, to the senior cashier as much as the new packer. And gather proper evidence before you act: counts, till reports, footage that actually shows the act, written statements. This is general guidance, not legal advice. Get a labour law specialist involved for any dismissal you expect to be contested.

What this means practically

If you are moving from a corporate role into retail or food, these are the controls I would put in place before opening, not after the first loss:

Restrict void, refund and discount codes to as few people as possible, and review a void report by cashier and by code every single day.

Cross-check your till against something physical every shift: covers, kitchen dockets, a turnover reading at a set time.

Count your key items daily, chosen because their shortages point to other shortages.

Do blind cash-ups, where the cashier counts the drawer without seeing what the system expects.

Check what leaves the building at random, including waste, staff bags and deliveries.

Have someone other than the receiver check deliveries against the invoice.

Turn up at unpredictable times, and rotate staff across shifts and tills so the same group isn't always together.

Give staff a way to report theft anonymously. The ACFE found 43% of frauds were uncovered through tips, more than any other method.

Put a written zero-tolerance theft policy in every contract, and apply it consistently with proper evidence.

The cost of not doing this is easy to underestimate. At an 8% net margin, R500 a day going missing adds up to R182,500 a year, and you would need over R2.2 million in extra turnover to earn that back. In a thin-margin business, theft at that level can wipe out a year's profit on its own, and it competes for the same cash flow you need for fixed obligations like a mandatory franchise revamp.

Frequently asked questions

How much do small businesses lose to employee theft and fraud?

The ACFE's Occupational Fraud 2026: A Report to the Nations estimates that organisations lose about 5% of annual revenue to occupational fraud. Businesses with fewer than 100 employees had the highest median loss of any size band, at US$126,000 per case, across 2,402 cases in 143 countries.

Can you dismiss an employee for stealing something small in South Africa?

South African courts have upheld dismissals for low-value theft where the employer proves the misconduct and applies a clear rule consistently. In De Beers Consolidated Mines v CCMA (2000) and Miyambo v CCMA (2010), the Labour Appeal Court treated dishonesty as a breakdown of trust regardless of value. Weak evidence still loses cases.

How do staff steal through a point-of-sale system?

Common methods include voiding or refunding items after a customer has paid in cash, misusing manager override codes, applying unauthorised discounts and not ringing up sales at all. These often leave the till balanced, so they show up only when sales are compared with something physical, such as covers served or stock counted.

What is the most effective way to detect employee theft?

Tips are the most common way fraud is uncovered, accounting for 43% of cases in the ACFE's 2026 Report to the Nations. In a retail or food business, daily counts of key stock items and comparing till data against physical evidence, such as kitchen dockets and covers served, catch schemes that system reports alone miss.