Stock loss investigations: finding where the shrinkage actually goes

Why a stocktake tells you that stock is gone, never where

A variance is a measurement. It's the difference between what the record says you hold and what the count says you hold. That difference is real and it's worth knowing. But it carries no information about cause. Stock written off as spoilage and stock loaded onto the wrong truck at four in the morning produce the same line in the same report.

This is where most stock loss work goes wrong. Management receives a number, and the number feels like a finding. It isn't. It's the start of a question. The stocktake has established that something is wrong. It has established nothing about what.

Investigations that skip this distinction tend to fail in a particular way. Someone decides the variance means theft, an employee is identified on thin grounds, and the matter collapses at the hearing because there was never evidence of an act, only evidence of an absence. The absence was never in dispute. An absence is not proof of anyone's conduct, and a chairperson will say so.

What causes stock loss besides theft?

Before anyone investigates a person, the cause has to be narrowed. Shrinkage usually has more than one source running at the same time, which is why single-cause theories are so often wrong. The realistic differential diagnosis:

• Administrative and paperwork error: capture mistakes, unit-of-measure confusion, credits never processed, transfers booked once or twice
• Supplier short-delivery: stock invoiced and signed for that never arrived in the quantity recorded
• Spoilage, damage and expiry: real loss, often under-recorded because nobody wants to book it
• Process failure at goods-receiving and dispatch: counts signed without being done, gate controls that exist on paper only
• External theft: opportunistic or organised, sometimes with inside assistance
• Internal theft: by an individual, or through collusion between staff, drivers and suppliers

Each of these produces an identical variance. You cannot tell them apart from the report, and no amount of analysis of the report will separate them, because the information that would separate them was never captured in it.

A firm that assumes theft first will misdiagnose, and will eventually lose the case. It will also cost you twice: once for the loss that was never theft and was never fixed, and again for the damage of an accusation that didn't hold. We say this plainly because it's the part of the work most likely to be oversold to you. An investigator arriving with a conclusion is not investigating.

Why counting harder doesn't find the loss

The usual response to an unexplained variance is another count. Then tighter counts, more often, with more people watching. This is understandable and it rarely works.

A recount re-measures the same variance. It produces a second number of the same kind as the first, and a number of that kind cannot carry cause. If the loss is happening at goods-receiving, counting the shelf more carefully will confirm the shortfall to a finer decimal without ever touching the point where it occurred. If the loss is collusion at dispatch, the count is being taken by people who may already know, and in some cases by the people doing it.

The signal is in the process and the people. It's in what happens at the receiving bay when the truck is late and the queue is long, in who books the waste and who witnesses it, in which controls are performed and which are signed. None of that is visible in a count, and all of it is visible to someone standing there.

What does South African research say about stock loss?

There's less credible South African data on this than the marketing around it suggests, and we'd rather cite one solid study than repeat figures we can't stand behind. Tabane, Phume and Retief (2024), writing in the South African Journal of Economic and Management Sciences, found that stock spoilage and internal theft are the strongest predictors of profitability and sales-volume loss. The study is peer-reviewed and open access, so you can read it and judge it yourself.

Two things about it matter here. The first is its scope, which we won't overstate: it sampled retail SMMEs in the City of Tshwane. It isn't a national figure, it isn't a sector-wide rand value, and anyone presenting it as either has left the evidence behind.

The second is what it actually found. Both spoilage and internal theft appear among the strongest predictors. Not theft alone. That's the differential-diagnosis argument stated in peer-reviewed terms: the thing destroying your margin may well be dishonesty, and it may equally well be product going off in a back room because a process is broken. Assuming which one you have, before establishing it, is how organisations spend money on the wrong problem for years.

How is internal dishonesty usually detected?

Where dishonesty is present, it tends to surface through people rather than through controls. The ACFE Report to the Nations, 2024 found that 43% of occupational frauds are first detected by tips, the single largest detection category, ahead of any individual control. That's a finding about detection method, and nothing more; it isn't a statement about how much fraud costs or what share of loss is caused by employees.

Read for what it is, it explains something practical. The people who know first are the people already inside the operation. They see the pattern because they work next to it. That knowledge doesn't reach management through a control system, because a control system has no way to receive it, and the person holding it has every reason not to put their name to it.

This is the case for placing an auditor inside the workforce. Not to replace controls, but to be positioned where the information actually is.

How Trio Data investigates stock loss

We start from the variance and work outwards to the cause, in roughly this order.

Undercover audit placement. We place a trained system auditor inside your operation in a casual or semi-permanent role, appearing as a bona fide employee. They see the process as it runs when it isn't being watched, which is the only version of the process that explains your stock. This is our flagship capability; the mechanics are set out on our undercover audits page.

Observation of the handling points. Goods-receiving, dispatch, returns and waste. These are where stock changes hands and where records are created, so they're where a discrepancy is either introduced or concealed. We document what's done, not what the procedure says should be done.

Reconciliation against the paper trail. Observation is matched back to delivery notes, waste books, transfers and system records. A gap between what happened and what was recorded is the finding. It's also the difference between a suspicion and something a chairperson can act on.

Forensic evidence work, if dishonesty is established. Where the audit establishes theft or collusion, the matter moves into forensic investigation: corroboration, statements, and a documented chain of evidence. Related capabilities, including surveillance and background clearances, sit under our broader investigations practice.

Handover as evidence. The output is prepared for use, not for filing. What that standard requires is set out on court-ready evidence. An investigation that convinces you internally but falls over at the hearing has cost you the loss and the case.

Finding no theft is a legitimate result

Some engagements end with no dishonesty found. The cause turns out to be a receiving process that was never performed as designed, or spoilage that was real and under-recorded, or a supplier consistently short-delivering against signature.

That's a result. The money was going somewhere, you now know where, and the fix is cheaper than the loss. It's also a better outcome than the alternative, because nobody was accused of something they didn't do.

We're explicit about this for a reason. An investigator who only ever finds theft is telling you something about the investigator, not about your stock. If the method can only return one answer, it isn't a method. Ours has to be able to clear people, or it can't credibly implicate anyone either.

When to bring in a stock loss investigator

The usual trigger is a variance that survives the obvious explanations: it recurs, it's concentrated in a line or a site, and the recounts keep confirming it without accounting for it. Other signals are behavioural rather than numerical, and we've set out the ones we see most often under signs of internal theft.

Bring someone in before the internal theories harden. Once a name is circulating, the operation changes around it, and so does the evidence.

What you receive

Structured weekly debriefs while the audit runs, so you're not waiting months for a verdict. A documented account of the process as it actually operates, and where the loss is occurring within it. Recommendations you can act on whether or not dishonesty is found. And, where it is found, an evidence pack prepared to an evidentiary standard with an investigator available to support the hearing or court process.

If you have a variance you can't explain, speak to us. The first conversation is confidential and costs nothing.