You Suspect Parts Are Walking Off: Decision Tree

Why this matters

Suspecting theft is a different kind of problem from a normal inventory variance, because the wrong move does lasting damage. A false accusation can cost you a good employee, poison the whole crew's trust, and expose you to a real legal and personnel mess, and it still will not find your parts. Before you investigate anything, hold this line: you are looking for a cause, not a culprit. Say nothing accusatory to anyone, keep your suspicion to yourself and one trusted person, and let the facts, not a hunch, decide whether there is even a case. Protect people first, investigate second.

First: protect people and process

Lead with restraint, the way you would lead with de-energizing a live circuit. The tempting move, confronting the tech you suspect or airing it to the crew, is the one that burns you.

• Do not accuse, hint, or confront. Not in a hallway, not in a huddle, not "jokingly." An accusation you cannot prove is a wound that does not heal even if you turn out to be right.
• Keep it contained. Loop in only an owner, a manager, or HR, whoever genuinely needs to know. Gossip destroys the investigation and the team.
• Document quietly and factually. Dates, items, counts, who had access. Facts on paper, no conclusions, no names circled.

Is it actually loss, or just bad records?

Most "theft" is an accounting gap wearing a scary costume. Rule that out completely before you go further.

• Confirm it is real, physical loss, not unposted usage, unrecorded receiving, a miscount, or a timing error. Work the reconciliation first. See related: Your Physical Count Doesn't Match the System Decision Tree.
• Rule out normal attrition. Small consumables walk in ones and twos as ordinary use. That is overhead, not a crime.
• Rule out damage and write-offs tossed without a record. A part broken and binned untracked reads as stolen.

If clean records make the gap disappear, there was no theft. This step alone ends most suspicions honestly, and it protects you from accusing someone over your own paperwork.

Is there a real pattern?

Genuine diversion usually leaves a shape. A single unexplained short is noise; a pattern is signal.

• What is going missing? Loss concentrated in high-value, easily-resold items points toward deliberate diversion far more than random shortages across cheap odds and ends.
• Where and when? Losses tied to a specific location, shift, route, or time window narrow the picture. So does loss that started when something changed.
• Who had access? Note who could reach the stock, without deciding that access equals guilt. Access is a filter, not a verdict.

A pattern across several of these is worth acting on. A hunch on one is not.

Tighten controls before you tighten the screws on anyone

The first real intervention is never confrontation. It is control. Most internal loss stops when the opportunity closes, and no one has to be accused at all.

• Secure the high-value stock. Lock it, limit who can pull from it, and require a log entry per pull.
• Make every movement leave a record. Point-of-use logging, verified receiving, recorded write-offs. Accountability that everyone can see deters quietly.
• Watch whether the loss stops. Tightened controls are both a fix and a test. If the shrinkage ends when access closes, you solved the problem without a single accusation.

See related: Catching and Preventing Inventory Shrinkage for the full control set.

If loss continues despite controls

Only now, with clean records, a real pattern, and controls that did not stop it, do you treat this as a personnel matter.

• Hand it to the right people. An owner, HR, or counsel runs this, on documentation, following your own policies and the law. It is not a solo hallway reckoning.
• Never confront alone or on a hunch. Wrongful accusation, defamation, and privacy missteps are real exposures. If evidence points to a crime, the decision to involve law enforcement is the owner's, made deliberately.
• Fix the system regardless. Whatever the outcome, the durable answer is controls that make the next attempt visible and hard.

Recap

1. Protect people first: no accusations, contain it, document facts.
2. Prove it is real loss, not records: reconcile before you suspect.
3. Look for a genuine pattern in what, where, when, and who had access.
4. Close the opportunity with controls, and watch whether the loss stops.
5. Only if it persists, escalate through the right people, never a solo confrontation.

References

• See related: Your Physical Count Doesn't Match the System Decision Tree, Catching and Preventing Inventory Shrinkage
• See related: Parts Inventory Shrinkage Decision Tree, Physical Security for a Shop Full of Tools and Parts
• U.S. Small Business Administration (SBA), loss-prevention and internal-controls guidance
• Trade-standard practice for internal theft investigation and employee-relations handling