Investigate

The problem category

Someone at a business has a bad feeling. The numbers don’t quite add up. Money seems to be leaking, but no one can point to where. Somebody has to sit down with the records and find out.

That’s the investigate muscle. You’re handed the ordinary paperwork of a small business, its bills and payments, its cash records, its lists of staff and suppliers, and a plain question: is money being lost, how, and by whom? Somewhere in the honest mistakes and unlucky coincidences sits a real theft by one insider. Your job is to separate the real fraud from the false alarms, name the person responsible, clear the ones who are innocent, add up what was actually stolen, and write it down.

You need no accounting background. No journal entries here. It’s all careful reading, matching one record against another, and grade-school arithmetic. The skill is in the habits, not the bookkeeping.

The one big idea

An anomaly is a question, not a verdict.

The beginner’s move is to find one odd number, one payment to a name they don’t recognize, one night the cash came up short, and announce that they’ve caught the thief. They’re almost always wrong, and they’ve just accused an innocent person.

Real fraud is almost never a single strange number. It’s a pattern that shows up only when someone reads the whole record and connects small things across different pages. Any one anomaly has a boring explanation most of the time: a refund, a typo, a legitimate one-off. The discipline you’re building is to treat every oddity as a question to answer, not a crime already solved. An odd number tells you where to look. It doesn’t tell you what you’ll find.

How to tackle it

1. Split the records by function and read all of them. Payments in one place, cash in another, the names and addresses in a third. The clue that convicts and the clue that clears usually live in different records, which is why one person working alone tends to miss it.
2. Flag the anomalies, but don’t judge them yet. List everything odd. Resist labeling anything “fraud” on this pass.
3. Cross-reference. This is the heart of it. A name, an address, or an amount means almost nothing alone and can mean everything in combination. A payment to a supplier whose address matches an employee’s home. A shortfall that lands on the same person’s shift every time. Hold two records side by side and look for the match. A match is a lead worth chasing, and, like any anomaly, still a question rather than a verdict.
4. Reconcile two records. Compare what should be equal. Cash rung up against cash deposited. Materials bought against materials used. When two records that should agree don’t, the gap is your signal.
5. Clear the innocent on purpose. Naming the guilty party is only half the job. The other half is looking hard at the person a surface flag pointed to and saying, clearly, “not them, and here’s why.” Wrongly accusing someone is a real failure, not a small one.
6. Total only the real theft, and write the one-page report. Culprit, cleared names, every flag marked fraud or false alarm with its evidence, and the amount actually stolen.

The traps

• Accusing the first oddity you find. It’s almost never that simple.
• Skipping the explanation. Before you call a shortfall theft, check for the refund or delivery that explains it. It’s usually one page away.
• Confusing a loss with a theft. A customer’s check bounces and the business loses real money. That’s a loss. Nobody stole it. Keep it out of the theft total.
• Trusting a match too fast. A shared address or a matching name is a strong lead and a weak verdict. Confirm it before you convict on it.

The idea under all of it: segregation of duties

One control would have stopped nearly every theft you’ll investigate, and it has a plain name: segregation of duties. No single person should hold two jobs that let them both commit and hide a theft. Whoever counts the cash shouldn’t also deposit it. Whoever orders supplies shouldn’t also confirm they arrived. Find the culprit and you’ll almost always find someone trusted with two jobs that never belonged in the same pair of hands. That’s the mechanism, every time.

The two shapes of theft

Almost every theft you’ll meet takes one of two shapes, and naming the shape tells you which two records to hold side by side.

The first is money that never arrives. Cash comes in, gets rung up, and then some of it never reaches the bank. That’s skimming, and you catch it by reconciling what was rung up against what was deposited. The money existed. It just went sideways before the deposit slip.

The second is money that leaves for nothing. A payment goes out the door, or a wage gets paid, but no goods, no service, and no work ever came back for it. This is the family of phantom vendors, paying a supplier that doesn’t exist, bogus refunds, recording a refund no customer got, and ghost employees, paying someone who never works a shift. You catch these by asking one blunt question of every payment: what came back for this? When the answer is nothing, you’ve found it.

Materials get their own check, because they’re neither cash in nor cash out. They sit in between, and something bought can walk off before it’s ever sold. So reconcile what was bought against what was actually used or served, counted off a par log or the sales log, and treat the gap as your question.

Worked walkthrough: Skimming at the Window

Sunny has a bad feeling about the cash. Some nights the deposit just seems light. You’re handed four short records, plus a staff list with names and home addresses.

• Record 1, the sales log. What the register rang up in cash, shift by shift.
• Record 2, the deposit log. What actually reached the bank, shift by shift.
• Record 3, the shift schedule. Which cook closed the truck each night, counted the drawer, and made the deposit.
• Record 4, the supplier payments. Money Sunny sent out to vendors.

Step 1 and 2. Read and flag. Reading the sales and deposit logs side by side, four evening shifts come up short.

Shift	Cash rung up	Cash deposited	Short by
Tue, week 1	$310	$265	$45
Fri, week 1	$520	$460	$60
Wed, week 2	$300	$280	$20
Sat, week 2	$540	$505	$35

One thing also jumps out of the supplier payments: a $180 payment to “Delgado Tortillas.” Its address on the invoice matches cook Mara’s home address on the staff list. A payment to a vendor at an employee’s house is the textbook look of a phantom supplier. Tempting to stop right there and write Mara’s name down.

This is the wrong turn, and it’s the one this chapter keeps warning about. An address match is a strong lead, not a verdict. Before accusing Mara, ask what the match implies: if Delgado is fake, the tortillas it billed for never showed up. So check. Turn to the inventory and the receiving notes, and the tortillas are there, delivered and signed for, every order. Ask around, and Delgado Tortillas turns out to be a real, small supplier run by Mara’s cousin, which Mara disclosed when she referred them. Real invoices, goods delivered, normal price. The match had an innocent explanation sitting one record away. Mark it a false alarm, and note that you came within an inch of accusing the wrong person over a coincidence of address.

Step 3 and 4. Explain what you can, then reconcile. Back to the four cash shortfalls. Start with the smallest, Wednesday’s $20. Record 2 has a signed note clipped to that day’s deposit: a $20 cash refund to a customer for a wrong order. The money didn’t vanish, it went back to a customer, with a record. Another false alarm. That leaves three real, unexplained shortfalls: $45, $60, and $35.

Step 5. Cross-reference and clear the innocent. Line the three real short nights up against the schedule.

Short shift	Who closed and deposited
Tue, week 1 ($45)	Dylan
Fri, week 1 ($60)	Dylan
Sat, week 2 ($35)	Dylan

Mara worked plenty of shifts those two weeks, including a couple of busy nights, the same surface flag that gets an innocent person accused and that the address match nearly rode to a conviction. But Mara didn’t close any of the three short nights, and never counted a drawer or made a deposit. Dylan closed all three, counted the cash, and made the deposit each time, one person holding both jobs. There’s the segregation-of-duties failure, and there’s the pattern.

So Mara is cleared, twice over: the Delgado match was a documented, legitimate supplier, and she had no access to the short deposits. A reason, not a hunch.

Step 6. Total and report. Add only the real theft.

$45 + $60 + $35 = $140 stolen.

The Wednesday $20 was a refund. The $180 Delgado payment bought real tortillas. Neither belongs in the total. Here’s the one-page report.

Finding	Verdict	Evidence
Tue/Fri/Sat shortfalls, $140	Fraud	Deposits under cash sales on three nights, all closed and deposited by one person
$180 to Delgado Tortillas	False alarm	Real supplier (Mara’s cousin), goods received and signed for, disclosed
Wed $20 shortfall	False alarm	Signed refund note in the deposit record
Mara	Cleared	Delgado is legitimate; no access to any short deposit
Culprit	Dylan	Closed, counted, and deposited on all three short nights
Total stolen	$140

What good looks like

Neither answer below is a cartoon. The weak one is what a fast, capable team turns in when it trusts a match too quickly.

A weak answer:

“Dylan’s skimming the cash: three short nights, all his, $140 total. And Mara’s running a phantom supplier, Delgado Tortillas, billed to her own address, for $180. Total stolen: $320, two culprits.”

Look at what it got right. It found Dylan, cleanly, off the reconciliation and the schedule. That’s the hard part, and it landed. Then it threw the win away. It convicted Mara on the address match without ever checking whether the tortillas arrived, and they did, and it folded a real $180 purchase into the theft total. One unconfirmed match turned an accurate $140 finding into a false $320 accusation and an innocent second culprit. Trusting a match too fast is the expensive mistake here, not missing the fraud.

A strong answer is the report above: Dylan named with a reason, Mara cleared with a reason, both false alarms set aside, the theft totaled at $140.

Investigate challenges are scored on much the same balance: did you find the real fraud, clear the innocent, get the total exactly right, and avoid crying fraud at the false alarms. Say it plainly: missing a real theft and wrongly accusing an innocent coworker are both failures. You’re not trying to name someone. You’re trying to be right.

A second walkthrough: The Cheese Count

Sunny’s cheese bill keeps climbing, but sales of the quesadillas that eat most of that cheese are flat. Money is going somewhere. You’re handed the material records.

• Record 1, the receiving log. Blocks of cheese delivered and signed for.
• Record 2, the sales log. Quesadillas the register rang up.
• Record 3, the par card. How many quesadillas one block of cheese makes.
• Record 4, the supplier payments, plus the staff list with home addresses and the schedule of who received deliveries and who ran the weekly count.

Step 1 and 2. Read and flag. The supplier payments turn up a $150 payment to “Okafor Dairy.” Its invoice address matches new cook Jordan’s home on the staff list. A vendor paid at an employee’s house is the phantom-supplier look exactly, and it’s tempting to write Jordan’s name down and stop.

This is the wrong turn. An address match is a lead, not a verdict. If Okafor were fake, the cheese it billed for never arrived, so check. The receiving log has every Okafor block, delivered and signed for, at a normal price. Okafor Dairy is a real family creamery Jordan disclosed when he referred them. Real goods, real value. Mark it a false alarm, and note you came within an inch of convicting Jordan over a shared address.

Step 3 and 4. Reconcile bought against used. Now the material check. Count the blocks received: 50 over the period. The par card says one block makes 20 quesadillas, so 50 blocks should carry:

50 × 20 = 1,000 quesadillas.

The register rang up 800. A signed waste log accounts for 2 blocks that spoiled in a cooler outage, tossed and recorded, which is 40 quesadillas’ worth. So the cheese honestly accounted for is:

800 sold + 40 spoiled = 840 quesadillas, which is 840 ÷ 20 = 42 blocks.

Received 50, accounted 42. Eight blocks walked off with no sale and no waste note behind them.

Step 5. Cross-reference and clear. Who could move eight blocks and keep the count clean? Look at the schedule. Dylan both signs the receiving log when cheese arrives and runs the weekly inventory count, one person holding both jobs, the deliveries and the on-hand tally, so nobody independent ever checks his numbers against the shelf. Mara and Jordan cook with the cheese but never receive a delivery or touch the count. The gap surfaced only because you compared purchases to register sales, two records Dylan doesn’t control. So Jordan is cleared, Okafor is legitimate and he can’t reach the inventory records, and Mara is cleared for the same access reason.

Step 6. Total and report. The 2 spoiled blocks are a documented loss, not theft. The Okafor payment bought real cheese. Add only the missing eight blocks, at $17 a block:

8 × $17 = $136 stolen.

Finding	Verdict	Evidence
8 blocks of cheese missing, $136	Fraud	Bought 50, sales and waste account for 42; gap controlled by one person who both receives and counts
$150 to Okafor Dairy	False alarm	Real creamery (Jordan’s family), cheese received and signed for, disclosed
2 spoiled blocks	Loss, not theft	Signed waste log, cooler outage
Jordan	Cleared	Okafor legitimate; no access to inventory records
Culprit	Dylan	Signs receiving and runs the count, so controls both inventory records
Total stolen	$136

Try It: The Short Drawer

Your turn. The worked answer is in Appendix A.

Sunny’s afternoon shifts are under review. Here are four days of cash sales and deposits, and the two cooks who could have closed.

Shift	Cash rung up	Cash deposited	Closed by
Mon	$240	$215	Dylan
Tue	$260	$260	Mara
Thu	$300	$250	Dylan
Fri	$280	$255	Dylan

A clipped note in Friday’s record shows a $25 cash refund for a cancelled catering deposit.

Find the shifts that are genuinely short, mark any false alarm, name who’s on all the real short shifts, clear the other cook with a reason, and total only the real theft.

Work it on paper, then check Appendix A.

More practice

Four more. Each one hands you the records, the same as a real case. Read them, cross-reference, reconcile, and total only the real theft. Work them on paper, then check Appendix A.

1. Two Vendors. Two supplier payments this month, plus a staff address list. Read them together.

Vendor paid	Amount	Invoice on file	In the receiving / service log
Reyes Cleaning	$220	yes	yes, a signed weekly cleaning log
Apex Supply	$300	none	nothing

Staff member	Home address
Sam	14 Oak Street

Reyes Cleaning’s invoice lists its address as 14 Oak Street. Apex Supply’s payment was both ordered and approved by Jordan, who handles supplier payments alone. Which payment is the real fraud, which is the false alarm, who is cleared, who is the culprit, and what is the total theft?

2. The Bounced Check. Two short deposits this week. Here is the record for each.

Day	Sales	Deposited	Short	Note	Closed by
Mon	$610	$460	$150	$150 catering check bounced (bank memo)	two cooks
Thu	$540	$450	$90	none	one cook, alone

What is the real theft here, and what is just a loss?

3. The Extra Name. This month’s payroll, set next to the schedule and clock-in log of who actually worked. Read them side by side.

Paid on payroll	Amount	On the schedule?	Clocked in?
Dylan	$1,800	yes	yes
Mara	$1,600	yes	yes
Sam	$1,750	yes	yes
Jordan	$1,700	yes	yes
T. Rivera	$600	no	never

Sam’s pay ran higher than a normal month, but a signed overtime slip covers the extra hours. Rivera was paid $150 a week for four weeks. Payroll is both run and approved by Jordan, alone. Which payment is the fraud, who is cleared, who is the culprit, and what is the total theft?

4. Case Count. Sunny buys to-go cups by the case, 1,000 cups to a case, at $40 a case. The month’s records:

Record	Figure
Cases received (receiving log)	20
Drinks rung up (register), one cup each	16,000
Cases tossed, crushed on the dock (signed damage note)	1

The person who orders the cups also runs the storeroom count. Reconcile what was bought against what was used, set aside the documented loss, and give the real theft.

Take it live (optional)

Ready to test this muscle for real? Each of the five programs has a bank of live team challenges, run with a facilitator. You don’t need them to finish the book; the walkthrough and practice above already cover the skill. To show you exactly what one looks like, here is a full Investigate case, records and all, with the answer key. Work it yourself, or run it with a team. The other four in this bank stay sealed, so they’re fresh when you compete.

A full challenge: Say Aaah

The setup. Lakeside Family Dental keeps coming up a little short at the bank. Dr. Owen Pearce is a dentist, not a bookkeeper, so he leaves the bills, the vendor payments, and the front-desk cash deposits to his office manager. He brings you in to look: a mistake, or something worse? The practice has one rule that matters here: no vendor gets paid more than $1,000 without the owner’s sign-off. You have three records.

Record A, payments and vendors. Recent payments, and who approved each:

Paid to	Amount	Approved by
DentalCore (invoice DC-2210)	$640	O. Pearce
DentalCore (invoice DC-2210, again)	$640	O. Pearce
DentalCore (invoice DC-2255)	$980	O. Pearce
Bright Smile Supply Co.	$980	G. Voss
Bright Smile Supply Co.	$960	G. Voss
Bright Smile Supply Co.	$940	G. Voss
Bright Smile Supply Co.	$920	G. Voss

Also in the file: a credit memo from DentalCore (CM-1180) refunding one of the two $640 charges, and the approved vendor list, which shows “Bright Smile Supply Co., office and operatory supplies, no phone, no website, remit to 22 Wren Court.”

Record B, staff roster:

Name	Role	Home address
Owen Pearce	Owner, dentist	8 Lakeshore Drive
Gary Voss	Office manager	22 Wren Court
Priya Nair	Hygienist	15 Maple Street
Tom Ricci	Front desk	40 Birch Lane

Record C, front-desk cash. Patients pay copays in cash, and all of it is deposited by Gary Voss:

Date	Collected	Deposited	Short by
03/12	$340	$240	$100
03/15	$300	$300	$0
03/19	$280	$200	$80
03/22	$360	$260	$100
03/26	$320	$220	$100

A refund slip in the file shows $80 returned to a patient on 03/19.

Your task. Write a fraud report: name the culprit, mark each flag as fraud or a false alarm with its evidence, and total only the real theft.

Facilitator answer key.

• The double DentalCore payment, $640 twice. False alarm. The credit memo (CM-1180) shows DentalCore caught it and refunded one. Net loss $0. Check whether it came back before you call it theft.
• The single $980 to DentalCore. Not fraud, a normal one-off purchase. One payment near the limit isn’t structuring, it’s the decoy.
• Bright Smile Supply Co., four payments. Fraud, $3,800. Cross-reference the vendor’s remit address, 22 Wren Court, against the roster: it’s Gary Voss’s home. A vendor with no phone or website, paid at the office manager’s own address, in four amounts each just under the $1,000 sign-off limit, all approved by Gary himself. A phantom vendor funneling money to Gary.
• The cash shortfalls. Fraud, $300. Three days short by $100, all deposited by Gary. The 03/19 short of $80 is a false alarm, explained by the refund slip.
• Culprit: Gary Voss. He both approves the payments and deposits the cash, which is what made all of it possible. Total stolen: $3,800 + $300 = $4,100. The lesson under it is segregation of duties: no one person should hold both jobs.

The rest of the Investigate bank

Four more, sealed for fresh scored play. Read every record, treat each oddity as a question, cross-reference and reconcile, confirm a match before you convict, and total only the real theft.

1. The Books Don’t Balance (a coffee shop). More volume, several schemes at once, two innocent coworkers to clear.
2. Out of Step (a dance studio). Money paid up front for lesson packages that never reaches the bank.
3. Down the Drain (a plumbing company). Material theft: what was bought against what was installed.
4. Short Changed (a check-cashing store). Fee skimming, and the sharp lesson that a loss isn’t always a theft.

Going deeper

Real fraud hides in volume, and sometimes in pairs. The next habits are working through many records without losing the thread, and spotting collusion, where two people cover for each other and the segregation-of-duties control fails because both signers are in on it. The bank’s later cases add both.