Publication date: September 11, 2026
For a multi-location restaurant or retail business, unexplained loss rarely arrives as one obvious event. It appears as a recurring inventory variance, a group of unusual point-of-sale transactions, inconsistent delivery records, or a pattern that seems limited to one shift or location.
The difficult question is determining what the numbers mean.
A variance may result from incorrect counts, spoilage, portion-control problems, unrecorded waste, receiving mistakes, system configuration issues, or poor training. It may also reflect intentional theft. In some cases, several factors exist at the same time.
That is why a loss investigation should not begin with an accusation. It should begin with documented fact-finding.
Armstrong Investigations, PLLC assists businesses with corporate investigations, professional surveillance, and evidence-focused investigative support throughout the Dallas-Fort Worth Metroplex. For restaurants and retailers in Dallas, Fort Worth, and surrounding North Texas counties, the objective is to identify what happened, preserve relevant records, and help decision-makers evaluate the evidence carefully.
Why multi-location loss requires more than a single inventory count
A single location can often identify a problem through ordinary management review. Multi-location businesses face a more complicated challenge because policies, staffing levels, vendors, equipment, and management practices may vary from store to store.
A loss pattern that appears to be employee theft at one location may actually reflect:
- A recipe or product-unit configuration that is incorrect in the POS system
- Different counting methods used by different managers
- Inconsistent portion sizes or product handling
- Delivery shortages that were not documented at the receiving door
- Unrecorded spoilage, breakage, or employee meals
- A recurring issue with one vendor or delivery route
- An access-control weakness affecting several locations
- A process failure that occurs only during a specific shift
The investigation should therefore compare locations using the same definitions and time periods. Otherwise, management may compare inconsistent data and draw an unreliable conclusion.
Useful comparison points may include:
- Inventory variance by location
- Variance by product category
- Variance by day of the week
- Variance by opening, closing, or overnight shifts
- POS exceptions by terminal and user
- Delivery discrepancies by vendor and route
- Access events around receiving and storage areas
- Manager-on-duty schedules
- Camera coverage and retention periods
A multi-location review can show whether a problem is isolated, operational, or patterned.
Inventory variance is a signal, not a conclusion
Inventory variance is one of the most useful starting points in a restaurant or retail loss investigation. It is not, by itself, proof of intentional theft.
For restaurants, the comparison may involve beginning inventory, deliveries, theoretical usage, waste records, employee meals, transfers, sales, and ending inventory. For retailers, the review may include receiving records, transfers, returns, markdowns, damages, cycle counts, and point-of-sale activity.
A useful investigation asks:
- What quantity should have been available according to the records?
- What quantity was physically present?
- Were the items counted consistently?
- Were units of measure configured correctly?
- Were transfers between locations recorded?
- Were damaged, expired, or discarded items documented?
- Did the variance recur in the same category or time period?
- Did the loss correspond with a particular shift, terminal, or access event?
High-risk categories differ by business. A restaurant may focus on liquor, premium cuts of meat, seafood, specialty ingredients, or high-value packaged goods. A retailer may focus on electronics, cosmetics, designer merchandise, small high-value items, gift cards, or products that can be resold easily.
The key is to avoid treating every variance as misconduct. The investigation should first test ordinary explanations and document whether those explanations are supported by the records.
POS anomalies can reveal patterns hidden in ordinary sales data
Point-of-sale systems contain more information than completed sales. Depending on the system, they may also record voids, refunds, discounts, comps, no-sale drawer openings, price overrides, table transfers, reprints, deleted items, and user activity.
Reviewing these events can help management identify patterns such as:
- Repeated voids shortly after an order is entered
- Refunds issued without a corresponding customer complaint
- Discounts used at unusual times or on unusual products
- Transactions completed under another employee’s credentials
- No-sale drawer openings clustered around a particular shift
- Manual price changes that do not match approved promotions
- Transactions canceled after payment appears to have been accepted
- Repeated reprints or duplicate receipts
- Unusual activity at one terminal compared with others
A POS anomaly does not automatically establish theft. It may reflect a training issue, a busy shift, a system malfunction, a manager correction, or an employee using a shared login because the business has not enforced individual credentials.
The question is whether the event is explainable and whether the explanation is consistent with other evidence.
For example, a high number of voids may be understandable during a software outage. But if the same user has an unusual concentration of voids, the activity occurs after closing, the products do not appear in waste records, and the inventory variance corresponds with those transactions, the matter may justify additional review.
Shift comparisons help separate opportunity from coincidence
Loss patterns often become clearer when analyzed by shift rather than by calendar day.
A restaurant may see a variance primarily during closing shifts. A retailer may experience repeated shortages during opening deliveries, late-night operations, or a particular manager’s scheduled days. Comparing shifts can help identify whether the concern follows:
- A specific employee or group
- A manager-on-duty schedule
- A delivery window
- A terminal or register
- A storage-area access code
- A recurring operational condition
- A location-specific process
The purpose of this analysis is not to label someone responsible before the facts are established. It is to identify where the investigation should focus.
A strong comparison uses similar periods and accounts for legitimate differences. A Friday dinner shift may naturally have different transaction volume and staffing than a Tuesday lunch shift. A high-volume store may show more exceptions simply because it processes more transactions.
Investigators and business leaders should look at rates, patterns, and context rather than relying only on raw totals.
Delivery discrepancies deserve an independent review
In restaurants and retail businesses, loss can occur before products are placed on a shelf, in a cooler, or in a storage area.
A delivery investigation may compare:
- Purchase orders
- Vendor invoices
- Packing slips
- Receiving records
- Shortage and damage reports
- Credit memos
- Return records
- Delivery times
- Names or signatures of receivers
- Video from the receiving area
- Inventory increases after delivery
The basic question is whether the quantity ordered, quantity billed, quantity received, and quantity entered into inventory match.
If records do not match, several explanations may be possible. The vendor may have made a mistake. The delivery may have been incomplete. The receiver may have failed to document a shortage. A product may have been placed in the wrong storage area. A credit may have been promised but never issued. In some matters, the discrepancy may involve coordinated conduct.
Video and access records can provide useful context. They may show how many cases arrived, who handled them, whether a delivery was left unattended, or whether product moved from the receiving area before it was entered into the system.
Businesses should preserve delivery-related video quickly because many systems automatically overwrite older footage.
Access-control records can establish opportunity without proving intent
Access-control information may include badge swipes, keypad entries, electronic lock activity, alarm events, and key logs. These records can help establish who entered a storage area and when.
For a loss investigation, access records may be compared with:
- Employee schedules
- POS activity
- Delivery times
- Inventory counts
- Camera timestamps
- Manager reports
- Closing and opening procedures
- Reported maintenance or cleaning activity
The goal is to build a reliable timeline.
If a high-value storage room was accessed outside normal operating procedures, that event may deserve review. It may also have an innocent explanation, such as a refrigeration problem, maintenance call, emergency restocking, or an authorized manager correcting an inventory issue.
Access records are most useful when they are combined with other evidence. They should not be treated as a stand-alone conclusion.
Businesses should also review whether access codes are shared, whether former employees still have access, whether badge permissions match job responsibilities, and whether camera clocks are synchronized with POS and access-control systems.
Neutral interviews are central to reliable fact-finding
Interviews should be conducted after the investigator understands the basic records and operational procedures. Early conversations with managers, receivers, cashiers, servers, stock associates, and other personnel can clarify how the process works in practice.
A neutral interview may ask:
- How are deliveries normally received at this location?
- Who is authorized to correct an inventory count?
- How are damaged or spoiled products recorded?
- What happens when a customer disputes a transaction?
- Who can approve a discount, void, refund, or comp?
- Are POS credentials ever shared?
- Who has access to the storage area?
- Were there staffing or system problems during the period under review?
- What unusual events occurred during the relevant shifts?
The same basic topics should be covered with people in similar roles. Questions should be specific, respectful, and based on documented events rather than assumptions.
The investigator should record the date, time, participants, documents discussed, and material explanations provided. If an employee identifies another record, witness, or operational issue, that lead should be documented and evaluated.
A neutral process protects the integrity of the investigation. It also increases the chance that process weaknesses will be identified, even when intentional theft is not established.
Evidence preservation should begin before confrontation
Once a business identifies a meaningful loss pattern, it should preserve relevant evidence before making major system changes or confronting individuals.
Potentially relevant materials may include:
- POS exports and exception reports
- Inventory count sheets
- Purchase orders and invoices
- Delivery tickets and credit memos
- Employee schedules
- Access-control records
- Camera footage
- Written policies and training materials
- Waste, spoilage, and damage logs
- Refund and return documentation
- Relevant emails or business messages
- Prior internal reports
Digital records should be exported in a way that preserves the original information when possible. Access should be limited, and the business should document who collected, reviewed, copied, or transferred each item.
A simple evidence log can identify:
- What was collected
- Where it came from
- The date and time of collection
- The person who collected it
- The storage location
- Who later accessed it
- Whether an original or copy was provided
Evidence preservation is not a license to access private accounts, intercept communications, or search personal property without appropriate authority. Workplace policies, Texas law, federal law, and legal guidance may affect what a business or investigator can collect and how it may be used.
Texas regulates investigative services under Occupations Code Chapter 1702. Businesses considering outside investigative assistance should confirm that the provider is properly licensed for the work being performed.
Lawful surveillance can help verify operational facts
Professional surveillance may be appropriate in some loss investigations, particularly when the concern involves repeated after-hours activity, product movement, delivery coordination, or conduct occurring away from the business premises.
Surveillance should have a defined purpose and should be conducted lawfully. It should not involve unreasonable intrusion into private areas, illegal interception of communications, unauthorized access to accounts, or methods that create unnecessary risk for employees, customers, vendors, or the business.
In a multi-location case, surveillance may help verify:
- Whether a scheduled delivery occurred as reported
- Whether products were moved during a relevant period
- Whether a vendor location appears operational
- Whether an employee’s reported work activity is consistent with observable facts
- Whether an external pattern corresponds with internal records
Surveillance is most effective when used alongside POS analysis, inventory review, access records, and interviews. It should support a documented timeline rather than replace one.
What does a private investigator cost for a restaurant or retail loss investigation?
The cost of a private investigator depends on the scope and complexity of the matter. A single-location review involving a defined date range may require a different level of work than an investigation involving several restaurants or stores, multiple data systems, extensive video, interviews, delivery routes, and surveillance.
Factors that may affect private investigator cost include:
- Number of locations
- Length of the review period
- Volume of POS and inventory records
- Number of employees, vendors, or witnesses
- Amount of video requiring review
- Need for field investigation or surveillance
- Travel between Dallas, Fort Worth, and surrounding counties
- Urgency of evidence preservation
- Reporting and chronology requirements
- Coordination with company leadership or legal representatives
A responsible engagement should begin with clear questions, defined deliverables, and an explanation of what information the investigator needs. Businesses should be cautious of selecting solely on the lowest quoted cost. Incomplete collection, poor documentation, or an unclear scope can increase the expense later.
A fact-based path for DFW businesses
Restaurant and retail loss investigations are strongest when they distinguish between what the records show, what the records do not show, and what still requires verification.
For a business operating in Dallas, Fort Worth, Plano, Frisco, Arlington, Richardson, Irving, or elsewhere in Dallas, Tarrant, Collin, Denton, Rockwall, Ellis, Kaufman, or Johnson County, the process may include:
- Defining the suspected loss and relevant dates
- Preserving POS, inventory, delivery, video, and access records
- Comparing locations, shifts, products, and transaction types
- Testing process-based explanations
- Identifying specific inconsistencies that require follow-up
- Conducting neutral interviews
- Using lawful field investigation or surveillance when appropriate
- Preparing a factual report and evidence chronology
- Recommending control improvements based on the findings
Armstrong Investigations, PLLC provides corporate investigations, private investigator services, and professional investigative support for businesses throughout North Texas and the State of Texas. Whether you are searching for a private investigator Dallas businesses can contact about a multi-location loss issue or a private investigator Fort Worth companies can engage for discreet fact-finding, the investigation should be organized, neutral, and evidence-driven.
Learn more about our corporate investigations and due diligence resources, strategic intelligence services, and technology-supported surveillance approach.
Statutory disclaimer
This article provides general educational information about restaurant and retail loss investigations. It is not legal advice and does not create a professional relationship. Texas statutes, regulations, workplace policies, employment practices, privacy rules, evidence requirements, and investigative licensing issues may apply differently depending on the facts. Before taking disciplinary, reporting, surveillance, search, recording, or evidence-preservation action, consult appropriate Texas legal counsel and confirm that any outside investigator is properly licensed for the services provided.
Jasen A. Armstrong, J.D.
Armstrong Investigations, PLLC
P: 214-851-3800 | W: armstronginvestigations.com
Texas DPS Lic. #: 166353101 | Affiliated with TCS Consulting (TX DPS Lic. #: C20493) & Howard Law, PLLC