Dealing with suspected or actual theft, dishonesty or fraud for an employer can be a tricky, difficult and potentially traumatic process — for both the employer and the person suspected of dishonesty says Gillian Howard. Employers need to have clear procedures on how to deal with such misconduct when it comes to their attention.


Dishonesty comes in many forms from stealing cash or goods or the goods of a client or customer to falsification of records such as expenses, application forms or accident reports, etc. It must be distinguished from being caught while on company property in “unauthorised possession” of company property or that of another third party, without permission.

For theft, the employee has to have left the company premises, with the dishonest intention of permanently depriving the lawful owner of their goods/money, etc.

There are also gross misconduct offences of accepting or giving or offering bribes or the taking of secret commissions or the tort of unjust enrichment. This tort occurs when a person unfairly gets a benefit by chance, mistake or another's misfortune for which the one enriched has not paid or worked and morally and ethically should not keep. A person who has been unjustly enriched at the expense of another must legally return the money or benefits.

Accepting or offering or giving bribes are criminal offences under the Bribery Act 2012 and the latter two are common law offences.

There are also dishonesty offences of stealing confidential information, stealing electronic data or databases, deliberate downloading of malware and perpetrating or assisting in the perpetration of cyber-attacks, etc.

Gross misconduct offences

All these offences can amount to gross misconduct and should be clearly stated as examples of gross misconduct and should be listed in the disciplinary procedure as such.

  1. Dishonesty of any kind including knowingly misrepresenting or giving untruthful information (material information) when applying for the job or at interview or at any time during employment, fraud, claiming sick pay when not sick, taking any form of leave without permission etc.

  2. Falsification of company forms or records such as application forms, expense forms etc, or irregular practice in respect of cash, records, returns or accounts including making false expenses claims or overtime or bonus claims.

  3. Giving or receiving bribes; using the company’s information/systems for personal gain, for example, running your own business or the business of another using the company’s computer systems or using company suppliers etc for your own personal business or gain or for another third party’s gain.

  4. Accepting secret commissions or secret profits or diverting a lawful business opportunity.

  5. Stealing confidential information, electronic data or the employer’s databases.

  6. Deliberate downloading of malware.

  7. Perpetrating or assisting in the perpetration of cyber-attacks, etc.

Summary dismissal cannot always be a fair penalty even for such serious offences as “the punishment must fit the crime” (Ladbroke Racing Ltd v Arnott and others [1979] IRLR 192 EAT). Not every technical act of dishonesty necessarily warrants summary dismissal — especially when there is no dishonest intent or motive on the part of the employee, the infringement of the rule is “relatively minor” and there were immediate admissions of what they have done by the employees involved.

Civil standard and burden of proof

Employers and employment tribunals adopt the civil standard of proof and burden of proof.

The civil standard of proof is the balance of probabilities, ie is it more likely than not that the employee committed the act complained of?

The civil burden of proof is that expressed in BHS v Burchell [1978] IRLR 379:

  1. Did the employer have a genuine and honest belief?

  2. In forming that belief, did the employer have reasonable grounds to sustain that belief?

  3. At the final stage at which the employer formed that belief on those grounds, had it carried out as much investigation in the matter as was reasonable in all the circumstances of the case?

Mere suspicion is not good enough and actual proof is not necessary although desirable and probably essential in cases of alleged or suspected theft or fraud, etc.


In terms of how detailed and thorough an investigation is necessary in a suspected and serious criminal offence, it needs to be extensive. In A v B [2003] IRLR 405, the EAT set out the nature and extent of the investigation necessary where a criminal offence has been alleged.

In such a case where the gravity of the charges and the potential effect upon the employee are so serious, the matter must be investigated most carefully and conscientiously. The investigator must concentrate on obtaining evidence which will exculpate the suspected employee or at least try to obtain evidence that will point towards their innocence. This is particularly the case where the employee has been suspended and has been denied the opportunity of being able to contact potential witnesses themselves.

Delay may be fatal

In some cases a delay in the investigation may render the investigation unfair, eg where statements have not been taken in a timely manner or at all, eg leading to fading memories. Delay may be fatal to an employer successfully defending an unfair dismissal claim. The EAT held that:

“If the investigation is defective it is no answer for the employer to say that even if the investigation had been reasonable it would have made no difference to the decision. If the investigation is not reasonable in all the circumstances of the case, then the dismissal is unfair and the fact that it may have caused no prejudice to the employee goes to compensation.”

Vicarious liability

Before the Supreme Court heard Mohamud v WM Morrison Supermarkets plc [2017] I ALL ER 15, the courts had not held employers vicariously liable for the criminal acts of their employees (Heasmans v Clarity Cleaning [1987] IRLR 286 and Vaickuviene v J Sainsbury plc [2014] SC 147).

However in Mohamud’s case the Supreme Court held that each court will need to make an evaluative judgment in each case as to whether or not the employer should be vicariously liable for the criminal acts of its employees.

Mr Khan, an employee at one of Morrison’s petrol stations, had violently assaulted and racially abused Mr Mohamud as he returned to his car on the forecourt. Mr Khan ignored his supervisor’s orders to stop.

The Supreme Court examined the nature of Mr Khan’s job and whether or not there was a sufficient connection between the job and his wrongful conduct to make his employer liable.

They identified Mr Khan’s job as attending to customers and responding to their enquiries. It decided that his attack followed directly on from his interaction with a customer, and his order to the customer to stay away from the premises suggested that he was purporting to act on his employer’s behalf.

Lord Toulson did not consider it right to regard (Mr Khan) “as having metaphorically taken off his uniform the moment he stepped from behind the counter” ie when he pursued Mr Mohamud out of the petrol station and attacked him.

Lord Toulson also concluded that Mr Khan’s motive in the attack was irrelevant. It did not matter whether the attack was racist, or motivated by a desire to benefit his employer’s business.

Using private investigators

Private investigators (PIs) may have a place where the employer has a suspicion of fraud or dishonesty and obtaining proof is the only way to substantiate those suspicions. However, the PIs must adhere to a strict “Code of Conduct” and observe the rights of individuals for respect for their privacy and family life (Article 8 of the Human Rights Act 1998).

The Association of British Insurers (ABI) has produced guidelines on the instruction and use of PIs, September 2014,

Employers should have a detailed contract with the PI setting out what they are required to do and how they should do it and what they must not do, ie trick their way into the employee’s house pretending to do market research and secretly record and/or video them (Jones v University of Warwick [2003] EWCA 151, where the High Court held that this practice was unlawful). Page 12 of the Guidelines referred to above sets out what instructions should be given.

Breach of data protection rights

The taking of covert photographs (images) or using covert CCTV except in rare cases is unlawful, ie the employer has to disclose to the employee in normal circumstances how their personal data is processed and stored and to whom it may be disclosed.

Only under s.29 of the Data Protection Act 1998 (and schedule 1 para 9(1)(a) of the Data Protection Bill 2017) can covert CCTV and other covert methods be used where this is strictly for the purposes of the detection or prevention of crime. In such a case the employee has no rights of access to such data under their subject access rights (s.7).

In the case of Naomi Campbell v MGN Ltd [2004] 2 WLR 1232, the House of Lords ruled that secretly filming her on the street, coming out of Narcotics Anonymous, was a breach of her data protection rights and she had an expectation of respect for her privacy under Article 8 of the Human Rights Act.

Should the employer wait for the criminal trial before taking disciplinary action?

There is no hard and fast rule that the employer cannot go ahead with its own disciplinary investigation and hearing and then make a decision and dismiss fairly, in advance of any criminal trial.

If employees refuse to give any explanation of their actions to their employer when suspected of misconduct, the lack of explanation by employees does not prevent the employer from reaching a reasonable conclusion as to the employee’s guilt. If, on the evidence available, the employer’s belief in the employee’s guilt is reasonable, the employer can dismiss fairly.

Once charged with theft, an employee can be dismissed as long as the employer has followed a fair procedure (Shepherd and Harris v Courage Eastern Ltd [1982] IRLR 89 Court of Appeal).

Calling in the police

When to call in police is a decision that should be made at a very senior level. The police may take away evidence and caution witnesses not to talk about the case to anyone. They may wrongly advise the suspect not to make any statements to any third party. The employer’s investigation would then be severely hampered.

However, any statement made to the employer would be inadmissible in a criminal trial because it would not have been made under caution and would be inadmissible under the Police and Criminal Evidence Act 1998 (PACE).

Key points for employers

  • Clearly define the allegations/issue(s) in need of investigation.

  • Consider the nature and likely scope of the investigation based on the allegation/issue(s) of concern.

  • Decide how best to conduct the investigation — in many cases this can be a very simple/quick process. However, this will depend on the specific circumstances of the case, eg whether the facts are disputed or clear and the seriousness of the matter. An investigation can simply be the gathering of facts looking at existing documentation, eg relating to the previous in/formal management processes undertaken to address an issue. In other instances it may require the planned and systematic gathering of data, interviewing of relevant witnesses and analysing relevant documents, records, policies, etc to determine next steps.

  • Consider what information you need to gather, from whom and how this will be obtained.

  • Consider the timescales of the investigation. Taking into consideration, where appropriate, the need to conduct interviews, collate witness statements, gather information and write and submit the investigation report, etc.

  • Identify if there are any potential barriers to obtaining information and how these can be addressed.

  • If appropriate, identify any witnesses who could help with investigations, determining whether these should be interviewed or whether a written statement should be sought. Initial contact with a potential witness is often in the form of a telephone conversation to: explain the situation; check their potential relevance; seek their agreement to participate in the process, etc.

  • Consider other resources you may need during the investigations, eg note taking, specialist advice/guidance.

  • Prepare interview plan(s) and consider the specific issues that need to be explored during these interviews.

  • Prepare the questions you may wish to ask, ensuring that the questioning (open, closed and probing questions) is appropriate, eg for obtaining information/facts, exploring feelings or opinions. Avoid using leading questions.

  • If appropriate, provide regular updates to those involved.

  • It may be necessary to continually consider the need to amend your plan depending on the findings throughout the investigation.

  • Keep the employee and witnesses informed if applicable.

  • Any employee subject to an investigation should be made aware that an investigation will be undertaken, and should be provided with a brief summary of the reasons for this and the practical measures involved.

  • Include any paperwork/information which will be needed to be seen or considered prior to the interview.

  • Advise and if necessary assist the employee (and any witnesses) to access the counselling and support available to them.

  • Take appropriate steps to ensure the confidentiality of the investigation process.

  • If applicable, notify the witness’ manager of their involvement in the investigations, so that they can attend any relevant meetings.

  • Thank the interviewee for attending and make any necessary introductions (include an explanation of roles). Please note that there is no right of representation at the investigation stage of any procedure, however, managers may use their discretion to agree to such requests from the employee under investigation if they wish.

  • Confirm that it is a fact-finding meeting. It is important to remain objective.

  • Explain the need for confidentiality/implications for breaching this, eg potential impact on investigation/disciplinary action.

  • If they refuse to allow you to tape record the interview, explain that notes will be taken throughout the interview. The investigator should determine whether notes should be formally shared/signed by the interviewee. Where shared, if the interviewee disagrees with an aspect of the record they will be able to annotate the notes before returning to the investigator.

  • Confirm the area/allegation around which the employee or witness will be asked to comment. (When interviewing the employee under investigation, ensure they understand the allegations being made against them).

  • Explain that the evidence/information may be used in a subsequent formal hearing meeting and that they may be required (or in the case of witnesses requested) to attend, depending on the outcome of the investigation.

  • Check if the interviewee has any questions regarding the process.

  • Seek evidence/information using any prepared and supplementary questions.

  • In questioning the employee under investigation, explore possible explanations/special circumstances. Ask them to respond to any allegations and if they are able to produce any evidence/information to support their response.

  • Check if the interviewee wishes to provide any further information or raise any questions before the interview concludes.

  • Explain next steps and indicate timescales and that it may be necessary to hold additional interviews should further evidence arise.

  • Seek any relevant supporting information/evidence to substantiate information provided by the employee/witnesses.

  • Consider whether other documentation may be helpful for the investigation. For example: work rotas, attendance records, medical reports, incident reports, minutes from meetings, appraisal/training/development records, emails, letters, etc (permission of the employee may be required for some of these examples). Also consider any other documentation, eg employee handbooks/local agreements, etc.

  • Seek advice from HR as to whether the employment record of the employee(s) under investigation may provide any background or special/mitigating circumstances.

  • Should you identify any information that may warrant immediate action please raise this with the manager who instigated the investigation as a matter of urgency.

  • After each interview forward the record, as appropriate, for signing, to the interviewee.

  • If the interviewee disputes the accuracy of the record, ask them to: identify what is in dispute; offer their interpretation/recollections of the discussions by annotating the record provided, before signing and returning the record.

  • In the case of witness statements, gain the individual’s consent to share this with other relevant parties.

  • Maintain a record of all evidence gathered.

  • If company policy, tape record the interviews and give a transcript to each interviewee to sign and date — always get their permission to do this in advance.

  • Ensure all documentation associated with the investigation is retained securely and only shared with discretion and confidentially. Tone/style should be considered as all relevant information will be shared with key parties including the employee under investigation.

Last reviewed 21 March 2018