What Should a Business Owner Do When They Suspect Employee Misconduct or Fraud?

A business owner notices something that does not add up. A supplier invoice looks unusual. A company laptop shows signs of deleted files. A staff member becomes defensive when asked about payments. Stock is missing, bank details have changed, or a trusted employee suddenly resigns when questions are raised.

When a business owner suspects employee misconduct or fraud, the first step is not to accuse, confront or dismiss the employee immediately. The first step is to stay calm, secure company information, preserve possible evidence, document the concern and seek appropriate advice before taking action. Suspicion is not proof. A careful, factual approach protects the business, the employee’s rights and the integrity of any later decision.

This matters especially for small and medium-sized businesses in Namibia, where trust, close working relationships and limited internal controls often sit side by side. Many business owners only discover weaknesses after money, stock, data or confidence has already been lost.

Employee Misconduct, Fraud and Evidence

Employee misconduct is a broad term. It may include behaviour that breaches company rules, employment duties, policies or ethical expectations.

Employee fraud is more specific. It usually involves dishonesty or deception for personal gain. This could include false supplier invoices, inflated expenses, unauthorised payments, altered records, misuse of company property, theft of stock, manipulation of banking details or abuse of access to systems.

A business owner may not use professional terms at first. They may search online for questions such as:

“What should I do if I think an employee is stealing?”

“Can I check an employee’s company laptop?”

“What are the signs of fake supplier invoices?”

“How do I prove employee fraud?”

These are understandable questions. However, the answer should always begin with caution. The aim is not to jump to conclusions. The aim is to establish facts.

Evidence may include documents, emails, invoices, payment records, accounting entries, access logs, supplier details, device activity, stock records, delivery notes, screenshots, written approvals and communication history. In many cases, the most useful evidence is not one dramatic document. It is a pattern.

A suspicious invoice on its own may have an innocent explanation. Repeated invoices with vague descriptions, changed bank details, no delivery proof and links to an employee require closer attention.

The practical rule is simple:

Preserve first. Decide later.

Why Immediate Confrontation Can Create Risk

Many business owners want to confront the employee straight away. This is natural. When trust feels broken, the emotional reaction can be strong.

But early confrontation can create problems.

An employee may delete emails, remove documents, change explanations, warn others, resign before the business understands what happened or claim that the process was unfair. The business owner may also say something in anger that later complicates a disciplinary, labour, civil or criminal process.

This does not mean the business should do nothing. It means the first actions should be careful.

A better approach is to ask:

“What do we know, what do we suspect, and what still needs to be verified?”

That question helps separate emotion from evidence.

It is also important not to force a resignation, threaten an employee or present allegations as proven before the facts are properly reviewed. If misconduct appears serious, the next steps should be handled in line with the employment contract, workplace policies, applicable labour requirements and professional advice.

A calm process is not weakness. It is protection.

Practical Considerations Before Taking Action

When misconduct or fraud is suspected, a business owner should focus on a few broad areas.

Secure company property and access

If a company laptop, email account, accounting profile, phone, file cabinet or payment system may contain relevant information, the business should take reasonable steps to protect company information from alteration or deletion.

This should be done carefully. A company device may contain business records, but it may also contain personal information. Business owners should avoid unnecessary access to private accounts or personal content and should seek guidance where the situation is sensitive.

The goal is not curiosity. The goal is evidence preservation.

A useful question is:

“What company information could disappear if we wait?”

Document what raised the concern

Before making accusations, write down what caused the concern.

This may include dates, amounts, supplier names, invoice numbers, payment references, stock items, email addresses, system users, conversations, missing records or changes in behaviour. Keep the notes factual. Avoid emotional language.

For example, write:

“Invoice number 1045 from ABC Supplies was paid twice on 12 June and 14 June. No delivery note found.”

Rather than:

“She is obviously stealing from us.”

Factual notes are more useful than assumptions.

Avoid damaging possible evidence

Well-meaning checking can accidentally damage the very evidence the business may later need.

Opening files, moving folders, editing documents, deleting content, using the employee’s profile, forwarding emails carelessly or changing system settings may affect the reliability of the evidence. In digital matters, even small actions can change timestamps or create confusion about who accessed what.

This is why independent support can be valuable when company laptops, email accounts, accounting systems or digital records are involved.

The practical rule is:

Do not clean up before you understand what needs to be preserved.

Review supplier invoices and payments carefully

Fake supplier invoices are a common concern for businesses because they can look ordinary at first.

Warning signs may include:

* unfamiliar suppliers;

* vague invoice descriptions;

* repeated round amounts;

* duplicate invoice numbers;

* changed banking details;

* invoices just below approval limits;

* missing delivery notes;

* suppliers with unclear contact details;

* payments made without proper approval;

* supplier details connected to an employee.

None of these signs automatically proves fraud. But they do justify closer review.

Business owners should ask:

“Did the business receive what it paid for?”

“Who approved the invoice?”

“Who created or changed the supplier details?”

“Is there independent evidence that the goods or services were delivered?”

Consider the wider control environment

Employee fraud rarely happens in isolation. It often becomes possible because controls are weak, duties are not separated, records are poorly reviewed or one person has too much access.

For example, the same employee may request a supplier, capture the invoice, approve payment and reconcile the account. In a small business, this may happen because there are limited staff members. But it still creates risk.

The question is not only:

“Did this person do something wrong?”

The broader question is:

“How did the system allow this risk to arise?”

This mindset helps the business owner move from blame to prevention.

Company Laptops and Digital Evidence

Company laptops can be important in misconduct or fraud concerns. They may contain downloaded invoices, altered documents, email communication, deleted files, browser activity, accounting exports, supplier records or evidence of unauthorised work.

However, reviewing a company laptop should be approached carefully. The device should be secured, but the review should be proportionate, relevant and properly handled. The business should avoid unnecessary intrusion into personal information and should consider workplace policies, privacy expectations and professional guidance.

In many cases, the value lies in identifying factual traces:

What files existed?

When were they created or changed?

Were documents deleted?

Were company records downloaded?

Were supplier invoices edited?

Were business records sent outside the organisation?

These questions can help establish a clearer picture, but they should be handled with care. Poor handling can weaken the usefulness of the evidence.

What Should a Business Owner Do First?

The first step is to pause and organise the facts.

Do not start with confrontation. Start with preservation and documentation.

A practical first response may include:

Secure relevant company records. Limit further risk where appropriate. Write down what raised concern. Identify who had access. Keep communication professional. Avoid accusations until the facts are clearer. Seek advice before disciplinary or legal steps are taken.

This is especially important where the issue involves money, payroll, supplier payments, company devices, confidential information, stock or customer data.

The business owner should also consider whether immediate risk reduction is needed. For example, if someone still has access to payment systems, supplier records or sensitive files, the business may need to protect those systems while still following fair and lawful processes.

A useful rule of thumb is:

Act quickly enough to protect the business, but carefully enough to protect the evidence.

When Should a Business Contact a Certified Fraud Examiner?

A business should consider independent forensic or fraud prevention support when the concern involves financial records, repeated irregularities, supplier invoices, company laptops, deleted files, unusual payments, conflicts of interest or a trusted employee in a sensitive position.

For many SMEs, the first need is not always a full investigation. Often, the immediate need is a focused factual review.

What happened?

What records exist?

What documents support the concern?

Is there a pattern?

Is there enough information to make a responsible next decision?

A Certified Fraud Examiner can assist by reviewing relevant information, identifying red flags, organising facts and helping the business owner understand the situation more clearly. This can support better decision-making without unnecessary drama.

The aim should always be clarity, fairness and evidence-based action.

Common Mistakes Business Owners Make

Mistake 1: Accusing the employee too early

Accusations made without sufficient evidence can damage the workplace, weaken the business’s position and create unnecessary conflict. It is better to secure information first and make decisions based on facts.

Mistake 2: Allowing continued access without thought

If the concern involves payments, accounting systems, supplier records or confidential information, continued access may increase risk. Access decisions should be handled carefully and appropriately.

Mistake 3: Searching devices informally

A business owner may be tempted to open everything on a laptop or phone. This can create privacy and evidence problems. A review should focus on relevant company information and should be handled with care.

Mistake 4: Ignoring small warning signs

Many fraud matters start with small inconsistencies. A missing document, vague invoice or unusual payment may seem minor. But repeated small warning signs can point to a larger problem.

Mistake 5: Focusing only on the employee

Even if an employee acted dishonestly, the business should also review its internal controls. Fraud prevention improves when businesses understand both the conduct and the control weakness that made it possible.

This article provides general awareness and practical guidance. It is not legal advice, labour advice, disciplinary advice, forensic advice or a substitute for structured professional verification. Business owners dealing with suspected employee misconduct, fraud, theft, fake supplier invoices or misuse of company systems should seek appropriate professional support before taking formal action.

When a business owner suspects employee misconduct or fraud, the most important response is not panic, anger or immediate confrontation. The most important response is calm evidence preservation.

Secure what matters. Document what raised concern. Avoid damaging evidence. Do not jump to conclusions. Seek appropriate advice before taking disciplinary, legal or financial action.

For Namibian SMEs and organisations, this approach protects both the business and the fairness of the process.

The memorable takeaway is simple:

Suspicion starts the question. Evidence guides the decision.

FAQ

What should I do if I think an employee is stealing from my business?

Stay calm and avoid accusing the employee immediately. Secure relevant company records, document what raised the concern and consider restricting further access where appropriate. Do not delete, alter or move possible evidence unnecessarily. If money, records, stock or company devices are involved, seek professional advice before taking formal action.

Can I check an employee’s company laptop if I suspect fraud?

A company laptop may contain relevant business information, but it should be handled carefully. The review should focus on company-related records and avoid unnecessary access to private information. Poor handling can affect evidence and create privacy concerns. Where the matter is serious, independent professional support is advisable.

What are signs of fake supplier invoices?

Warning signs include vague descriptions, unfamiliar suppliers, changed bank details, duplicate invoice numbers, invoices just below approval limits, missing delivery notes, unusual payment patterns or supplier details linked to an employee. These signs do not automatically prove fraud, but they should be reviewed carefully.

Should I confront an employee if I suspect fraud?

Usually not before preserving relevant information and understanding the facts. Early confrontation can lead to deleted evidence, conflict, resignation or legal complications. A calm, documented approach is safer. Once the facts are clearer, the next step should follow workplace policies, labour requirements and professional advice.

What evidence is useful in employee fraud matters?

Useful evidence may include invoices, payment records, supplier details, emails, accounting entries, approval records, delivery notes, stock records, access logs, company files, device activity and written explanations. The value lies not only in individual documents, but in whether they show a consistent pattern.

When should I call a Certified Fraud Examiner?

You should consider contacting a Certified Fraud Examiner when the concern involves money, supplier payments, false invoices, company devices, deleted files, accounting records, repeated irregularities or a trusted employee in a sensitive position. Independent review can help organise facts and support better business decisions.

Suggested internal links

* How can small businesses prevent fraud?

* What does a Certified Fraud Examiner do?

Written by Melanie Meiring, Certified Fraud Examiner (CFE), founder of SoA Growth & Integrity Consulting. Melanie assists businesses, investors, professionals and organisations with fraud prevention, forensic accounting support, integrity risk assessment, investment intelligence and digital trust.