Inside employee misconduct rings: closing blind spots on fraud and theft

Employee misconduct, particularly around fraud or theft, is something that most organizations take seriously. And if it’s more than one employee, it can get even more serious.

Recently, utilities company SaskEnergy fired 13 employees after a loss report discovered internal fuel theft and an internal security investigation revealed the employees were involved in the theft. SaskEnergy reported the thefts to police and hired an independent investigator to look further into the issues, while an internal audit is also being conducted.

In a more serious story, seven Toronto police officers and one former officer have been charged in a probe into organized crime, unlawful database searches, drug and weapons trafficking, and shielding illegal cannabis dispensaries.

HR leaders must look hard at the blind spots that let such employee “rings” form with the purpose of some sort of misconduct, how investigations are run in such circumstances, and how discipline is calibrated once the facts are known, says Mark Alward, an employment lawyer at Taylor McCaffrey in Winnipeg.

Closing the blind spots

Alward says these cases often start small and expand because of gaps in the employer’s oversight.

“One person finds a vulnerability in the system and tests that with something small, and then he tells two friends, then they tell two friends, and so on,” says Alward. “These things generally snowball because of a lack of checks and balances and a lack of oversight.”

Michael Penner, a labour and employment lawyer at Kent Employment Law in Victoria, says that inconsistent policy application can lead to informal practices by multiple employees that might be hard to change.

“If the employer has never enforced a policy, is it co-ordinated?” he says. “There’s some collusion there and a situation where there's an entitlement, but it’s not necessarily nefarious although it’s to the advantage of the employee beyond the terms of the contract — but is it better to label it theft or breach of trust, or a breach of policy?”

Penner adds that if the rules are a vague and informal practices are being followed, HR needs to be cautious about labelling every misuse of resources as theft or fraud.

“With any employer policy, you need to make the standards known, you need to enforce it consistently, and you also need to know whether or not that's just individual employees doing it in isolation or in a co-ordinated manner,” he says. “Get ahead of it and just say, ‘This is an organization that is vulnerable to this type of misbehaviour and, because of that, we’re going to have a zero-tolerance policy.'”

For HR, that means vague rules and light-touch monitoring around high‑risk areas such as fuel, inventory, expense claims, or overtime create can space for employees to stretch boundaries, which becomes more normal for them over time, according to Alward.

Fairness, investigations, and legal risk

Alward says it can be difficult to manage investigations into groups of employees, but in the SaskEnergy case, the organization audited usage before acting. He says an evidence‑first approach is crucial, particularly where more than one employee appears to be involved.

“They started by auditing everything and trying to understand, from a factual perspective, what some of these issues were and what was happening,” he says. “So the first step in an investigation like this is doing your best as an employer to gather as many of the facts that you can, short of going to the employees.”

Penner says one of the first things to determine is the value of what's been stolen and determine if the police should be informed. 

That can means pulling information from records, logs, and system data before calling anyone into a meeting, so the organization has a grounded view of what seems to have happened, adds Alward.

Once an investigation turns to interviews, speed and sequencing matter, as the more employees are involved in potential misconduct, the harder it is to keep things under wraps, says Alward. HR ehould expect that employees may look for scapegoats, so it’s essential to move briskly, document answers carefully,and be prepared for new information, he says.

SaskEnergy’s response also highlights the legal tightrope employers walk as they investigate and discipline multiple employees, often under public scrutiny and sometimes in a unionized environment, says Alward, adding that investigations are less about checking a legal box and more about avoiding costly mistakes.

Individualizing discipline for fraud

Discipline decisions also have to reflect individual circumstances, even when many employees are implicated, according to Alward. He says each case must stand on its own: “The 25-year employee who has a spotless record and maybe did this once for 50 bucks should be treated slightly differently than the one-year employee who discovered the loophole and has defrauded the company of thousands of dollars,” he says.

“And this was a situation where there clearly wasn't a lot of oversight on these employees, so there’s a high amount of trust that has to exist -— we have to look at each individual situation independently. You can't just take the shotgun approach and say, ‘You're all gone’ — it has to be more nuanced than that.”

Penner agrees that each individual employee has to be assessed on the circumstances before determining discipline or dismissal.

“If it's an isolated incident and the employee is contrite, then I would say termination is excessive — but if there’s a co-ordinated effort by multiple employees to deliberately commit misconduct, it’s different,” he says. “If there’s nefarious intent where the employee is not only purposefully converting property to their benefit, but encouraging and abetting others to do the same, then not only do you have what would constitute criminal theft, but you also have that massive breach of trust.”

“You have employees who are actively working against their employer’s interests and, in that context, I think discipline needs to be firm and immediate,” adds Penner.

When it comes to preventing circumstances where several employees can band together in committing misconduct, the key is finding the balance between robust oversight and not turning the workplace into a surveillance state, says Alward. When it comes to issues like theft or fraud, he suggests regular review of expenses and other records as part of good management, not a sign of paranoia.

“I don't think it creates a culture of distrust for an employer to be diligently reviewing submitted records in terms of expenses,” he says. “It’s good management, and I don't think that it creates too much of a feeling of distrust, because employees who aren't manipulating the system don't have anything to worry about.”

Alward suggests that means designing review processes that are predictable, fair and explained up front, and training managers to ask questions in a way that seeks clarification rather than assumes guilt.

Choosing your battles after a breach

The SaskEnergy case has also raised questions about whether and how far organizations should go to recover losses from employees, as SaskEnergy indicated that it intends to recover the value of the fuel that was stolen.

“It's extremely rare for an employer to file a civil claim against a former employee for something like this, and generally the reason for that is that it's not worth it,” says Alward. “Now, there are times where an employee defrauds an employer of a heck of a lot more money, then you would likely see a civil claim — and if it's something where you have the option to report to the police because theft and fraud are criminal offenses, you can pursue getting repaid in terms of restitution.”

Penner agrees that chasing relatively small sums through civil courts often makes little financial sense. He cautions that “using a small claims court claim to recover $500, they're going to spend 10 times that, with no guarantee of success, so as a fiscal decision, it’s probably a pretty poor one.”

He believes that it’s often wiser to invest resources in tightening controls, clarifying expectations, and reinforcing culture than in long‑shot litigation against former employees.