How to track cashier voids and internal theft: exception reporting, thresholds and fair investigation

Which till transactions does internal loss arise in?

Till-side internal loss arises when a routine transaction within the cashier's authority is used for something it was not meant for. That is why the pattern carries the information, not the transaction itself: voids happen at every till, but voids that repeat for the same cashier, at the same hours and for similar amounts say something else.

The types fall into two groups. In the first, the transaction leaves a trace in the POS record: line or receipt voids, refunds, manual discounts and price overrides, no-sale drawer openings. In the second, the trace is left in stock rather than in the POS: sweethearting, meaning a product passed through without being scanned or with a cheaper product scanned in its place, and under-ringing, meaning the quantity is keyed in short. The second group does not show directly in the exception report; it is tracked through indirect indicators and camera events.

For the share of loss caused by employees there is only an old, global measurement: according to the global retail shrink index cited by TPF (the Turkish retailers' federation) in 2018, 22.95 per cent of loss was caused by employees; external theft accounted for 34.34 per cent, supplier-related loss for 24.28 per cent and administrative causes for 18.43 per cent. This breakdown is neither specific to Turkey nor current; your own chain's breakdown can only come from your own records.

How to build an exception report: rate, comparison base and threshold

An exception report does not list every transaction, only those that deviate from what is expected. The logic is simple: cashiers serving the same customers in the same store and the same shift should have void, refund and discount rates close to one another. If one diverges clearly and repeatedly, that is where to look.

The rate is calculated separately on value and on count. The value rate shows large losses, the count rate shows frequent repetition. The denominator is the gross value the cashier scanned, that is, before voids and refunds; using net sales as the denominator inflates the rate artificially as voids rise.

The comparison base matters as much as the rate itself. The morning opening shift and the evening rush have different void patterns, a new cashier makes more errors than an experienced one, and self-checkout and staffed tills are read separately. So a cashier is compared not with the chain average but with the other cashiers in the same store and shift; if the shift has too few transactions, similar stores in the region become the base.

The threshold is a design decision and there is no universal value. One example rule: if a cashier's rate exceeds twice the comparison base, above a set minimum volume, and this repeats in at least three of four weeks, the record is taken up for investigation. A one-day spike is monitored, not investigated.

Void rate (value)

Voided sales value ÷ Gross sales value scanned × 100

Void rate (count)

Voided lines ÷ Lines scanned × 100

Refund rate

Refund value ÷ Gross sales value scanned × 100

No-sale drawer opening frequency

No-sale openings ÷ Receipts closed × 100

Deviation ratio

Cashier's rate ÷ Rate of the other cashiers in the same store and shiftThe cashier is excluded from the base; otherwise a high rate raises its own base and the deviation looks smaller than it is.

1. Take the data with the cashier IDPOS movements come with cashier ID, till, time, transaction type and amount. On a till opened with a shared login nobody knows who did what; personal logins are the first requirement.
2. Separate transaction typesLine voids, receipt voids, refunds, manual discounts and no-sale drawer openings are counted separately. Rolling them into a single rate hides the pattern.
3. Build the baseSame store, same shift, same period; the cashier is kept out of their own base.
4. Set a minimum volumeFor a cashier who scans few receipts, a single void makes the rate jump. Records below the minimum stay out of the report until volume builds up.
5. Require repetitionA breach in a single period is monitored; a breach that repeats across several periods is investigated.
6. Review the thresholdIf the report produces too many records every period, the threshold is too loose; if it produces none, it is too tight. Track how many investigated records turn out to be innocent and adjust the threshold accordingly.

Worked example: void rate and flagging

Below are four weeks of POS records for the five cashiers on a store's evening shift; cashiers are shown by code and the figures are illustrative. Rule: if the value-based void rate exceeds twice the shift rate excluding the cashier, and this repeats in at least three of four weeks, the record is taken up for investigation.

What happens once a flag is raised?

An exception report does not say who is stealing; it says which record to look at. The investigation therefore starts from the most likely innocent cause and moves forward as evidence builds. If the sequence is broken, for instance if the first step is to confront the cashier, the wrong person is worn down and the trail of a real problem is lost.

The data is personal data. POS records held against a cashier ID and camera footage fall within Law No. 6698; processing must be lawful and fair, for specified, explicit and legitimate purposes, and relevant, limited and proportionate to those purposes (Art. 4). Employees are told in the privacy notice for what purpose this data is processed (Art. 10). Article 11 of the Law gives the data subject the right to object to an outcome against them that arises from analysis of the processed data exclusively by automated systems; an exception report flag is therefore never a decision on its own, it starts a human review.

On the employment side, two provisions set the order. Under Article 19 of Labour Law No. 4857, an employment contract of indefinite duration cannot be terminated for reasons related to the employee's conduct or performance without first hearing the employee's defence against the allegations; the right to terminate under Article 25(II) is reserved. Article 26 states that the right to terminate on grounds of conduct contrary to morality and good faith cannot be exercised once six working days have passed from the day the other party learned of the conduct, and in any case one year after the act; the one-year limit does not apply where the employee obtained a material benefit. That is why it matters to keep a written record of when the investigation started and what it relied on.

1. Verify the dataCheck that the cashier ID really belongs to that person, that the till was not running in training mode, and that there was no scanner or scale fault.
2. Rule out innocent causesSeparate out shift and till type, price-change days, the start of a promotion, shelf label and till price mismatches, and supervisor-approved voids.
3. Describe the patternRecord transaction type, time, amount, payment type and whether the void was made within the receipt or after the customer left. The pattern describes a transaction, not a person.
4. Gather event-level evidenceFor the specific transactions that fit the pattern, the till record and camera footage captured for a legitimate purpose are compared at the same timestamp. The whole shift is not reviewed.
5. Hear the explanationThe employee is heard with the findings shown to them; their explanation and any documents they provide go into a written record. Recordings are shared only with those assigned to the investigation.
6. Record the outcome and closeAn investigation that finds nothing wrong is also closed with a closing note; any action such as training, a change of authority or a process fix is recorded with an owner and a date.

This section is general information, not legal advice. Decisions on the investigation and on the employment contract depend on the circumstances of the case and are assessed with a lawyer who works in employment and data protection law.

Where is the data protection limit when using cameras at the till?

Retention periods, warning signs, audio recording and access rights for camera footage are covered in detail in the store camera recording and data protection guide. Only three points bear directly on a till investigation here.

The first is the till area. The public announcement of 8 June 2026 by the Turkish Personal Data Protection Authority (KVKK) states that camera use may appear proportionate in shared areas or in zones with a security risk such as the till; as purposes it gives ensuring workplace security and helping to prevent and detect crime.

The second is the limit of the purpose. The same announcement does not regard seeing whether employees work efficiently, or increasing discipline, as a legitimate purpose, and asks that cameras not be used outside the stated purpose to monitor employees' attendance or performance. Measuring a cashier's speed, time at the till or conversations with customers on camera is therefore not part of an internal loss investigation.

The third is scope. The announcement calls for data minimisation, automatic deletion and technical and administrative measures such as an authorisation matrix. What the investigation looks at is not the cashier's shift but the moment of a specific transaction that fits the pattern; an exported clip is tied to the case file and deleted when the process ends.

This section is general information, not legal advice. The purpose of the cameras, the privacy notice, the retention period and access rights are the business's decisions as data controller.

How should void rate, till variance and stock loss be read together?

Till variance only audits money that has a record. A sale whose line is voided and whose cash is kept leaves both the record and the till at the same moment, so the till balances at the end of the day. A product passed through without being scanned leaves no trace at the till either. The loss from these transactions builds up not in the till variance or the POS reconciliation but in the product's stock record, and surfaces as stock loss at the count.

That is why three indicators are read together. Till variance shows money left unexplained in the POS reconciliation; the exception report shows the cashier and transaction pattern; stock loss shows the total of unrecorded shrinkage, theft and recording error found at the count. None is enough on its own: if a store has a high void pattern, zero till variance and rising stock loss on particular products, all three may be telling the same story.

It also works the other way. In a store with high stock loss but normal void, refund and discount patterns, the source of the loss is most likely not the till; look at goods receiving, shrinkage recording or external theft.

Shrinkage is a known loss with a recorded cause; stock loss is a shortfall whose cause is unknown. In a store where shrinkage is under-recorded, stock loss grows and till-side loss cannot be told apart from spoilage.

How are till events and camera events matched in Mindpera?

Mind Cam turns footage from store cameras into event data through computer vision; every event is recorded with store, area, event type and time. The till variance record is placed next to the camera event at the same moment. A till event with no POS record at the same time, and movement outside the usual pattern, raise an alert; the investigation starts from the matched event rather than from hours of scrolling through footage.

On the Mind Ops side, POS movement records, ERP sales and return invoices and store camera feeds come together in the same data model. On the Store Reconciliation screen, the difference between the till and the system is listed as unmatched POS lines with a reason code and amount; a till event that does not match a transaction goes to its owner together with its record, and the item is tracked until it is closed.

The purpose of the cameras, the privacy notice, the retention period and access to recordings are the business's decisions as data controller; an analytics product does not remove those obligations. If camera, till and sales data sit in different systems, our team handles the installation and brings the sources into a single data model.

• Mind Cam, till matching: the till variance record next to the camera event at the same moment
• Mind Cam, anomaly alert: a till event with no POS record at the same time, and movement outside the usual pattern
• Mind Ops, Store Reconciliation: unmatched POS lines with reason code and amount
• Mind Ops, Action Centre: owner, deadline and outcome; an item left open escalates step by step