POS Data Discrepancies: How to Tell Honest Errors and Theft Apart
Most POS discrepancies are honest mistakes; the skill is spotting the deliberate few quickly, before a dollar of loss becomes a hundred.
Every multi-location operator watches food cost and labor percentages. The discrepancies that cost a few dollars at a time, a refund here, a void there, are the ones that get noticed last, if they get noticed at all. Most are honest: a customer changes an order, or a cashier keys the wrong total. A small number are deliberate, and the difference is rarely obvious on the receipt.
If you have ever looked at a figure that would not reconcile and not known whether to let it go or chase it, you are not alone. Telling an honest error from theft takes a trained eye, and catching it early, while the loss is still small, is what protects your margin. Read on for how an experienced reviewer makes that call, and why catching a problem at a dollar matters more than catching it at a hundred.
The discrepancies you see: refunds, voids, and manual entries
Start with the discrepancies you already recognize. Restaurants, convenience stores and gas stations, and multi-site franchise brands all run high-transaction registers with thin staffing. There are roughly 152,000 convenience stores and gas stations nationwide, most owned by local and regional operators. The more registers you run and the fewer eyes you have on them, the easier it is for a discrepancy to disappear into a busy week.
The ones you notice are familiar: refund anomalies, repeat voids, a jump in hand-keyed sales (items typed in instead of scanned), and cash gaps that never quite reconcile. Most are honest, and the usual suspects among the rest are a manipulated void, a false refund, or the sweetheart discount rung up for a friend. Refunds hide the easiest, because a refund looks like a routine correction until you check whether a sale ever happened at all. That is why refund fraud often runs longer than other POS theft types before anyone thinks to question it.
Telling an honest error from theft
What identifies theft is the transaction itself, read against the footage, and how often it happens matters less than most multi-unit operators expect. It is tempting to assume you need a run of incidents before you can call something theft: one void is nothing but a dozen is a problem, for instance. An experienced reviewer reads it differently. A single void at the end of a rush is routine, while a void that the footage shows covering a cash pull is theft, and a reviewer can see the difference from that one transaction without waiting for it to happen again.
Consider a common case at one of your locations. A cashier rings an item below its real price and takes the difference in cash: checked against the footage, that is theft, because the price was changed deliberately and money left the drawer. Change one detail, the same cash left in the drawer to cover a shortage from earlier in the shift, and an honest misunderstanding of protocol is at least arguable. The two POS lines are nearly identical, and the footage, read carefully, ideally by an experienced analyst, is what tells them apart.
There is no clean formula that separates an honest error from theft; it is a judgment call about what happened, and making that call well is where a trained reviewer adds value.
Why a trained reviewer catches what your reports miss
Your POS already flags the odd transaction; what it cannot do is tell you which flag to inspect closely. Most operations work from the exception reports their system produces: the running list of refunds, voids, and odd transactions, checked against a quick word with the manager on shift. Across one or two locations that can work. Across fifty it breaks down: one person cannot hold weeks of line items in their head, match a flagged transaction to the second it happened, and do so for every register under their management.
This is where continuous review earns its place. Trained reviewers follow the same registers week after week and tie each transaction to its time-stamped footage. The software flags issues and a trained analyst decides what they mean. A report that flags forty incidents hands you forty things to chase, while a reviewer who knows your registers picks out the one that matters and tells you where to look. Across industries, fraud that someone is getting away with runs about a year on average before it is caught, and most of it surfaces because a person noticed something rather than because a system flagged it.
If your own reports are raising more questions than they answer, our loss prevention service puts trained reviewers on your POS data and does the monitoring for you.
Why a month without a POS discrepancy can be your most valuable one
The most valuable month of monitoring can be the one where we find almost nothing, and that sometimes surprises new clients. When an operator first brings us in, we often find the large losses: the hundreds or thousands that have gone unseen for months. That feels like value, and it is, but it is only part of the point. The point is to catch the next problem at a dollar, before it ever has the chance to become a hundred.
So the months that look least impressive are often the ones that prove proactive monitoring is working. A month where we flag a few dollars of loss means something was caught the first time it appeared, while it was still small. Once monitoring is in place the staggering numbers should stop, and if they come back, something has slipped.
This is also what separates ongoing monitoring from the one-off check that finds a single incident. We look for every instance a problem has produced, and on the theft side those instances usually sit close together, within a week or two of footage. Sometimes there is only one, and that is the best outcome of all, because it means we found it right at the start.
Our operational excellence work involves documenting how patterns build over time to evaluate how a location performs. For our loss-prevention work, the aim is different: catch the single issue early, the first time it appears, so it never gets the chance to repeat.
From a hunch to a file you can act on
A suspicion only becomes actionable once it is tied to a dated transaction and the matching register footage. When a POS discrepancy looks concerning, we build the evidence file.
Footage on its own only goes so far. It becomes evidence the moment a person sits down and reads it against the POS data. That is the difference between “I think someone is under-ringing” and a file that answers the question for you.
It is also why waiting for a crisis, for example an employee dispute, to start digging through your data leaves you on the back foot. Proactive operations keep their data under continuous review, so the evidence is already on file when they need it. Pembroke handles that review, documents findings, and hands you clear next steps as a complete package. It is part of why 88% of the operators we work with stay with us year after year.
A trained analyst catches losses while they are still small
A POS discrepancy on its own is just a question: honest mistake, or something more? The answer comes from someone trained to read the transaction against the footage, tell one from the other, and catch it while the loss is still small. That is what monitoring looks like when it works. Finding a thousand-dollar discrepancy that has been running for months is the review doing its job. Finding the next loss at four dollars is the review doing its job early, before the loss has time to grow.
Contact us to review your POS data and find out which of your discrepancies are simple slips and which ones need your attention.
What operators ask us about POS discrepancies
How do you tell a POS error from theft?
It is a judgment about what the transaction is, read against the footage. A single void or an odd refund is usually an honest slip. What tells an experienced reviewer otherwise is the transaction itself: an item rung below its price with the difference taken in cash is deliberate, and the footage confirms it. One clearly evidenced instance can be enough.
Can a single transaction be enough to act on?
Yes. You can address a problem the first time it appears, and catching it then is the goal, because that is when the loss is smallest. Where a problem has produced more than one instance, a reviewer finds them all to complete the evidence, but a single, well-documented transaction tied to the footage is something you can act on with confidence.
How do you investigate a POS discrepancy?
Confirm what the transaction is, rather than reacting to the fact that it looks odd. Pull the matching footage, so the POS line and what happened at the register sit together. Write it up with times, registers, and amounts, so you are holding a documented file. Then have the conversation the evidence supports.