Most cash shortages have ordinary explanations. A bill sticks beneath the drawer insert. A paid-out never makes it onto the closing sheet. Someone enters the wrong starting bank, or the deposit is counted after a twelve-hour shift by a manager who is ready to go home.
The trouble is that an honest mistake and a deliberate transaction can look remarkably similar the next morning.
If the numbers do not match, resist the urge to clean everything up immediately. Save the available records before making routine corrections. If continued access creates an immediate risk, restrict it promptly and document when the change was made. You may discover a simple error. If you do not, at least you will still have the information needed to understand where the money went.
Table of Contents
Quick Answer: Which Records Should You Save After a Restaurant Cash Shortage?
When restaurant cash is short, save the POS closeout, user audit log, refund and void reports, physical drawer count, employee schedule, deposit records and relevant video. Export the files before transactions are changed, preserve the originals and identify where the expected cash first stops matching the count.
Begin With the Paperwork on the Desk
The closing documents are usually the best place to start because they show what the manager knew at the time.
Keep the original count sheet, even if the handwriting is poor or a number has been crossed out. Save the deposit slip, the POS closeout and any note left by the closing manager. If the deposit bag has a serial number, photograph it.
Write a short account of how the difference was found. It does not need to sound formal:
Register 2 was expected to contain $1,392.40 after removing the starting bank. Two counts produced $1,247.40. The closing manager checked beneath the drawer and inside the safe. The $145 difference was not found.
That note is more useful than “cash missing” because another person can repeat the calculation.
Record who counted the drawer and whether the register was shared. Also note anything unusual about the shift. A terminal change, power interruption or late table transfer may turn out to matter. Most of the time it will not, but details are easier to discard later than recover later.
Pull the POS Reports That Show Changes
The daily sales report tells you the final total. It may not tell you what happened along the way.
POS systems use different names for their reports, but the useful records tend to cover the same activity:
Record | What to look for |
|---|---|
Refund history | Refunds entered after closing or returned as cash |
Voids and deleted checks | Transactions removed before payment |
Reopened checks | Changes made after a check appeared complete |
Comps and discounts | Repeated adjustments by the same account |
No-sale drawer openings | Drawer access without a recorded cash sale |
Tip adjustments | Changes made after the customer left |
Manager overrides | The account, terminal and time of approval |
User audit log | Actions taken under each login |
Choose the correct business date, not just the calendar date. A Friday dinner shift may remain open well after midnight and appear partly under Saturday.
Export the reports as PDFs or spreadsheets if the system allows it. A screenshot is better than nothing, but it often cuts off the filters, username or report range. If a screenshot is the only option, include the whole screen rather than cropping it down to one suspicious line.
Some POS platforms keep detailed audit information for only a limited period. If you are unsure what can be retrieved, call the provider and ask specifically about transaction history, deleted checks and user activity.
Follow the Cash in the Order It Moved
A restaurant deposit passes through several hands. Reconcile those steps in order rather than jumping straight from sales to the bank statement.
First, establish the starting amount in the drawer. Add the cash sales. Then account for recorded refunds, paid-outs, drawer transfers and tips handled in cash. That gives you the amount that should have been present at closing.
Compare it with the signed count sheet.
If those two figures match, move to the deposit. Compare the count sheet with the deposit slip, then compare the slip with the bank credit. A shortage that appears at the register is different from one that appears after the bag leaves the building.
Work on one shift at a time. A manager may be tempted to combine six small differences into a single estimated loss. That makes the file look simpler, but it removes the dates and transaction details that could explain what happened.
What a Manager Login Actually Proves
Suppose the refund report shows that the same manager account approved four late-night refunds. That is worth reviewing, but it does not necessarily identify the person who approved them.
Shared passwords are common in restaurants. So are terminals left logged in while managers move between the dining room, kitchen and office.
Compare the POS time with the schedule, clock records and terminal location. Was the account holder working? Was the transaction entered at the bar terminal while that manager was closing the kitchen? Did another supervisor know the code?
A login proves that a credential was used. With shared access, it may prove little more than that.
If the code needs to be changed, first save the account history. Write down when access was removed and who made the change. Otherwise, a later reviewer may see that an account was disabled without knowing whether it happened before or after the disputed transactions.
Save Video Before the System Records Over It
Video is often lost for a very ordinary reason: nobody knows how long the recorder keeps it.
Check the retention period as soon as the shortage is noticed. Save the register view, cash office, safe and deposit handoff if those areas are covered. Include several minutes on either side of the relevant activity. A tiny clip may show a drawer opening but leave out the reason it was opened.
Keep the exported file in its original format. Make a note of the camera number, the time shown on the recorder and whether that clock runs fast or slow.
Do not send footage around in a staff group chat. Limit access to the people handling the review. An unexplained shortage is not proof that an employee acted dishonestly, and casual accusations can create a separate employment problem.
When One Shortage Becomes a Pattern
A single discrepancy may end with a correction to the closing sheet. Repeated differences deserve a closer look.
Compare similar shifts rather than every shift in the restaurant. Look at the same register, closing manager, day of the week or transaction type. Are cash refunds appearing after the drawer count? Do checks reopen shortly before the closeout? Are no-sale openings unusually common on certain shifts?
Do not ignore days when the drawer is over. An overage can expose the same weak closing practice that produced a shortage the night before.
Keep a simple log with the business date, register, expected cash, counted cash and difference. Add a reference to the supporting POS report. Avoid filling gaps with averages. If a number cannot be supported, label it as unresolved instead of forcing it into the total.
Mistakes That Make the Review Harder
Some well-meant actions damage the record before anyone realizes it:
correcting the original check instead of making a note
replacing the handwritten count sheet with a typed version
deleting an employee’s POS account before exporting its history
saving only the final sales summary
asking several employees to examine the same original files
treating a shared password as proof of identity
adding estimated shortages to confirmed differences
If continued access creates a real risk, the restaurant does not have to leave accounts or keys active. Preserve what can be saved, restrict access and document what was changed.
For questions about insurance protection rather than the POS review itself, see StarNet’s separate guide to commercial crime coverage and employee dishonesty.
If the POS account may have been accessed from outside the restaurant, stolen credentials or a system compromise could also involve restaurant cyber insurance.
Frequently Asked Questions
Does a cash shortage mean an employee stole money?
No. It means the restaurant’s records and physical cash do not agree. Counting errors, incorrect starting amounts, undocumented paid-outs and misplaced funds should be checked before theft is assumed.
Which POS records should be saved first?
Save the closeout and user audit log first. Then export the refund, void, deleted-check, reopened-check, discount, comp and manager-override reports for the same shift.
Can a POS report identify the employee responsible?
It may identify the account and terminal used. If employees share passwords or terminals, schedules and video may be needed to understand who actually performed the transaction.
How do you investigate a cash shortage in a restaurant?
Start with the opening bank, add recorded cash sales and subtract cash refunds, paid-outs, transfers and cash tips. Compare the result with the physical drawer count, deposit slip and bank credit to identify where the amounts first stop matching.
How long should restaurant video be kept?
Retention varies by system. Relevant footage should be exported promptly because many recorders automatically replace older files when storage becomes full.
When should the insurance company be notified?
Check the policy’s notice requirements once the restaurant has reason to believe the difference may involve a covered loss. Ask before committing to outside investigation expenses that may require approval.
How StarNet Insurance Group Can Help
A restaurant does not need to solve every question before asking how a possible loss should be reported. It does need to protect the records that already exist.
StarNet Insurance Group can help restaurant owners review reporting requirements and identify which coverage may be relevant to missing cash or suspicious POS activity. Actual coverage depends on the policy, endorsements and facts surrounding the loss.
Contact StarNet Insurance Group to discuss a possible restaurant cash loss or review commercial crime coverage.
Related StarNet Resources
