An owner calls on a Tuesday. Inventory has not reconciled for three months, a long-serving supervisor has been approving his own adjustments, and the owner wants him out by Friday. By Thursday the laptop has been wiped and reissued, two people on the floor have been asked leading questions, and the supervisor has counsel.
Catching the theft is the easy part. The expensive mistakes happen in the 48 hours after an employer becomes suspicious, before anyone has thought about what they will eventually have to prove. An employer who fires on a hunch frequently ends up paying the thief.
Short answer: to dismiss for internal theft without notice and survive the wrongful dismissal claim, you must prove two separate things. First, that the conduct happened, on the balance of probabilities rather than beyond a reasonable doubt, with evidence that is clear, convincing and cogent. Second, that the misconduct was serious enough, in context, that dismissal was proportionate and the employment relationship had broken down. No charge or conviction is required. Separately, Ontario’s employment standards regulation sets a higher bar for withholding statutory notice and severance, so you can win on just cause at common law and still owe the money. Almost everything that decides these questions is created or destroyed in the first two days: preserve before you investigate, investigate before you interview, interview before you decide.
This article turns on statutory interpretation and case law. Treat it as orientation, and have an employment lawyer look at a live file before you act, ideally before you suspend anyone.
What you have to prove, and to what standard
Did it happen? A wrongful dismissal action is civil, not criminal. In F.H. v. McDougall, 2008 SCC 53, the Supreme Court of Canada settled that there is only one civil standard of proof at common law, proof on a balance of probabilities (para. 40), and that the seriousness of an allegation does not raise it. The Court added, at para. 46, that evidence must always be “sufficiently clear, convincing and cogent.” So you do not need proof beyond a reasonable doubt, but “more likely than not” still has to be built from documents and records a judge can follow, and the burden sits on the employer alleging cause.
Does it justify dismissal without notice? This is the harder question and the one most files lose on: proving an employee took something does not automatically prove summary dismissal was the right sanction. A third question sits behind both, covered below: whether the conduct also clears the narrower statutory test for withholding termination and severance pay.
Just cause is contextual, and the amount taken is not decisive
The governing authority is McKinley v. BC Tel, 2001 SCC 38, [2001] 2 S.C.R. 161, where the Supreme Court rejected the idea that any dishonesty automatically gives an employer just cause. Iacobucci J. framed the test at para. 48:
“whether an employer is justified in dismissing an employee on the grounds of dishonesty is a question that requires an assessment of the context of the alleged misconduct. More specifically, the test is whether the employee’s dishonesty gave rise to a breakdown in the employment relationship.”
He named the organizing principle directly: “Underlying the approach I propose is the principle of proportionality. An effective balance must be struck between the severity of an employee’s misconduct and the sanction imposed.”
McKinley did not make theft trivial. The Court was clear that “Where theft, misappropriation or serious fraud is found, the decisions considered here establish that cause for termination exists,” while adding that “This principle necessarily rests on an examination of the nature and circumstances of the misconduct.” The finding that conduct is theft, rather than sloppiness or an informal practice nobody wrote down, is itself the product of a contextual inquiry.
The Ontario Court of Appeal set out how to run that inquiry in Dowling v. Ontario (Workplace Safety and Insurance Board) (Court of Appeal for Ontario, docket C40220, released 26 November 2004; leave to appeal dismissed 19 May 2005). Gillese J.A. broke the standard into three steps at para. 50:
- Determine the nature and extent of the misconduct, not only the incident that triggered the suspicion. The trial decision was overturned partly because the judge looked at a single $1,000 payment and not at the undisclosed discounted purchases, the false document, or the lies told during the investigation.
- Consider the surrounding circumstances. At para. 52 these are, for the employee, “age, employment history, seniority, role and responsibilities,” and on the employer’s side the nature of the business, its relevant policies and practices, the employee’s position, and “the degree of trust reposed in the employee.”
- Decide whether dismissal is warranted, meaning whether it is proportionate.
So four hundred dollars moved quietly by a bookkeeper with sole signing authority sits differently than four hundred dollars of product walked out by a seasonal worker: seniority and trust cut against the employee, not for them. After-discovered misconduct counts if it predates the termination, since Dowling confirms at para. 51 that “an employer is entitled to rely on after discovered wrongdoing, so long as the later discovered acts occurred pre-termination.” Condonation runs the other way: if a supervisor knew and let it run, that history works against cause.
The gap that catches employers: common law cause versus the ESA standard
Just cause at common law and the statutory exemption from notice and severance are different tests, and the statutory one is harder to meet. Under the Employment Standards Act, 2000, notice and termination pay come from Part XV and severance pay from section 64. The exemptions sit in Ontario Regulation 288/01 (Termination and Severance of Employment), worded identically at s. 2(1) para. 3 and s. 9(1) para. 6:
“An employee who has been guilty of wilful misconduct, disobedience or wilful neglect of duty that is not trivial and has not been condoned by the employer.”
Every element is a hurdle. The conduct must be wilful, meaning deliberate rather than careless. It must not be trivial. It must not have been condoned.
The Ontario Court of Appeal applied this squarely in Render v. ThyssenKrupp Elevator (Canada) Limited, 2022 ONCA 310. The Court upheld dismissal for cause at common law, then at paras. 79 to 82 held the same conduct was not wilful misconduct under the Regulation and awarded eight weeks of statutory termination pay anyway. It adopted the description of the statutory test as “being bad on purpose,” and noted the Ministry of Labour’s own position that the exemption “is narrower than the just cause concept applied in the common law.”
For a theft file: a deliberate, planned scheme (falsified invoices, a fabricated vendor, a running pattern) is most likely to clear both bars. Spontaneous or opportunistic conduct may establish cause at common law and still leave you writing a statutory cheque. Budget for that from day one.
The first 48 hours: preserve before you investigate
Preservation first, investigation second, confrontation last. Almost every ruined file inverts that order.
- Do not tip the employee. No informal chat, no “we are just looking into something,” no access change they would notice. The moment a subject knows, the deletion starts.
- Image the devices before anyone touches them. Laptops, phones and assigned removable media should be forensically imaged, write-blocked and hashed, with analysis done on the copy. The most common irreversible mistake we see is IT being asked to “have a quick look,” or a machine being reimaged while the investigation is still being scoped. Booting a machine and browsing it changes it. See Digital Forensics: What’s Recoverable, and What’s Admissible and our digital forensics work.
- Pull the video now. Many recorders overwrite on a rolling cycle, so do not assume yours holds months. Export the relevant windows with buffer either side, in the native format, and record who exported what and when. Exporting a curated clip invites the argument that context was removed.
- Export system records with their metadata. Point of sale journals, inventory and ERP logs, purchase and payment records, badge access, network authentication, email and file access, in a form that preserves timestamps.
- Secure physical evidence and record continuity. Photograph it in place, label it, and keep a written record of who held it and when. Tidying up risks an adverse inference, and that risk runs against employers exactly as it runs against employees.
- Consider a paid suspension instead of a firing. It buys the time to do this properly, but it is not risk-free and can itself be argued as constructive dismissal, so run it past counsel first.
Building the evidentiary record
Once evidence is preserved, the case is built by correlation: a single suspicious document is an allegation, the same event proved three ways is a case. This is the substance of a workplace investigation, running alongside digital forensics wherever device artifacts matter. Prove exclusivity as you go, because if four people share a login the case has a hole no footage fills.
Reconcile documents to transactions. Match invoices to purchase orders to receiving records to payments, and match voids, refunds, discounts and inventory adjustments to the user account that authorized them and to the shift schedule. The persuasive exhibit in most theft files is not footage, it is a reconciliation showing a defined set of anomalies belongs to one person’s credentials and shifts and nobody else’s.
Correlate video to time-stamped system records. Video alone shows a person at a till. Video synchronized to a transaction log showing a void at that second on that user’s login is a different exhibit entirely. Measure and document the offset between the recorder clock and the system clock, because that discrepancy is the first thing challenged.
Where undercover and surveillance genuinely fit
Undercover placement earns its cost when the loss is ongoing, more than one person appears involved, and the scheme is operational rather than documentary: product leaving the building, collusion with a driver or vendor, cash that never enters the system. It is how you observe a process that leaves no paper. See undercover investigations for how those placements are structured. It is overkill when a single employee is suspected, the conduct is historical, and the reconciliation already closes the case. External surveillance answers one narrow question, where the property goes and who receives it.
Collection has to be lawful. Investigation for hire in Ontario is licensed work under the Private Security and Investigative Services Act, 2005 and O. Reg. 363/07, and evidence gathered outside those boundaries creates a second problem instead of solving the first. Two areas need particular care: what your policies say about monitoring company systems, and audio. On the latter, read Recording Conversations in Ontario: One-Party Consent first.
The investigative interview is where most cases are lost
More theft files are damaged in the interview room than anywhere else, usually by an employer trying to save time.
- Time it last, and plan it. Interview the subject after the evidence is preserved and the record is built. Know what each document proves, what you will put to them in what order, and what you will do with each answer.
- Have a second person present. One asks, one takes notes. A one-on-one meeting becomes a credibility contest about what was said, and the employer usually loses it.
- Take accurate, contemporaneous notes. Dated, timed, who was present, and what was answered in the employee’s own words rather than paraphrased into a conclusion. Read it back and let them correct it. Notes written from memory two days later carry a fraction of the weight.
- Do not promise leniency, and do not threaten criminal charges. This is not a soft ethical point. Criminal Code s. 346(1) defines extortion as inducing or attempting to induce a person, “without reasonable justification or excuse and with intent to obtain anything, by threats, accusations, menaces or violence,” to do anything. Telling an employee you will call the police unless they sign a repayment agreement or a resignation is exactly what employment counsel warn against, and whether a given exchange crosses a line is a question for a lawyer, not for whoever is running the meeting.
- Know what an admission is worth. A private employer is not the state, so no Charter caution is required. That is not a licence. An admission produced by a five-hour session, a closed door, or a threat of charges is worth very little and taints the file by putting the employer’s conduct in issue. A calm interview in which the employee is shown the records and asked to explain them is worth more than a confession a judge will discount.
Procedural fairness, and the price of alleging cause you cannot prove
Before deciding, put the allegations to the employee and give a genuine opportunity to respond. Not a formality performed after the termination letter is drafted: an actual chance to explain, with the material in front of them, and a real interval before the decision. Employers skip this because they are certain. Certainty is not the point. The record of having asked is.
Financially, the reason is Honda Canada Inc. v. Keays, 2008 SCC 39, [2008] 2 S.C.R. 362, where the Supreme Court held at para. 57 that damages for the manner of dismissal are available where an employer “engages in conduct during the course of dismissal that is 'unfair or is in bad faith by being, for example, untruthful, misleading or unduly insensitive.'” At para. 59 it directed that such damages be assessed as actual damages rather than by extending the notice period, giving as examples “attacking the employee’s reputation by declarations made at the time of dismissal, misrepresentation regarding the reason for the decision, or dismissal meant to deprive the employee of a pension benefit or other right.”
Three behaviours turn a defensible dismissal into an expensive one: announcing to staff or a prospective employer that the person is a thief before anything is proven (which also raises defamation exposure); alleging cause in the letter on evidence that will not support it, then abandoning it at trial; and withholding a record of employment or final wages to force a settlement.
Alleging cause is not free. If you cannot prove it, you have not only lost the notice argument, you have handed the other side a claim about your own conduct.
Police: what involving them costs you
A criminal charge is not required to establish just cause, and neither is a conviction. Reporting is a strategic decision, best made with counsel rather than in the first hour of anger.
What you gain: investigative powers you do not have, including search warrants and production orders, and the possibility of restitution. Under Criminal Code s. 738(1), restitution can be ordered only where an offender is convicted or discharged, on application of the Attorney General or the court’s own motion. Charge severity turns partly on value: Criminal Code s. 334 distinguishes theft of property worth more than $5,000 from theft not over $5,000.
What you give up: timing, because the pace becomes the service’s; custody of your own evidence, since devices and originals can be seized and held as exhibits; control of the file, because Crown disclosure obligations mean your interview notes and investigator reports can end up with the accused’s counsel; and simplicity, since a parallel criminal proceeding complicates both the civil action and the employment file.
It is usually the right call for large or sustained losses, organized schemes, and where risk to the business continues after the dismissal.
Recovering the money, and preventing the next one
Recovery is generally the weakest part of an internal theft outcome.
- A civil claim against someone with no assets produces a judgment, not money. Assess collectability first.
- Do not simply hold back the final cheque. Section 13 of the Employment Standards Act, 2000 prohibits withholding or deducting wages except as authorized in that section. Notably, s. 13(5)(b)(ii) means even a written authorization from the employee does not permit a deduction where the employer had a cash shortage, lost property or had property stolen and a person other than the employee had access to it. Self-help creates a new claim against you.
- Check your insurance early. Commercial crime or employee dishonesty coverage, where a business carries it, is often the most realistic path to recovering a loss. These policies typically require prompt notice and a documented proof of loss.
Prevention is cheaper than all of it, and most files reveal the same gaps: segregation of duties, so nobody originates, approves and reconciles the same transaction; unique credentials, enforced, because shared logins destroy attribution and therefore your evidence; mandatory vacation and rotation in finance and inventory roles, since schemes needing daily maintenance surface when the person is away; and a written, acknowledged monitoring policy, which also makes lawful collection cleaner later.
For the earlier-stage version of this problem, see How to Spot Employee Fraud Before It Costs You.
What to do next
If you suspect internal theft right now, in this order:
- Stop. Do not confront, do not announce, do not change access in a way the subject notices.
- Preserve. Image devices before IT touches them, export video before it overwrites, export logs with metadata, secure physical evidence, record continuity.
- Call an employment lawyer before you suspend or dismiss anyone, and before you allege cause in writing.
- Bring in a licensed investigator to build the record, or an undercover placement if the scheme is live and multi-person, so whoever collected the evidence can explain how and stand behind it in court.
- Interview last, with a second person present and accurate notes.
- Decide after you have heard the employee’s answer.
Done in that order, the employer usually keeps the money. Done backwards, the employer pays twice, once for the theft and once for the dismissal.
If you are inside the first 48 hours and want the evidence preserved properly, our workplace investigations team can be reached through Assign a Case or contact. We would rather hear from you before the laptop is wiped.
Frequently asked questions
Do I need to prove employee theft beyond a reasonable doubt to fire someone for cause?
No. That is the criminal standard. A wrongful dismissal action is a civil case, and in F.H. v. McDougall the Supreme Court of Canada confirmed there is one civil standard of proof: the balance of probabilities. The seriousness of the allegation does not raise the standard, but the evidence must still be clear, convincing and cogent. The employer alleging cause carries the burden of proving it.
Is a small theft enough to justify dismissal without notice?
It depends on context, not on the dollar figure alone. In McKinley v. BC Tel the Supreme Court of Canada held that whether dishonesty justifies summary dismissal requires assessing whether it caused a breakdown in the employment relationship, and that the sanction must be proportionate to the misconduct. A small taking by a trusted controller can be more serious than a larger one by a junior employee. Proven theft, misappropriation or serious fraud is treated as grave, but the finding itself rests on the surrounding circumstances.
Can I win on just cause and still owe termination and severance pay in Ontario?
Yes, and employers are regularly caught by this. Under Ontario Regulation 288/01 made under the Employment Standards Act, 2000, an employee loses statutory notice and severance only for wilful misconduct, disobedience or wilful neglect of duty that is not trivial and has not been condoned. In Render v. ThyssenKrupp Elevator (Canada) Limited the Ontario Court of Appeal upheld dismissal for cause at common law yet still ordered eight weeks of statutory termination pay, because the conduct was not wilful in the narrower statutory sense.
What should I do in the first 48 hours after I suspect an employee is stealing?
Preserve, then investigate. Forensically image the devices before anyone browses them, pull and export the video before the recorder overwrites it, export the transaction and access logs with their metadata, and secure any physical evidence with a written continuity record. Do not let IT reimage or clean the laptop, do not confront the employee, and do not announce anything internally. Once you tip the subject, the deletion starts.
Do I have to report employee theft to the police?
No. A criminal charge is not required to establish just cause, and a conviction is not required either. Involving police has real trade-offs: you lose control of timing, the devices and records you need may be seized as exhibits, and your investigative file can end up disclosed to the defence. Police involvement makes sense for large, organized, or ongoing losses. It is a decision to make with counsel, not reflexively.
Can I deduct the stolen amount from the employee’s final pay?
Not simply, and not safely. Section 13 of the Employment Standards Act, 2000 prohibits withholding or deducting wages except as authorized by that section. Even a written authorization from the employee does not permit a deduction where the employer had a cash shortage, lost property or had property stolen and a person other than the employee had access to the cash or property. Recovery normally runs through a civil claim, an insurance policy, or a restitution order after a conviction.
This article is general information about investigative practice in Ontario, not legal advice. Laws change and every situation is different. For advice about your specific circumstances, consult a licensed Ontario lawyer or contact a licensed investigator directly.