Bank statements, invoices, and expense reports must be secured and catalogued without modification.
Evidence documentation is the structural backbone of any defensible employee theft investigation in California. Without a proper record of what was collected, how it was handled, and who had access to it, even compelling evidence can be challenged, excluded, or rendered useless in subsequent employment or legal proceedings. California employers face a dual obligation: to gather sufficient evidence to support a factual finding, and to do so in a manner that complies with the state’s robust employee privacy and monitoring laws.
This article provides a practical framework for documenting evidence in a California employee theft investigation, from the moment suspicion arises through the completion of the investigation record, with particular attention to the legal constraints that distinguish California from most other states.
Proper documentation is the foundation of every defensible workplace theft investigation.
California imposes significantly stricter privacy protections on employers than federal law requires. The California Constitution recognizes privacy as an explicit, inalienable right. The California Electronic Communications Privacy Act (CalECPA), the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), Labor Code section 980, and California Penal Code section 637.7 collectively create a legal framework that limits how, when, and with what notice employers may gather electronic and physical evidence.
An employer who collects evidence without understanding these boundaries may obtain information that cannot be used, or worse, may expose the organization to a separate legal claim arising from the manner of collection. The investigation process must therefore be designed in advance, with documentation standards established before evidence is gathered rather than reconstructed after the fact.
Kathie Allen of Allen Morris Investigations has conducted workplace theft investigations for employers ranging from small businesses to large public agencies throughout Orange County and California. A consistent finding across those engagements: organizations that maintained contemporaneous, structured documentation throughout the investigation produced far more defensible findings than those that reconstructed their process after identifying the subject. Documentation is not administrative overhead. It is the investigation itself, recorded.
The investigation record should begin the moment a decision is made to open a formal inquiry. This opening documentation should include the date the decision was made, who authorized the investigation, the nature of the allegations or initial indicators, and the identity of the assigned investigator.
If an external investigator is retained, the scope of the engagement should be confirmed in writing. This written scope serves two purposes: it defines the boundaries of the investigation, and it creates a record that the inquiry was methodical and purposeful rather than reactive or targeted at a specific individual without basis.
Every subsequent action taken in the investigation should be entered into a centralized investigation log maintained by the investigator. This log records dates, times, actions taken, observations made, evidence collected, and any decisions with their stated rationale. Gaps in this log become gaps in the defensibility of any conclusions drawn.
Physical evidence must be documented with date, location, and collector name.
Physical evidence in employee theft investigations may include cash, company property, inventory items, documents, receipts, or any tangible item relevant to the alleged conduct. Each item collected should be documented at the point of collection with the following information: the date and time it was collected, the location from which it was taken, the name of the person who collected it, and a description specific enough to distinguish it from similar items.
Physical evidence should be stored in a secure, access-controlled location. A log of who accessed the evidence storage area, and when, should be maintained throughout the investigation. This process, commonly referred to as chain of custody, establishes that the evidence has not been altered, contaminated, or substituted between collection and any later proceeding.
Photographs should be taken of physical evidence in situ before it is moved. These photographs establish the original condition and location of each item and provide a visual record that supplements the written log.
Document review is among the most significant components of an employee theft investigation. Bank statements, invoices, expense reports, purchase orders, payroll records, timesheets, and any other financial documentation relevant to the alleged conduct should be identified, collected, and catalogued.
Originals should be secured where possible. If originals cannot be removed from the organization’s systems, certified copies or complete digital exports should be obtained and date-stamped at the time of collection. The investigator should note, for each document: the source system or location, the date range covered, who produced the document, and the date on which it was collected.
Documents must not be annotated, highlighted, or otherwise modified after collection. Any analysis of documents should be recorded separately in the investigator’s notes, with specific citations to the unaltered source documents. Alterations to collected documents, even well-intentioned ones such as handwritten notes in the margin, can create chain of custody challenges.
All electronic evidence must be preserved and comply with California privacy law.
Electronic evidence in California workplace investigations is subject to significant legal constraints. Employers may generally access and collect information from company-owned devices and systems for which employees have received prior notice of potential monitoring. California law requires that employees be informed of monitoring practices; notice by signage alone is generally insufficient, and employers relying on existing electronic use policies should confirm that those policies explicitly address investigative access.
Labor Code section 980 prohibits employers from requiring or requesting employees to disclose personal social media credentials. However, section 980 also provides that an employer may request disclosure of personal social media reasonably believed to be relevant to an investigation of employee misconduct, provided the information is used solely for that purpose. The distinction between employer-directed disclosure and coercive demand matters under the statute, and this distinction should be documented clearly if personal social media evidence becomes relevant.
For digital evidence, best practices include working from forensic copies rather than originals wherever possible, preserving metadata and file timestamps, and documenting the tools and methods used in the collection and review process. Screenshots should be dated and the URL or file path visible. Email evidence should be preserved with full header information, not printed to PDF in a manner that strips routing data.
Kathie Allen has observed that in California workplace investigations, digital evidence is increasingly central and increasingly challenged. An investigator who can demonstrate that digital evidence was collected through a methodical, well-documented process has a significant advantage when findings are disputed.
Electronic evidence requires careful handling to preserve metadata and comply with California privacy law.
California law requires that employers not conduct video surveillance in areas where employees have a reasonable expectation of privacy. Restrooms, locker rooms, and certain break areas are categorically prohibited. Common work areas, points of sale, inventory areas, and entrances may be monitored, but only with appropriate notice to employees.
Surveillance footage collected as part of a theft investigation should be preserved in its original, unedited format. The chain of custody documentation for video evidence should include the name of the system, the camera identification, the date and time range preserved, who extracted the footage, the extraction method, and the storage format. Edited or clipped versions used for review should be clearly distinguished from the preserved originals.
Interview records are a critical component of the investigation file. Every investigative interview should be documented in a written summary prepared by the investigator as close in time to the interview as possible, ideally the same day.
The interview summary should identify the witness by name and role, the date, time, and location of the interview, who was present, and the substance of what was discussed. Direct quotations should be used sparingly and only where the precise language matters. The investigator should clearly distinguish in the summary between what the witness stated and what the investigator observed or assessed.
Witness summaries should be treated as confidential working documents maintained in the investigation file. California employers should be aware that broader confidentiality instructions to witnesses, such as prohibiting them from discussing the investigation with anyone, carry risk under the National Labor Relations Act, which limits employer restrictions on concerted employee communications. Any confidentiality guidance given to witnesses should be tailored and documented, with the specific business justification noted.
Each item of physical evidence must be documented at the point of collection with date, location, and collector name.
The complete investigation file should include, at minimum: the opening authorization document, the investigation log, all collected evidence with chain of custody records, all interview summaries, any interim findings or notes, legal counsel communications (maintained under privilege where applicable), and the final investigation report.
The file should be stored securely, with access limited to those with a legitimate need. In California, employee records, including investigation records that may contain personal information, are subject to employee inspection rights under Labor Code section 1198.5. Employers should be prepared for the possibility that an investigation file, or portions of it, may be subject to later legal discovery.
Investigation files should not be destroyed prematurely. While retention periods vary by record type, any file that relates to a matter that has resulted in, or could result in, litigation, administrative proceedings, or a formal complaint should be preserved until all related proceedings have concluded.
Can an employer access an employee’s work email without notice?
Employers may generally access employer-owned email systems if they have provided prior notice of that policy to employees. The existence of a written electronic communications policy, signed by the employee, is the most defensible approach. Accessing an email account without any prior notice or policy creates a risk of challenge under CalECPA.
What happens if chain of custody is broken during an investigation?
A break in the chain of custody does not automatically render evidence unusable, but it creates a credibility problem. The opposing party, whether in litigation, arbitration, or an administrative proceeding, will use the gap to argue that the evidence may have been altered or substituted. Complete, contemporaneous documentation from the point of collection forward is the most effective protection.
Can video surveillance evidence be used in a California termination proceeding?
Yes, provided the footage was obtained from a lawfully maintained surveillance system covering an area where the employee did not have a reasonable expectation of privacy, and provided appropriate prior notice was given. Footage from a prohibited area, or footage captured without any notice to employees, carries significant legal risk.
Should the investigation file include the investigator’s credibility assessments?
Credibility assessments belong in the final investigation report, clearly labeled as the investigator’s conclusions and supported by the specific evidence and observations that informed each assessment. They should not be interspersed informally throughout the evidence file, where they could be misread as established fact rather than analysis.
At what point should legal counsel be involved in evidence documentation?
Legal counsel should be engaged before or at the outset of any investigation that may result in termination, criminal referral, or litigation. Attorney-client privilege can protect certain communications and work product generated during the investigation, but that protection must be established deliberately and documented appropriately.
Documenting evidence in a California employee theft investigation is not a secondary concern. It is the process through which findings become defensible, decisions become sustainable, and the employer’s position is protected. California’s privacy and monitoring laws add a layer of complexity that requires advance planning, consistent methodology, and informed legal guidance.
Allen Morris Investigations provides fully documented, legally defensible workplace theft investigations for employers throughout Orange County and California. If your organization is facing a potential theft matter, contact us for a confidential consultation.
For a complete overview of the investigation process, visit our practical guide to investigating employee theft. For context on the warning signs that typically precede a theft investigation, see signs of employee theft California employers should never ignore. For information on the full range of employee misconduct investigation services we provide, visit our employee misconduct page or our workplace investigations overview.
About Kathie Allen
Kathie Allen is a licensed California Private Investigator (PI 27033) with over 20 years of experience conducting workplace investigations throughout Orange County and California. She is an Association of Workplace Investigators (AWI) trained investigator and Certified Title IX Investigator specializing in harassment, discrimination, employee misconduct, and Title IX compliance investigations for businesses, schools, and organizations.
Contact Allen Morris Investigations:
• Phone: 949-573-4624
• Email: Kathie@allenmorrispi.com
• Website: https://allenmorrispi.com
Schedule a consultation or learn more at Allen Morris Investigations.
Related resources: Read our practical guide to investigating employee theft, see our employee misconduct investigation services, or contact us for help.
