Rightshold™ Sign up

Evidence Delivery · $99 / 30 days · Offers open November 18, 2026 · online purchasing currently unavailable

Answers · bookkeeping

How can a small business owner or their accountant tell whether an employee is stealing stock and covering it by recording the missing goods as shrinkage, scrap, spoiled or obsolete stock, or by adjusting the inventory counts?

Last updated

TL;DR: Because stock gets counted, someone stealing it usually has to make the records agree with the shelf. The common covers are an inventory quantity adjustment posted to a shrinkage account, a write-off as scrap, spoiled or obsolete stock, altered count sheets, or a fake sale of the missing goods that is later cancelled or written off as bad debt. In QuickBooks Online Plus and Advanced, an inventory quantity adjustment changes an item's quantity without recording a purchase or sale and posts the value to Inventory Shrinkage under cost of goods sold, and earlier adjustments can be edited or deleted. So the test is whether each write-off is backed by evidence the person posting it didn't produce: a count done by someone else, the damaged goods or disposal record, and a second approval. In the ACFE's Occupational Fraud 2026 report, theft of noncash assets such as inventory was the most common form of asset misappropriation: 23% of cases, a median loss of USD 75,000 and a median duration of 12 months. It appeared in 19% of cases at organizations with fewer than 100 employees.

What should I check, step by step?

1. Pull every inventory adjustment and write-off for the last 12 months, with who posted it, the date, the reason and the value. Sort by person, location, item and reason code. Clusters matter more than totals.

  1. Look hardest at write-offs of small, valuable, easy-to-resell items, and at adjustments posted just before or just after a physical count.
  2. Separate the jobs: the person who handles or receives stock shouldn't also post adjustments or write-offs, and shouldn't count their own area alone.
  3. Require evidence for every write-off over a set value: a count by someone else, a photo or the damaged goods themselves, a supplier return or a disposal receipt, and a second person's approval before it is posted.
  4. Do scheduled and unscheduled counts, and tell staff that unscheduled counts happen. Count sealed boxes, not just the labels on them.
  5. Compare inventory adjustments with refunds by employee, and list everyone who can post both. A refund with no goods back plus a later shrinkage entry is one theft recorded twice.
  6. Watch bad debt. A rise in written-off receivables can mean stock was shipped on a fake sale that was never going to be paid.
  7. Keep a dated copy of each count and its approval somewhere the stock staff can't edit, so a count sheet can't be rewritten after the adjustment is posted.
  8. If you suspect theft, talk to your accountant or a fraud examiner before confronting anyone, and keep the counts and records as they are.

How do employees hide inventory theft as shrinkage, scrap or write-offs?

The ACFE's 2026 fraud tree splits noncash theft into misuse (using company assets without taking them) and larceny (taking them). Simple larceny is carrying stock out; the harder part for the thief is that a count will eventually show the gap, so the records have to be made to agree.

Can someone change inventory quantities in QuickBooks Online without a sale or purchase?

Intuit's help page says that if you track inventory in QuickBooks Online Plus or Advanced you can manually adjust an item's quantity without recording a purchase or sale, to match what you have in stock. You choose an inventory adjustment account, enter a new quantity or a change, add a memo and save; QuickBooks then adjusts the Inventory Asset account and cost of goods sold under Inventory Shrinkage.

What does the ACFE 2026 report say about inventory and noncash asset theft?

Occupational Fraud 2026: A Report to the Nations covers 2,402 cases. Theft of noncash assets was the most common of the nine asset misappropriation sub-schemes it tracks: 549 cases (23%), with a median loss of USD 75,000 and a median duration of 12 months. The report places it, with billing and check and payment tampering, among the sub-schemes posing the greatest combined risk of frequency and loss.

How do I ask Rightshold about this (free, no key)?

Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Open a human approval request before my store manager posts an inventory write-off over $200. The action is writing off 12 units of one item as damaged in storage; I want my approval recorded against the exact item, quantity, count and photo before the adjustment goes into QuickBooks.”

One-click setup

{
  "tool": "request_human_approval",
  "arguments": {
    "action": {
      "type": "inventory_write_off",
      "sku": "SKU-4471",
      "quantity": 12,
      "unit_cost_cents": 3850,
      "reason_code": "damaged_in_storage",
      "count_ref": "COUNT-2026-11-12-B",
      "count_sheet_sha256": "<sha256 of the count sheet scan>",
      "photo_sha256": "<sha256 of the photo>"
    },
    "summary": "Write off 12 units of SKU-4471 (USD 462.00 at cost) as damaged in storage, per count COUNT-2026-11-12-B by a second staff member.",
    "expires_in_minutes": 1440
  }
}

Rightshold doesn't connect to QuickBooks, your POS or your stockroom, and it can't stop anyone posting an inventory adjustment, count stock or detect theft. It records the approvals you ask for and lets anyone check them later, so it only helps if someone compares the write-offs in the books against them. QuickBooks behavior is from Intuit's help page as checked on November 13, 2026; ACFE figures are from Occupational Fraud 2026. Not legal, tax, audit or accounting advice.

What are the sources?

Related

Not legal advice. JSON · Markdown · All answers

Get a free API key in one call

No card and no email needed. 100 free credits; the license and policy checks stay free without a key.

curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_...   # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
  -H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'