Investigation, Root-Cause Analysis, and Fraud Response

Introduction

Inventory discrepancies are not merely counting errors. They are signals that physical movement, system records, authorization, custody, or reporting controls may have failed. In a supply-chain environment, a discrepancy can arise from an innocent timing difference, a receiving mistake, a location error, process noncompliance, employee theft, organized external theft, supplier fraud, cyber-enabled manipulation, or a combination of causes. Effective stock auditing therefore requires more than identifying that book inventory differs from physical inventory. It requires a disciplined investigation that establishes what happened, when it happened, how it happened, why existing controls did not prevent or detect it, and what response is proportionate and lawful.

Investigation is both an analytical and governance activity. The investigator must preserve reliable evidence, avoid premature conclusions, protect due process, maintain confidentiality, and communicate findings to authorized decision-makers. Root-cause analysis should improve the system rather than simply assign blame. Fraud response, by contrast, must also address intentional deception, legal exposure, recovery, disciplinary action, and the possibility that the observed loss is only one part of a larger scheme.

This chapter presents an integrated method based on exception analysis, the five-whys method, fishbone analysis, process tracing, evidence preservation, interviewing, the fraud triangle and fraud diamond, escalation protocols, and corrective-action planning.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Distinguish an inventory exception from a confirmed loss or fraud event.
2. Prioritize exceptions using financial, operational, behavioral, and control-risk criteria.
3. Apply five-whys, fishbone, and process-tracing techniques without confusing symptoms with causes.
4. Preserve physical, documentary, digital, and testimonial evidence.
5. Conduct fair, information-seeking interviews and evaluate evidence cautiously.
6. Use the fraud-triangle and fraud-diamond models to structure fraud-risk hypotheses.
7. Apply proportionate escalation, reporting, containment, and recovery protocols.
8. Design corrective actions with owners, deadlines, control objectives, and effectiveness tests.

1. The Nature of an Inventory Exception

An exception is a condition that departs from an expected rule, record, pattern, or control. Examples include a negative on-hand balance, an unexplained adjustment, a receipt posted after goods were put away, repeated short shipments from one supplier, excessive pick reversals, or a high-value item found in an unauthorized location.

An exception is not automatically evidence of fraud. It is an investigation trigger. The initial classification should distinguish at least four possibilities:

A useful inventory accuracy metric is the absolute discrepancy rate:

Here, physical quantity and book quantity must use the same stock-keeping unit, unit of measure, location, and cutoff time. The metric is meaningful only when records are frozen or movements are controlled during the count. If book quantity is zero, the ratio is undefined; an organization should instead report the absolute quantity or value discrepancy. For mixed-value inventory, a value-based measure is often more informative:

The summation covers item classes indexed by i. The cost basis must be stated because standard cost, weighted-average cost, FIFO cost, and replacement cost answer different managerial questions. A positive result indicates book stock exceeds verified stock; negative results may indicate overages, timing errors, or master-data problems.

2. Exception Analysis and Investigation Triage

2.1 From population to priority

Large warehouses generate thousands of exceptions. Investigators should not examine them in arbitrary sequence. Triage ranks cases according to likely impact and urgency. Relevant factors include:

• financial exposure and margin sensitivity;
• safety, regulatory, product-quality, or recall implications;
• evidence of intentional concealment;
• recurrence and trend concentration;
• involvement of privileged access or management override;
• vulnerability of the item, such as high value, resale demand, or controlled status;
• risk that evidence will be destroyed or that losses will continue;
• customer, supplier, insurer, lender, or reputational consequences.

A simple prioritization score may be used when governance rules permit it:

Each factor is normally rated on a documented ordinal scale, such as 1 to 5. This is not a probability calculation unless the organization defines and validates the scales. Its purpose is consistent triage, not false precision. A high score should trigger faster review, stronger containment, or specialist involvement.

2.2 Pattern analysis

Exception analysis becomes more powerful when it examines relationships rather than isolated transactions. Useful dimensions include SKU, location, shift, employee or user ID, supplier, carrier, customer, transaction type, workstation, date, and adjustment reason. Analysts should look for:

• concentration near shift changes or control handoffs;
• repeated adjustments just below approval thresholds;
• discrepancies following cycle counts or system outages;
• one user correcting transactions created by another user;
• unusual reversals, deletions, or backdated entries;
• losses clustered around high-value or easily resold products;
• divergence between picking, packing, shipping, and invoicing records.

A pattern is a lead, not proof. For example, concentration on a night shift may reflect weaker supervision, a different product mix, delayed postings, or biased counting—not necessarily misconduct.

2.3 Establishing the investigation question

A poorly framed question produces unfocused work. “Who stole the inventory?” assumes both theft and a perpetrator before evidence exists. Better questions are:

• What quantity and value cannot be reconciled at the cutoff time?
• Which process step first shows divergence between physical and system evidence?
• Which people, systems, locations, and third parties had authorized access?
• What control should have prevented or detected the divergence?
• Is there evidence of intent, benefit, concealment, collusion, or unauthorized access?

3. Root-Cause Analysis

Root-cause analysis seeks conditions whose removal would materially reduce recurrence. It should not stop at the immediate error. If a receiver enters 90 units instead of 9, “data-entry error” describes the event. Further analysis may identify a confusing screen, no independent verification, excessive workload, poor unit-of-measure design, or an incentive to process receipts rapidly.

3.1 The five-whys method

The five-whys method repeatedly asks why an observed condition occurred. Five is a guideline, not a mandatory number. The process should stop when the team reaches a controllable cause supported by evidence, while recognizing that multiple causal paths may exist.

Example:

1. Why was inventory missing? The system showed 500 units, but only 470 were verified.
2. Why did the system show 500? A receipt for 30 units was posted although the goods were not physically present.
3. Why was the receipt posted early? The receipt process allowed posting from an advance supplier notice.
4. Why was that allowed? The system treated the notice as sufficient confirmation and lacked a physical-receipt status.
5. Why was the design not corrected? Process ownership and control-review responsibilities were undefined.

The analysis identifies a system and governance weakness, not merely an employee action. Investigators should test each link against documents, timestamps, access logs, and interviews. A speculative chain should be labeled as a hypothesis.

3.2 Fishbone analysis

Fishbone, or cause-and-effect, analysis organizes possible causes under categories. Common categories for stock discrepancies are:

• People: training, staffing, fatigue, incentives, collusion, segregation of duties;
• Methods: receiving, picking, counting, returns, disposal, and adjustment procedures;
• Machines and systems: scanners, interfaces, access controls, outages, master data;
• Materials and products: packaging, unit conversion, serialization, damage, substitution;
• Measurement: count methods, tolerances, cutoff rules, valuation, sampling;
• Environment: layout, lighting, congestion, temperature, security, shift handover;
• Management: supervision, targets, exception review, accountability, risk appetite.

The fishbone is a hypothesis-generation tool. It does not establish causation. Each proposed cause must be tested through process records, observation, reproduction, data analysis, or reliable testimony. Teams should distinguish causes that are necessary, contributing, enabling, or merely correlated.

3.3 Process tracing

Process tracing reconstructs the life of a unit, pallet, serial number, or transaction through the supply chain. A typical trace includes purchase order, advance notice, receipt, quality hold, put-away, transfer, pick, pack, shipment, return, adjustment, and disposal. For serialized or lot-controlled products, the trace should include serial, lot, batch, expiry, and custody information.

The investigator should build a timeline with at least four columns: event time, system record, physical or documentary evidence, and responsible role. Differences between event time and posting time are often decisive. A transaction posted at 16:00 may represent a physical movement at 10:00, a delayed entry, or a fictitious movement. The distinction must be established rather than assumed.

Process tracing is especially useful for identifying the first point at which the expected quantity or authorization ceased to match reality. That point is often more valuable than the last place the item was seen.

4. Evidence Preservation and Evaluation

4.1 Evidence categories

Relevant evidence may include:

• count sheets, recount records, photographs, seals, labels, and location maps;
• purchase orders, delivery notes, bills of lading, packing lists, invoices, and credit notes;
• warehouse-management-system and enterprise-resource-planning records;
• user-access logs, audit trails, handheld-device records, and interface messages;
• CCTV, gate logs, vehicle records, badge data, and visitor registers;
• emails, messages, operating procedures, training records, and approval workflows;
• damaged goods, packaging, samples, serial numbers, and physical exhibits;
• interview notes and signed statements where policy permits.

Evidence should be relevant, authentic, complete enough for interpretation, and protected from alteration. A spreadsheet exported from a system is not self-authenticating; investigators should record who exported it, when, using which report or query, with what filters, and how the file was preserved.

4.2 The preservation sequence

A sound sequence is:

1. Contain: protect people, inventory, systems, and records from continuing loss or alteration.
2. Document the scene: record date, time, location, stock status, photographs, seals, and persons present.
3. Freeze or copy data: use authorized, preferably read-only, exports and preserve original metadata.
4. Control access: maintain a chain-of-custody log for physical and digital evidence.
5. Record methods: document queries, filters, recount procedures, assumptions, and exclusions.
6. Analyze working copies: never manipulate the only original.
7. Retain according to policy and law: apply legal holds where litigation or regulatory action is reasonably anticipated.

Evidence preservation must respect privacy, labor law, data-protection requirements, surveillance rules, and contractual restrictions. Investigators should consult legal counsel or an authorized investigations function when the matter may become disciplinary, criminal, regulatory, or litigated.

4.3 Evidence quality and corroboration

A statement, system record, or video clip may be incomplete or misleading when viewed alone. Strong conclusions usually result from convergence: an access record places a person in a location, a transaction shows a movement, CCTV shows a handoff, and physical evidence confirms the item. Absence of a record is not automatically proof that an event did not occur; systems may be offline, shared credentials may exist, or retention periods may have expired.

Investigators should separate:

• fact: directly observed or reliably documented;
• inference: a reasoned interpretation of facts;
• hypothesis: a proposition requiring testing;
• conclusion: an evidence-based determination within the investigator’s mandate.

This discipline reduces confirmation bias and protects procedural fairness.

5. Interview Principles

Interviews are information-gathering activities, not performances designed to obtain admissions. The interviewer should prepare a chronology, identify knowledge gaps, review relevant records, and determine whether the person is a witness, process owner, subject, or specialist. Roles may change as evidence develops, so the interview must be conducted fairly.

Effective practice includes:

• explain purpose and confidentiality limits honestly;
• begin with open questions such as “Please describe the receiving process on that date”;
• obtain a free narrative before showing selected evidence;
• move from general chronology to specific transactions;
• ask one question at a time and allow silence;
• distinguish personal observation from hearsay;
• test alternative explanations without accusatory language;
• summarize the account and invite correction;
• document date, attendees, exhibits, and material responses;
• provide representation or other rights required by policy or law.

Interviewers should avoid leading questions, threats, promises of secrecy that cannot be honored, unnecessary disclosure of evidence, and assumptions based on demeanor. Nervousness is not proof of deception, and confidence is not proof of truth. Where a matter is potentially criminal or disciplinary, trained specialists should lead or advise the process.

6. Fraud Models and Their Use

6.1 The fraud triangle

The fraud triangle proposes three commonly interacting conditions:

1. Pressure or incentive: financial need, performance targets, debt, addiction, perceived unfairness, or organizational pressure.
2. Opportunity: weak access controls, poor segregation of duties, unmonitored adjustments, inadequate physical security, or management override.
3. Rationalization: beliefs such as “the company owes me,” “everyone does it,” or “I am only borrowing it.”

The model is explanatory, not predictive. The presence of pressure does not imply fraud, and fraud can occur without an obvious personal financial crisis. Investigators should use the model to ask what conditions enabled the event and what controls should be strengthened.

6.2 The fraud diamond

The fraud diamond adds capability: the person’s position, access, technical knowledge, confidence, ability to persuade others, or capacity to exploit organizational complexity. In inventory cases, capability may include knowledge of cycle-count schedules, authority to approve adjustments, ability to alter master data, or access to multiple systems.

The added dimension is valuable because pressure and opportunity may be widespread, while only a few individuals possess the access and skill to execute and conceal a scheme. It must not become a shortcut for profiling or stereotyping. Capability should be assessed through role permissions, demonstrated actions, and system evidence.

7. Escalation and Fraud Response

Escalation should be defined before an incident occurs. A typical protocol is:

Immediate containment may include segregating stock, suspending questionable adjustments, changing access rights, preserving CCTV, requiring dual authorization, or placing a transaction hold. Containment should be proportionate and should not destroy evidence or unfairly stigmatize an individual.

A case file should state the allegation or question, scope, dates, methods, evidence index, analysis, limitations, findings, financial estimate, control failures, and recommended actions. Findings should use carefully defined categories such as substantiated, unsubstantiated, inconclusive, or control failure without evidence of individual misconduct. Monetary recovery, disciplinary action, and criminal referral are separate decisions and should not be conflated.

8. Corrective-Action Planning

A corrective action is effective only when it addresses a verified cause and can be tested. A useful action register contains:

Actions should follow the hierarchy of control where practical. Preventive controls—such as scan validation, system-enforced segregation, serialized tracking, and restricted adjustment rights—are generally stronger than detective reviews alone. Detective controls remain important, especially for deliberate circumvention. Training is necessary when knowledge is a cause, but training alone is weak when the process permits easy error or override.

Effectiveness testing might compare discrepancy rates before and after implementation, review a sample of adjustments, test access rights, observe a live receiving process, or perform surprise counts. The test must have a defined population, period, criterion, and pass condition. Closure should occur only when implementation and effectiveness are both demonstrated.

9. Integrated Applied Case

Illustrative case: The recurring high-value variance

Background. A regional distribution center discovers repeated shortages in premium electronic accessories. Monthly cycle counts show book inventory exceeding physical stock by 18 to 35 units. The total recorded cost is material but below the threshold that automatically triggers external reporting.

Problem. The losses are concentrated in one secure cage and occur mainly during weekends. Several inventory adjustments are posted on Monday mornings with the reason “count correction.” Initial suspicion focuses on weekend warehouse staff.

Analysis. Exception analysis shows that the same user account posts most Monday adjustments, but the account belongs to a team leader whose credentials are also used at the weekend workstation. Access-log review shows that the user account was active during periods when the team leader was not present. Process tracing identifies a recurring sequence: a transfer from the secure cage to a staging location, a pick reversal, and a later adjustment. CCTV shows pallets moved, but camera coverage does not clearly identify individual units. A recount finds that two product codes share similar packaging and that one scanner profile permits substitution without a confirmation prompt.

The five-whys analysis begins with the shortage and initially points to unauthorized removal. Further testing identifies three interacting causes: weak substitution controls, shared credentials, and inadequate weekend handover. The fraud-diamond analysis identifies opportunity and capability but does not establish intent or identify a perpetrator. The team therefore avoids an unsupported accusation.

Approach. Management immediately disables shared credentials, preserves access logs and CCTV, requires dual verification for secure-cage transfers, and places the affected products under serialized review. Internal audit and HR conduct separate but coordinated interviews. IT determines that the user account was used from two terminals simultaneously, which is inconsistent with the team leader’s reported schedule. Legal counsel advises on data preservation and employee rights. A broader review finds that 11 other sites use the same scanner configuration.

Outcome. The investigation substantiates a control failure and confirms unauthorized transactions, but the available evidence is insufficient to attribute every missing unit to one individual. The organization corrects master data, restricts substitution, eliminates shared credentials, reviews access rights, expands testing to other sites, and pursues recovery under approved procedures. A later surprise-count program shows a substantial decline in the affected exception pattern.

Learning points. First, concentration by shift or user is a risk indicator, not proof. Second, a system identity is not necessarily a person. Third, process tracing can reveal a control path that produces both error and concealment. Fourth, corrective action should address enterprise-wide exposure when a common configuration is involved. Finally, a fair investigation may substantiate a control failure even when individual fraud cannot be proven.

10. Technology, Analytics, and Contemporary Practice

Warehouse and enterprise systems generate detailed audit trails, making automated exception detection increasingly practical. Rules can flag unusual adjustment amounts, rapid reversals, impossible travel between locations, dormant accounts used after hours, or transactions just below approval limits. Statistical and machine-learning models can identify clusters and deviations from normal behavior, but their outputs are leads rather than findings.

AI-assisted analysis introduces risks. Models may reproduce historical bias, confuse correlation with causation, expose personal data, or produce explanations that investigators cannot validate. Governance should require documented data sources, access controls, model versioning, human review, explainable alert logic where feasible, and retention of the evidence supporting each decision. Automated scores should never replace due process or serve as the sole basis for disciplinary action.

Contemporary investigations increasingly require coordination among supply-chain operations, internal audit, cybersecurity, data protection, legal, human resources, and insurance functions. The boundaries between physical shrinkage and digital compromise are less distinct when attackers manipulate orders, master data, credentials, or interfaces. Consequently, stock-audit programs should include identity governance, system-change monitoring, and incident-response coordination.

Challenges and Limitations

Investigation is constrained by incomplete records, shared credentials, missing video, delayed postings, unreliable master data, language differences, turnover, and pressure to close cases quickly. Root-cause tools can oversimplify complex systems; the five-whys may force a single chain where several causes interact, and fishbone diagrams may generate long lists without testing. Fraud models can encourage hindsight bias or unfair profiling. Financial estimates may be uncertain when valuation, timing, or recoverability is disputed.

These limitations should be disclosed. A professional report states scope, assumptions, data gaps, confidence, alternative explanations, and unresolved questions. Transparency about uncertainty strengthens rather than weakens the credibility of the investigation.

Chapter Summary

Stock discrepancies are investigation triggers, not automatic proof of fraud. Effective investigation begins with clear questions, disciplined triage, and analysis of patterns across items, locations, people, systems, and time. Root-cause analysis uses five-whys and fishbone methods to move beyond symptoms, while process tracing reconstructs the physical and transactional history of inventory.

Reliable findings depend on evidence preservation, chain of custody, corroboration, and separation of facts from inferences and hypotheses. Interviews should be fair, open-ended, and legally appropriate. The fraud triangle highlights pressure, opportunity, and rationalization; the fraud diamond adds capability. These models structure inquiry but do not prove misconduct.

Escalation must be proportionate and predefined. Corrective actions should address verified causes, assign ownership, establish deadlines, and include effectiveness testing. Technology and AI can improve detection, but automated alerts require human validation, privacy safeguards, and due process. The strongest stock-audit response protects evidence, limits ongoing loss, treats people fairly, and improves the control system.

Key Terms

Exception: A departure from an expected record, rule, pattern, or control.

Shrinkage: Inventory loss or unexplained reduction between recorded and verified stock.

Triage: Prioritizing cases according to impact, likelihood, urgency, and risk.

Root cause: An underlying condition whose removal would materially reduce recurrence.

Five-whys: An iterative questioning method used to move from symptom toward cause.

Fishbone analysis: A structured diagramming method for generating categories of possible causes.

Process tracing: Reconstruction of an item’s or transaction’s movement through linked process stages.

Chain of custody: Documented control of evidence from collection through storage, analysis, and disposition.

Audit trail: A chronological record of system actions, users, timestamps, and changes.

Corroboration: Confirmation of a fact or account through independent evidence.

Interview: A structured information-gathering conversation conducted under fair and documented conditions.

Fraud triangle: A model comprising pressure, opportunity, and rationalization.

Fraud diamond: The fraud triangle extended by the element of capability.

Containment: Immediate action to prevent continuing loss, alteration, or unauthorized access.

Escalation: Referral of a matter to a higher authority or specialist function.

Corrective action: A targeted intervention intended to remove or reduce a verified cause.

Effectiveness testing: Evaluation of whether an implemented control operates as intended.

Residual risk: Risk remaining after controls or corrective actions are applied.

Review Questions

Short Answer Questions

1. Why is an inventory exception not necessarily evidence of fraud?
2. What conditions must be controlled for a discrepancy-rate calculation to be meaningful?
3. Distinguish a fact, an inference, and a hypothesis in an investigation.
4. What additional element does the fraud diamond add to the fraud triangle?
5. Why should corrective actions include effectiveness testing?

Long Answer Questions

1. Explain how exception analysis, process tracing, and root-cause analysis can be integrated in a stock investigation.
2. Discuss the main principles of preserving physical, documentary, and digital evidence.
3. Compare the five-whys method and fishbone analysis, including their strengths and limitations.
4. Explain how interview practice can protect both investigative quality and procedural fairness.
5. Design an escalation protocol for a distribution center experiencing recurring high-value inventory shortages.

Analytical / Application Questions

1. A warehouse records a shortage concentrated among Monday adjustments, but the relevant user account was shared by three employees. Develop an investigation plan that distinguishes process error, unauthorized access, and fraud.
2. A five-whys review identifies inadequate training as the apparent cause of repeated receiving errors. Critically evaluate whether training is sufficient and propose stronger preventive and detective controls.
3. Using the illustrative case, prepare a corrective-action register with at least four actions, accountable owners, completion evidence, and effectiveness tests.

Multiple Choice Questions with Answers

Question 1

What is the most appropriate interpretation of an inventory exception?

A. It is conclusive proof that an employee committed theft.

B. It is a trigger for investigation and classification.

C. It is always caused by incorrect product valuation.

D. It should be corrected immediately without preserving evidence.

Correct Answer: B. It is a trigger for investigation and classification.

Question 2

In the discrepancy-rate formula, what condition is required for the physical and book quantities to be comparable?

A. They must use different units of measure.

B. They must refer to the same SKU, location, unit of measure, and cutoff time.

C. The book quantity must always be zero.

D. The physical quantity must be estimated from sales data.

Correct Answer: B. They must refer to the same SKU, location, unit of measure, and cutoff time.

Question 3

What is the primary purpose of process tracing?

A. To assign blame before evidence is collected.

B. To reconstruct the movement and transaction history of inventory.

C. To replace all interviews with automated reports.

D. To calculate a company’s annual profit.

Correct Answer: B. To reconstruct the movement and transaction history of inventory.

Question 4

Which of the following is part of the fraud triangle?

A. Capability

B. Opportunity

C. Forecast accuracy

D. Inventory turnover

Correct Answer: B. Opportunity

Question 5

What does the fraud diamond add to the fraud triangle?

A. Capability

B. Materiality

C. Valuation

D. Seasonality

Correct Answer: A. Capability

Question 6

Which interview practice is most appropriate?

A. Begin by accusing the interviewee of theft.

B. Use only yes-or-no questions.

C. Obtain a free narrative before presenting selected evidence.

D. Promise complete secrecy regardless of legal requirements.

Correct Answer: C. Obtain a free narrative before presenting selected evidence.

Question 7

Which action is an example of evidence preservation?

A. Deleting duplicate system records to simplify analysis.

B. Changing the original exported file during analysis.

C. Recording who exported data, when, and with which filters.

D. Allowing unrestricted access to the evidence folder.

Correct Answer: C. Recording who exported data, when, and with which filters.

Question 8

A high priority score in an ordinal triage system should generally be interpreted as indicating:

A. A mathematically proven probability of fraud.

B. A need for faster or stronger review based on defined risk ratings.

C. Automatic grounds for criminal referral.

D. A requirement to dismiss the case as immaterial.

Correct Answer: B. A need for faster or stronger review based on defined risk ratings.

Question 9

Which corrective-action feature demonstrates whether a control actually reduced recurrence?

A. A general statement that training was completed.

B. An effectiveness test with a defined criterion and pass condition.

C. A verbal assurance from the process owner.

D. A higher inventory target.

Correct Answer: B. An effectiveness test with a defined criterion and pass condition.

Question 10

Why should AI-generated inventory alerts not be treated as final findings?

A. AI cannot process any warehouse data.

B. Alerts may reflect correlation, bias, incomplete data, or model error.

C. Automated systems are always slower than manual counts.

D. AI outputs are legally conclusive only when losses are small.

Correct Answer: B. Alerts may reflect correlation, bias, incomplete data, or model error.