How to Investigate Petty Cash Theft: The Imprest Method, Step by Step

What the imprest system is supposed to do

An imprest float is a fixed amount of cash — say R2,000 or £200 — held for small expenses. The rule is simple and powerful:

At any moment, cash in the tin + value of receipts (vouchers) not yet reimbursed = the fixed float.

When the float runs low, the custodian submits the receipts, gets reimbursed exactly that amount, and the tin is topped back up to the fixed figure. That is the whole point: the total should never change. If the float is R2,000, then R2,000 is the number you can check against, any day, without warning.

This is why the imprest system is a gift to an investigator. A properly run imprest float is self-checking. Any shortfall has to be explained, because the maths is fixed.

Step 1: Establish the float amount and the rules

Before you count anything, confirm the basics on paper: what is the fixed float, who is the custodian, who authorises reimbursements, and what the documented procedure is. If there is no fixed float — if the tin just gets topped up by varying amounts whenever it runs low — then it is not really an imprest system, and that failure of control is itself a finding worth recording. Loose cash with no fixed baseline is almost impossible to reconcile and easy to skim.

Step 2: Do a surprise count

The reconciliation only means something if it is unannounced. If the custodian knows you are coming, a shortfall can be quietly covered from a pocket and put back afterwards. Count the physical cash — note the denominations — and total the vouchers and receipts held in the tin. Do this in front of the custodian and have them acknowledge the count. Record the date, time and who was present.

Step 3: Run the reconciliation

The sum is:

Cash counted + total of unreimbursed vouchers = the fixed float?

Three outcomes:

• It balances. Good control on the day. Note it and move to the pattern review — one clean count does not clear a year of history.
• It's short. Cash + vouchers comes to less than the float. Money is missing. This is the finding that triggers the rest of the investigation.
• It's over. More than the float. Less common, but it points to sloppy records, un-lodged reimbursements, or cash put in to disguise an earlier shortfall.

Step 4: Understand the common schemes before you accuse anyone

A shortfall tells you money is missing. It does not tell you how, or that it was stolen. Here are the schemes to test for — and note that several look identical to honest mistakes at first glance:

Straight skimming. Cash removed and no attempt to cover it. Shows as a plain shortfall.

Fictitious vouchers. Fake or inflated receipts submitted to justify a reimbursement that then goes in a pocket. Look for receipts with no supplier detail, round numbers, photocopies, duplicate receipts used twice, or handwriting that matches the custodian's.

Altered receipts. A genuine R50 receipt changed to R150. Look for overwriting, mismatched ink, or totals that don't add up from the line items.

Recycling receipts. The same genuine receipt submitted more than once across different reimbursement cycles. Only visible if you review history, not a single count.

Delayed lodging / teeming and lading. Borrowing from the float and replacing it before the next count, using a later reimbursement to plug the earlier hole. This is why one clean count is not a clearance — you have to look at the pattern over time.

Step 5: Pair every red flag with an innocent explanation

This is the part that separates a professional investigation from a witch hunt. A missing R300 is very often not theft. It can be a genuine expense paid out without a receipt being kept, a reimbursement claim still sitting in someone's drawer, a maths error in the running total, or a receipt that fell out of the tin. Write down the innocent explanation for every flag and test it. Ask for the missing paperwork. Check whether the "fictitious" supplier is simply a small vendor that gives handwritten slips.

You are building leads, not a verdict. The finding you can defend is "there is an unexplained shortfall of R X across this period, the following control failures allowed it, and these transactions could not be substantiated" — not "the custodian is a thief."

Step 6: Review the pattern over time

A single reconciliation is a snapshot. The real picture comes from the history: pull the reimbursement records for the past six to twelve months and look for the shape of it. Are shortfalls creeping up? Do they cluster before month-end or around the custodian's leave? Do reimbursement amounts always come out suspiciously round? Does the same receipt appear twice? Patterns are far more persuasive than any single missing note, and they are much harder to explain away as a one-off mistake.

Step 7: Document defensibly

Keep the count sheets, the photographs of the tin and vouchers, the reconciliation working, the schemes you tested, the innocent explanations you considered, and the transactions that remained unexplained. If this goes to a disciplinary hearing, the arithmetic and the paper trail are your case — not your impression of the person.

Doing the arithmetic without it becoming a spreadsheet nightmare

The imprest method is not hard maths, but doing it across a year of reimbursements — totalling vouchers, matching receipts, catching duplicates and spotting the trend — is fiddly and error-prone by hand. Conectir's financial tools are built to read the records, categorise the transactions, run the reconciliation with every sum shown in plain sight, and flag duplicates and outliers for you to judge. It computes and surfaces; it never declares fraud. If petty-cash and cashbook work is a regular part of your caseload, it is worth seeing how the financial analysis handles a reconciliation.