Employee theft investigation