The Vanishing Overtime Hours
You are the lead investigator for a regional distribution center. The night-shift supervisor, Dana, has been flagged by an automated payroll audit: her team logged 412 overtime hours last quarter versus a 180-hour average for the other three shifts. Dana approved all of the overtime herself, and her own badge shows she left before midnight on 38 of the 52 nights in question. Two warehouse associates privately tell you the extra hours were real and that Dana 'told us to write them down so we'd get paid for the cleanup.' A third associate, who is on a performance improvement plan Dana initiated, claims the hours were fabricated and that Dana split the money with two team leads. Your HR partner wants to close the case this week as time theft. The company's policy manual requires documented approval for overtime but is silent on supervisor presence.
1. Assess whether you have enough to substantiate time theft and describe the case-management steps you would take before any disposition.
Read the worked answer
No, the record does not yet support a substantiated time-theft finding, and closing this week would be premature.
What you have: an anomaly (412 vs. 180 hours), a control weakness (Dana approved her own team's overtime), and conflicting witness accounts. None of these is proof of falsification.
What you lack:
- Independent corroboration of whether the cleanup work occurred (production logs, dock-door access records, camera footage, shipping manifests).
- A reconciliation of badge-out times against actual work performed - leaving early does not itself prove the hours were fake.
- Any documentary link between Dana and the alleged cash split.
Case-management steps:
- Freeze the payroll, badge, and scheduling data for the 52 nights before anything can be altered.
- Open a formal case file with a written scope and a conflict check on the third associate (his PIP creates a motive to implicate Dana - treat his statement as a lead, not a fact).
- Interview the two corroborating associates separately and ask for specifics (dates, tasks, who was present), not conclusions.
- Pull objective records: dock activity, inventory movements, and camera coverage for a sample of the highest-overtime nights.
- Document the policy gap and notify HR that the 'silent on supervisor presence' issue is a control finding, not evidence of misconduct.
- Set a realistic timeline and communicate it to HR rather than yielding to the one-week pressure.
2. The third associate's account is the only one alleging a cash split. How should you weigh and handle that allegation?
Read the worked answer
Treat it as an uncorroborated allegation from a source with a clear motive, and handle it with corresponding caution.
Weighing factors:
- Motive to fabricate: he is on a PIP Dana initiated, giving him a reason to damage her credibility.
- Specificity: does he provide dates, amounts, methods, or witnesses? Vague claims carry little weight; checkable specifics can be tested.
- Consistency: does his account stay stable across interviews, or shift when pressed?
- Corroboration: a cash split would likely leave traces - bank deposits, unusual spending, a second person's account.
Handling:
- Do not repeat the allegation to other witnesses; it can poison their recollections and expose the company to defamation risk.
- Interview him once more, focused on verifiable detail, and document verbatim.
- Independently test the claim - e.g., whether the two named team leads had any financial pattern consistent with a split - without tipping them off.
- Keep the allegation in the file as unsubstantiated pending corroboration; it should not drive the disposition of the overtime question.
- If corroborated, it escalates to a separate fraud matter with its own scope and possibly law enforcement referral.