Documenting a loss prevention case with verifiable evidence

Opening a case does not declare a loss

Separate facts, hypotheses and conclusions. A refund without a linked sale may warrant investigation, but an incomplete extraction can produce the same signal. Record what is known and what is missing before assigning a cause.

Group signals about the same operation into an identifiable case. Preserve their source rules without counting one event’s amount multiple times. A new alert can add evidence to an existing case instead of creating another loss.

Reconstruct the operation sequence

Link the sale and its lines, payment method and relevant later events: void, refund, inventory movement or settlement. Keep source identifiers, source versions, event time and receipt time. Late-arriving data does not change when an operation occurred.

Evidence should be retrievable through a protected reference. A screenshot may assist review but does not replace the records needed to verify amounts and relationships. If a file changes, preserve the version supporting the previous decision.

Reconstruct a refund before closing the case

Illustrative example: a COP 180,000 refund appears in the POS, but the original receipt cannot be found in the received file. Record this absence and the period covered by the file. Failure to find a sale in a partial extract does not establish that the sale never existed.

Collect the receipt, modification, business authorization, merchandise receipt where applicable and payment outcome separately. Each item needs its source, reference and event time. The date someone attached a file to the case cannot replace the operation date.

Form hypotheses that can be ruled out: a sale outside the period, a corrected reference, an authorized refund or an unsupported modification. Record which check would resolve each hypothesis. The person being investigated must not become a system-generated conclusion: the case describes operations and evidence, while responsibility requires the appropriate review process.

If the original receipt arrives, retain the previous case version and explain how the conclusion changes. If evidence remains missing, record pending information with an owner and next action. A complete case allows another reviewer to reach the same conclusion without relying on an unrecorded conversation.

Define decision authority

Assign an owner, review date and next action. Distinguish requesting evidence, fixing an integration, approving an exception and recording an adjustment. Detecting a difference should not automatically authorize changing it without review.

Use explicit states: awaiting review, awaiting evidence, investigating, closed and reopened. Reopening preserves the previous decision and identifies the new evidence challenging it. Do not overwrite a conclusion as if it never existed.

Close with a supported outcome

Useful outcomes distinguish valid operations, data errors, technical duplicates, confirmed losses and insufficient evidence. Insufficient evidence does not establish that an operation was correct; it records the investigation’s limit and supports follow-up.

Document recovery with a reference, amount, currency and date. If a refund and chargeback affect the same sale, verify their effects before adding exposure or recovery. Case status and money status should remain separately readable.

Protect evidence and test the case record

Grant role-based access and retain controlled references instead of multiplying copies of personal or payment data. Apply the organization’s retention and access policies to each source; one universal retention period does not fit every case.

Before closure, ask a second reviewer to reconstruct the operation, applied rule, missing evidence and decision without relying on an oral explanation. If that is impossible, the case still needs documentation.

• Link original documents
• Test hypotheses
• Close with reviewable evidence