Loss Prevention Policy Template (Free Download) + How to Write One That Actually Works

Without a written policy, whether a manager double-checks a cash count, verifies a vendor invoice against the agreement, or escalates a suspicious pattern depends entirely on that individual's habits, training, and how busy they are that day. A written policy makes these steps mandatory and auditable — not optional good practice that depends on who's working that shift.

When an employee is terminated for a policy violation, when an insurance claim is filed after a loss event, or when a vendor dispute escalates to legal action, having a signed, dated, consistently enforced policy is often the difference between a clean resolution and a drawn-out dispute. Courts and insurers look for evidence that a standard existed and was applied — not just that a loss occurred.

A written policy is the foundation every training program is built on. Without it, institutional knowledge about "how we handle cash" or "how we verify vendors" lives in individual employees' heads — and walks out the door when they leave. This is precisely how billing errors and control gaps get inherited and perpetuated across staff turnover, sometimes for years.

This opening section states the business's commitment to protecting assets, inventory, cash, employees, and customers, and defines exactly which locations, business units, employees, and third parties the policy applies to. Be specific — "all employees" reads differently than "all employees, contractors, and vendor personnel operating at any company-owned or company-leased location."

Common gap: Policies that don't explicitly cover contractors, seasonal staff, or third-party logistics partners — exactly the groups most often involved in the loss events that go undetected longest.

Define shrinkage, internal theft, external theft, and exception reporting explicitly. This isn't bureaucratic box-checking — when a manager is deciding whether to escalate an unusual transaction pattern, having a clear definition of what an "exception" is removes the judgment call that often results in nothing being reported.

• Shrinkage: the gap between recorded and actual inventory, expressed as a percentage of sales
• Internal theft: theft or fraud by an employee, contractor, or internal party
• External theft: shoplifting, burglary, organized retail crime

Every role from executive leadership down to frontline employees needs a clearly assigned loss prevention responsibility. The most damaging control gap in vendor and billing fraud cases is almost always the same: a single team manages the vendor relationship, compiles the billing data, and approves the payment — with no independent check anywhere in that chain.

The fix: explicitly separate who manages vendor relationships from who approves vendor payments. Explicitly assign finance or internal audit to independently verify billing data against signed agreements. This single structural decision prevents more loss than almost any other control in the policy.

This is the longest and most important section of the policy. It should cover, at minimum:

• Inventory control: receiving verification, cycle counts, write-off approval thresholds
• Cash handling: drawer counts, dual verification, void/refund authorization limits
• Employee theft prevention: background checks, mandatory vacation, separation of duties, anonymous reporting
• Vendor & supplier fraud prevention: invoice-to-agreement matching, new vendor approval, quarterly billing audits
• Physical & technology security: CCTV coverage, access control, POS exception monitoring

For deeper guidance on each of these areas, see our companion guides on inventory shrinkage and cost control fundamentals.

This section needs to specify, in order: evidence preservation before confrontation, who gets notified, when legal counsel must be consulted, insurance notification timelines, when to file a police report, and a required root-cause review after every confirmed loss event. The order matters — confronting an employee before preserving evidence is one of the most common and costly mistakes in internal investigations.

Define which metrics get tracked and how often: shrinkage rate, cash variance by location and employee, investigations opened/closed, vendor billing discrepancies recovered, and inventory accuracy. A policy with no metrics attached is a statement of intent, not an operating system.

Require initial training within a set period of hire (commonly 30 days), annual refresher training, and a signed acknowledgment from every employee confirming they've read and agreed to comply. Without a signed acknowledgment on file, enforcing the policy in a termination or legal dispute becomes significantly harder to defend.

Spell out that violations can result in disciplinary action up to termination, and may involve law enforcement or civil action. Critically, state explicitly that the policy applies consistently across all levels of the organization, including management and executives. A policy that's only enforced against frontline staff loses credibility — and legal defensibility — fast.

Assign a named owner and a minimum annual review cycle. Trigger off-cycle reviews after any major loss event, audit finding, or significant operational change — new locations, new systems, new vendor categories. A policy that hasn't been reviewed in three years is rarely still describing how the business actually operates.