Why a Single Shortage Never Tells You Anything
Every store manager who has run a register knows the feeling of a drawer that's a few dollars off at close. Most of the time it's exactly what it looks like — a miscounted bill, a mistaken change calculation, a rushed transaction during a lunch rush. On its own, a small variance is noise, not evidence, and treating every minor shortage as an accusation poisons trust with cashiers who are simply human and occasionally make mistakes.
The problem is that deliberate till skimming is deliberately designed to look exactly like that same noise. A cashier skimming a few dollars per shift, spread across weeks, produces a series of individually unremarkable variances — each one small enough to dismiss, none of them alone worth investigating. The only way to tell the difference between honest error and a pattern of skimming is to actually track every variance, by cashier, by shift, over time — which requires a consistent procedure, not a manager's memory of "that drawer's been a little off lately."
That's what this guide is built around. Not a single audit, but a repeatable daily protocol — opening counts, closing counts, over/short logging, and a clear escalation threshold — that turns a string of small numbers into a visible pattern the moment one actually exists.
What Causes Cash Over/Short: Three Sources, One Number
A cash over/short variance is simply the difference between what a register should contain — based on the starting bank plus recorded sales — and what it actually contains at count. But that single number can come from three very different sources, and a good cash handling procedure needs to distinguish between them rather than treating every variance identically.
A negative result is a shortage. A positive result is an overage. Both get logged — overages can also signal a change-making error worth correcting.
"One short drawer is a Tuesday. The same cashier's drawer being short every Tuesday for six weeks is a pattern — but only if somebody's actually logging the numbers to see it."
— Mithun GS, PreventLoss.orgThe Daily Register Balance Protocol: 6 Steps
This is the exact sequence a store should run every single shift, on every register, without exception. Skipping a step for a "trusted" cashier or a slow day is precisely how procedural gaps open up.
Before a cashier begins transactions, a manager or the outgoing shift verifies the starting bank amount together with the incoming cashier — counting it in front of both parties and having the incoming cashier sign or log acknowledgment of the confirmed total. This is the baseline every later calculation depends on; an unverified opening bank makes every subsequent variance impossible to attribute accurately.
On busy mornings, verifying the opening bank feels like a delay before the doors open. It takes under two minutes and is the single most common step to get rushed — which is exactly why it needs to be a hard requirement, not a judgment call.
Set a dollar threshold — commonly $150–$300 depending on register volume — above which a cashier performs a cash drop into a locked drop safe, logged with the amount, time, and cashier ID. This limits how much cash sits exposed in any single drawer at once and creates a mid-shift checkpoint independent of the closing count.
Two-person verification matters here: where staffing allows, having a second employee witness and countersign the drop significantly reduces both the opportunity for skimming during the drop itself and any later dispute about the logged amount.
On registers handling significant cash volume, an unannounced mid-shift count — where a manager briefly reconciles the drawer against expected totals without prior notice to the cashier — adds a checkpoint that a scheduled-only protocol doesn't provide. Predictable counts can be worked around; unpredictable ones can't.
At close, the cashier counts the drawer and records the total before the POS system's expected total is revealed to them — a "blind" count. This prevents a cashier from adjusting their counted total to intentionally match (and mask a shortfall in) the expected number, which is a common way an existing skim gets concealed at the count itself.
2. Manager reveals POS-expected total
3. Variance calculated and logged — cashier does not recount after seeing the expected figure
Record the exact over/short amount for every single shift, tied to the specific cashier and register, in a running log — a spreadsheet, POS reporting module, or dedicated cash management tool. The value of this step comes entirely from consistency: a log that only captures "notable" variances can't reveal a pattern, because the pattern is built from small numbers that individually look unremarkable.
Set two review cadences: an immediate manager review for any single-shift variance beyond a set dollar threshold (commonly $5–$20 depending on register volume), and a weekly or biweekly review of the full variance log looking for cashiers or shifts with a recurring one-directional pattern, even if no single variance ever crossed the immediate-review threshold.
A cashier who is consistently $4 short every shift never triggers a $15 threshold alert on any single day — but over two weeks, that's a clear, trackable pattern that only shows up when someone actually looks at the trend line, not just the daily flags.
Till Audit Tools That Reinforce the Protocol
The six-step protocol above works with a pen-and-paper log, but three tools meaningfully reduce both the effort required and the chance of a step being skipped under pressure.
None of these tools work if the underlying counts aren't happening consistently. A locked drop safe with logged access is only useful if drops are actually made at the set threshold every shift — the technology supports the protocol, it doesn't substitute for it.
5 Mistakes Retailers Make With Cash Handling Procedures
Most cash handling failures aren't a missing policy — they're a policy that exists on paper but isn't consistently enforced at register level.
Control Framework: Matching the Right Check to Each Cause
Different sources of cash variance call for different controls. This table maps each of the three causes to the protocol step and tool most effective against it.
| Cause | Primary Control | Detection Method |
|---|---|---|
| Honest Error | Cashier training; blind recount practice | Random-direction, low-frequency variance in the log |
| Procedural Gaps | Opening bank verification; scheduled cash drops | Variance that can't be attributed to a specific shift |
| Deliberate Skimming | Weekly variance trend review; dual-count verification | Repeated, one-directional variance tied to one cashier |
For the broader internal-theft picture cash handling sits inside, see our guide to employee theft prevention. For how to structure the audit process itself, see our loss prevention audit guide and what is internal audit explainer. If you're formalizing store-wide procedures, our loss prevention policy template is a useful starting structure.
Your Next Step: Standardize the Protocol This Week
Cash handling procedures don't need to be complicated to work — they need to be consistent. The six steps above are simple enough to run every shift without slowing down operations meaningfully, and the entire value of the system comes from doing them every time, not just when a drawer already looks suspicious.
The stores that catch till skimming early aren't the ones with the most sophisticated tools — they're the ones where every count, every drop, and every variance gets logged the same way, every single day, so the pattern has nowhere to hide.
- ✓Verify and log the opening bank together with each incoming cashier
- ✓Set a cash drop threshold and enforce it with logged, witnessed drops
- ✓Add unannounced mid-shift spot counts on high-volume registers
- ✓Switch closing counts to a blind-count sequence if not already in place
- ✓Log every shift's over/short variance, by cashier, without exception
- ✓Set both an immediate-review threshold and a recurring weekly trend review
If you're starting from nothing: implement the blind closing count and the variance log first. Both require no new hardware, take only minutes to add to your existing close-out process, and together they build the exact data trail that makes every other control in this guide possible.
Explore More Loss Prevention Guides
Free, practical frameworks for US retailers — audits, policy templates, employee theft prevention, and more. No sign-up needed.
Browse All Articles →