Let us be straight about what a system can and cannot do. It cannot stop somebody who intends to steal. What it can do is make every route from “money was owed” to “money is no longer owed” pass through a named account and leave a record, so that the routes people actually use become visible, awkward, or both.
Almost all till skimming in restaurants runs through the same three doors: void an item after the guest has paid cash, change a price down and pocket the difference, or process a refund against a bill that was never refunded. Close those and you have closed most of it.
Start with one account per person
Shared logins make everything after this pointless. If four servers use the same account, the log tells you an action happened and nothing about who did it, and no amount of reporting recovers that. One person, one account, no exceptions — including for family.
Then raise the dangerous actions
Anything that reduces the amount on the bill should sit above server level:
- Void or cancel a whole bill
- Cancel an item after it has gone to the kitchen
- Manual price change
- Manual discount
- Refund after settlement
A server can still round the last few coins if you allow it — a capped round-down amount lets small change be handled without opening the door to arbitrary edits. The cap is the point: it is a small permission, not a general one.
Two different questions, two different tools
Permissions decide what someone is allowed to do. The system log records what actually happened — who edited or voided which document and when. You need both and they answer different questions. When the day is short, permissions tell you which routes existed and the log tells you which one was taken.
Add to that the reports that make patterns show up: sales by cashier, sales by terminal, and void or discount counts by person. One server with four times everyone else’s void rate is a conversation, not proof — but you will not have the conversation if nobody is looking. Reconciling by person tells you who is short; reconciling by terminal tells you which counter or which piece of hardware is the problem.
Where discipline beats configuration
Two habits close more holes than any setting.
Cash up by shift, not by day. A shortfall found at handover belongs to a two-person window. Found on Monday for the whole weekend, it belongs to nobody. See end-of-day cash-up.
Disable leavers the same day. An account that still works after somebody stops working for you is the one gap that no permission model covers. If you are not on site, you can disable an account remotely — see watching the shop from another country.
