Your monthly count comes up short again. By the time the number lands on your desk, the shift that caused it happened weeks ago, and nobody remembers who was on register during a slow Tuesday afternoon. The trail is cold. But it wasn't always. You catch dispensary theft, especially employee theft, by knowing where to look in the POS data before a physical count ever comes up short – because the transaction that created the gap left a signature the same day it happened.
In this article, we’re covering the five transaction patterns worth watching, how to set alert thresholds off your store's own history instead of an industry rule of thumb, why reconciling the POS against a state seed-to-sale system catches things a standard sales report never will, what exception-based reporting means in a cannabis context, and where paired video fits once a transaction gets flagged. We’re also covering what none of this catches, since a POS only sees what touches the register. For the operational and cultural side of the dispensary theft problem, see our cannabis loss prevention strategy guide.
Key Takeaways
- Employee theft appears in POS transaction data before it appears in an inventory count, which is why reviewing transactions helps catch losses earlier than waiting on a monthly count.
- Five transaction patterns account for most internal loss: voids, unreferenced refunds, manual discounts, off-hours activity, and unscheduled inventory adjustments.
- Thresholds should come from a dispensary's own 30-day baseline, not an industry average – because a normal void rate in one store is a red flag in another.
- Exception-based reporting filters transactions against threshold rules, which turns a review from hours of footage into a short, targeted list.
How Do You Catch Dispensary Employee Theft With a POS System?
A cannabis POS system ties every void, refund, discount, and inventory adjustment to a specific employee login and a timestamp. Filtering that record against threshold rules narrows a full shift of activity down to the handful of transactions worth a second look; paired video then confirms or clears each one.
Cash loss and product diversion behave differently in the data. Cash loss shows up in drawer counts and voided or refunded transactions, while diversion appears in the gap between what the POS recorded as sold and what actually left the shelf. Most operators watch one closely and miss the other. A variance is also a reportable event in cannabis retail, not just a margin problem, and an unexplained adjustment can trigger its own compliance obligation separate from whatever caused it.
None of this works without a cannabis POS system built to capture that level of detail. A generic retail POS logs a sale; a cannabis POS logs who rang it, when, under what override, and how it reconciled against state tracking.
What Are the Five POS Red Flags That Indicate Cannabis Dispensary Theft?
There are five transaction types that can signal dispensary employee theft, and each one has a legitimate explanation as well as a suspicious one. The difference is frequency and concentration: one employee, one pattern, repeating well past what the rest of the store does.
Two of these are worth expanding upon.
- Unreferenced refunds are routine in general retail, which is exactly why they hide so well there. Cannabis operates under a different rule. California, for example, prohibits returning cannabis product to a retailer once it has left the premises, and several other states enforce similar restrictions. Where that kind of rule applies, legitimate refund volume should already be low, making a dispensary refund a stronger signal than a refund almost anywhere else in retail. The exact restriction varies by state, so confirm the rule in your own jurisdiction before treating refund volume as a red flag.
- Manual discounts point to sweethearting: an employee giving away product or unauthorized discounts to friends, family, or favored customers. The tell isn't the discount itself, since legitimate price matches and damaged-product adjustments happen every week. It's concentration – the same employee and the same customer showing up together, over and over. Cannabis raises the stakes here because every unit carries a package tag, so giving product away doesn't just cost margin. It opens a traceability gap a regulator will eventually ask about.
How Do You Set Thresholds Without Flagging Normal Activity?
Thresholds should come from your store's own baseline, not some published industry figure. Product mix, store format, and staffing levels all move a dispensary's baseline enough that an industry-wide number will either miss real activity or flag routine work as suspicious.
Setting your thresholds can be done in four steps:
- Pull 30 days of void, refund, and discount activity broken out by employee.
- Find the median rate and the normal spread across the team.
- Set the alert threshold above that band, not at an arbitrary round number.
- Re-baseline monthly so seasonal shifts and staffing changes don't quietly widen the range.
A quick illustration: a store with a median void rate of 3% and one budtender running closer to 11% is a pattern worth a look, not because 11% is inherently damning, but because it sits well outside what the rest of the team is doing under the same conditions. Concentration beats volume here. One employee running three times the store median is a stronger signal than a modest, store-wide rise that more likely points to something operational.
Cova's POS reporting and analytics tools give operators the transaction-level detail this method depends on, broken out by employee and shift rather than buried in a single daily total.
How Do You Reconcile Dispensary POS Data Against Your Seed-to-Sale System?
Every sale writes to two places at once: the POS, which records what was sold, and the state's traceability system, which records what the state believes was sold. The gap between those two records is a detection surface that only exists in regulated retail, and it's one no general-retail exception report can produce.
Three anomalies are worth watching for specifically: a sale with no corresponding entry in the traceability system, a package tag adjusted without a matching sale, and a manual adjustment entered to make the two systems agree rather than to explain why they didn't. That last one is particularly important; an adjustment made to close a gap is often the signal itself, not the resolution of one.
Before treating any of this as evidence of diversion, rule out a sync failure first. A connectivity issue between the POS and the traceability platform can produce the exact same symptom as missing product, and starting an investigation into a person before ruling out the integration wastes time and, worse, damages trust with a staff member who did nothing wrong.
Cova syncs with state traceability systems including Metrc and BioTrack, giving operators a way to check dispensary POS records against Metrc reporting rather than treating the two as separate systems that happen to track the same inventory.
What Is Exception-Based Reporting in a Dispensary?
Exception-based reporting filters out routine transactions and returns only the ones that breach a defined rule, so a manager reviews a short list of flagged events instead of a full day of sales.
In a cannabis dispensary, a flagged exception is rarely only a margin question. An unexplained adjustment is a reportable event in most states, and the exception report doubles as the documented review trail a regulator will ask for during an audit. Setting one up means deciding which transaction types generate an alert, setting the threshold from a store's own baseline, and naming an owner for the daily review, so flagged transactions don't sit unreviewed in a queue nobody checks.
Most dispensaries never catch small theft for a simple reason: investigating a $40 discrepancy has historically cost more in staff time than the $40 itself, so operators wrote it off. Exception-based reporting changes that arithmetic by cutting the review down to transactions that actually warrant the time.
For more on cash management best practices, take a look at our dispensary SOP templates.
What Does Pairing Dispensary POS Data With Video Actually Change?
Transaction-linked video removes the manual footage scrub. Instead of pulling a timestamp and scrolling through hours of camera footage, each flagged receipt opens with its own clip attached, so confirming or clearing a transaction takes seconds rather than an afternoon.
In practice, the flagged list built through exception-based reporting becomes a review queue where every item already has its evidence attached. It's worth keeping the two roles distinct: exception rules tell a manager that a transaction was irregular, and video tells them what actually happened at the counter. One flags, and the other confirms.
Cova's Solink integration automatically pairs each POS receipt with its associated security video. Managers can search by product SKU, employee name, or transaction type to find a specific clip, and Solink prioritizes high-risk transaction types, including returns, discounts, and promotions, so those clips sit at the top of the queue.
What Can You Not Catch With a POS?
A POS only sees activity that touches the register, which means some of the most damaging loss never shows up in a transaction report at all. These instances include:
- Product taken from the vault before it's received into inventory. It never existed in the system, so there's no transaction to flag.
- Cash intercepted before it reaches the drawer, which leaves no register record to review.
- Collusion at the counter, where the transaction itself is entered correctly and looks clean end to end.
This is where video does a second job. Motion alerts on predefined areas, like a vault or a back entrance, cover the vault-side events a POS is structurally blind to, since there was never a transaction for it to record. For more on camera placement, coverage, and how many angles each dispensary area needs, check out our dispensary security systems guide.
FAQ
What should you do first if you spot a discrepancy?
Preserve the transaction record and the associated video clip before anything else touches the system. Confirm what happened against the video before drawing a conclusion, document what you find, and log the adjustment with a reason code before confronting anyone. A flagged transaction is a lead, not proof.
Can you run exception-based reporting without integrated video?
Yes. The reporting layer works on transaction data alone and still produces a flagged list worth reviewing. What changes without video is resolution speed: confirming a flagged transaction means manually locating the timestamp and scrubbing footage by hand instead of opening an attached clip. Many operators start with reporting and add video pairing later.
Do you have to report an inventory discrepancy to your state regulator?
In most jurisdictions, yes, though the exact threshold and reporting window vary by state. For instance, as of 2026, California's Department of Cannabis Control requires licensees to notify the department and local law enforcement within 24 hours of discovering a significant inventory discrepancy, which is defined as a 5% difference between physical inventory and what’s in the state’s traceability system.
Integrating Video into Your Dispensary
The whole process comes down to four steps: know your store’s normal activity, filter transactions against thresholds, review what gets flagged, and confirm on video before drawing a conclusion. Pull 30 days of void and refund data by employee this week and find your store's own normal band before you decide what counts as suspicious.
Cova's POS captures the transaction-level detail this process depends on, and our Solink integration pairs each flagged transaction with the video that confirms it. To see how the two can work together in your dispensary, book a demo today.