Voids, comps and missing cash: internal controls for restaurants

Every restaurant voids items. A guest changes their mind, a server taps the wrong dish, a steak goes back to the kitchen. Most voids, comps and small cash differences are honest mistakes made on a busy night. Good routines keep the record clear, and a clear record protects your staff as much as it protects the business. When the drawer is short, nobody on the team has to wonder whether they will get the blame.

This guide is as of October 2026.

The words in this guide

What the research shows about losses

The Association of Certified Fraud Examiners (ACFE) publishes a large study every two years. The 2024 edition covers 1,921 cases from 138 countries.¹ The median loss per case was USD 145,000. The examiners who took part estimate that organisations lose 5 % of revenue to fraud each year. That figure is their estimate, not a measurement. A typical case lasted 12 months before someone found it.¹

Keep two limits in mind. The cases come from fraud examiners who investigated them, so they are not a random sample of businesses. Food service and hospitality had only 35 cases, with a median loss of USD 100,000.¹ The numbers show what happens when something goes wrong. They do not show how often it goes wrong at a typical restaurant.

The study does show a clear difference by size. Cash schemes are more common at organisations with fewer than 100 employees than at larger ones.¹ Skimming means that a sale is never entered. Cash larceny means that cash is taken after the sale is entered. Register disbursements are false voids and refunds.

Share of fraud cases by scheme and organisation size, 2024

• Fewer than 100 employees
• 100 or more employees

Show the data

Scheme	Fewer than 100 employees	100 or more employees
Skimming (sale never entered)	19 %	9 %
Cash larceny (cash taken after the sale)	17 %	9 %
Theft of cash on hand	16 %	10 %
False voids and refunds	5 %	3 %

Monitoring changed behaviour, not the team

The most useful study for restaurants is by Lamar Pierce, Daniel Snow and Andrew McAfee. They followed 392 restaurant locations from five US companies that started to use software that reads POS data to detect theft.² After the software went in, theft fell by 22 %. Revenue per restaurant rose by an average of USD 2,982 per week, about 7 %.³

The researchers found that the effect came mainly from changes in how the same people worked, not from people leaving.² Staff earned more in legitimate tips too.² Pierce described it as “not more surveillance”, but “better and less intrusive monitoring”, because the system reads the sales data instead of watching people on camera.³

For a small restaurant, the lesson is that clear rules and a record that someone reads help good people do good work. They do not need to be strict or suspicious.

How problems usually come to light

Most problems come to light because someone tells the owner. In the ACFE study, 43 % of cases started with a tip. Internal audit found 14 % and management review found 13 %. Automated monitoring found only 3 %.¹

How fraud was first found, 2024

Show the data

Method	Share of cases
Tip	43 %
Internal audit	14 %
Management review	13 %
Document examination	6 %
Account reconciliation	5 %
By accident	5 %
External audit	3 %
Automated monitoring	3 %

Employees gave 52 % of the tips and customers gave 21 %.¹ In a restaurant, this means that your team is your best control. Staff who notice something odd need a calm and private way to say so, and they need to know that you will listen without drama.

Surprise checks also help. Where organisations used surprise audits, the median loss was USD 75,000 and the median case lasted 9 months. Without them, the median loss was USD 200,000 and the median case lasted 18 months.¹ Only 17 % of the small organisations in the study used surprise audits, against 49 % of the larger ones. For management review, the figures were 39 % and 79 %.¹

Controls that fit a small team

These routines cost little and work in a team of five or fifty. They are the same for everyone, so nobody is singled out.

1. One sign-in for each person. Each member of staff signs in to the POS with their own code. A shared code makes the record useless, and it puts honest people under the same doubt as everyone else.
2. A reason for every void. Keep a short list, such as “guest changed order”, “wrong item entered” and “quality problem”. A void before the kitchen starts on the dish is routine. A void after the dish is made deserves a second look.
3. A manager approves the bigger actions. Decide which actions need a manager: for example a refund, a void after the kitchen has the order, or a comp above an amount that you set.
4. Comps go in as discounts. Enter a comp as a 100 % discount with a reason, not as a void. Then the item still counts in your sales mix and your food cost, and the report shows how much you gave away. Skatturinn says that goods given to staff are recorded when they are handed over. Meals that the owner and managers take go in a separate sub-ledger.⁵
5. Count the drawer at each handover. When the shift changes, the outgoing and the incoming person count the drawer together. Where you can, give each person their own drawer or their own cash bag.
6. Two people at the close. One person counts and a second person checks the count and signs. Rotate who does what.
7. A surprise count now and then. Count a drawer in the middle of a shift, on different days and for different people. Tell the team that this is a normal routine.
8. Read the daily report every day. Look at voids, refunds, discounts and no-sale opens, and compare them with a normal day. Look for patterns over weeks, not single events.
9. Tell staff what the POS records. Explain which actions carry their name and why. People work more calmly when they know the rules.

Reading the numbers fairly

Numbers start a conversation. They do not prove anything on their own. A run of voids on one shift often has a plain cause: a new server, a busy menu button next to the wrong dish, or a kitchen that ran out of an item. A cash difference often comes from wrong change, a card payment entered as cash, or a tip paid out from the drawer.

Talk to the person first, in private, and ask what happened. Write the explanation on the day’s settlement sheet. Skatturinn requires an explanation for every difference anyway.⁵ If the same pattern comes back after you have fixed the obvious causes, that is the time to look more closely and to get advice.

What Icelandic law already expects

The Bookkeeping Act no. 145/1994 asks every business that keeps books for “normal internal control” (eðlilegt innra eftirlit). Article 7 describes this as working procedures with clear responsibilities and a division of duties. The aim is reliable books, safe handling of money, and no loss from errors, mistakes or misuse.⁴

Skatturinn adds concrete rules for sales recorded on a POS.⁵

• The daily sales report shows how many times the cash drawer opened without a sale during the day or the shift.
• The settlement sheet shows any difference between the recorded sales and the counted cash, with an explanation.
• A manager or another responsible employee signs the documents for each day or shift.

The guide What a POS must do under Icelandic rules covers the daily report, the rule that recorded entries cannot change, and the seven-year retention period. The Bookkeeping Act sets that period in article 20.⁴ For the evening routine itself, see Closing the day.

In Resto, staff pick a reason from your list when they void an item. The day’s report shows voids, refunds, discounts, write-offs and no-sale opens, and each order keeps a history of who did what. The traceability page shows how it looks.

Your accountant can help you write down your procedures, which is what article 7 asks for. A one-page note that says who counts, who signs and who approves refunds is a good start.