Warehouse Team: P300 Breaks Deadlock After Failed Audit
£31,500 missing from a food distribution warehouse over nine months. Three separate internal audits. An external accountant. Rounds of HR interviews. No result. The entire team of eight with cash handling access remained under suspicion. P300 EEG was instructed — tested all eight in a single day — and broke the deadlock that nine months of conventional investigation could not.
Important Use & Limitations Notice
Anonymisation: All names, company details, and identifying information have been anonymised or adapted for this published case study.
Evidential use: P300 EEG results in this case were used as supporting evidence in internal HR disciplinary proceedings and subsequent employment tribunal proceedings. Not presented as standalone determinative evidence.
Purpose: For educational and investigative planning purposes only. Not legal advice.
Case Background
A North West England food distribution company operated a goods-in desk where a small number of independent local suppliers paid for orders in cash on delivery — an arrangement that predated the company's shift to electronic payments and had not yet been fully migrated. Cash receipts at the goods-in desk were logged manually and reconciled against daily summaries by the finance team.
From July 2024 onwards, the finance manager began noticing recurring discrepancies between the cash logged at the desk and the cash received by the finance office at end of day. The discrepancies were small individually — ranging from £40 to £380 per occurrence — but consistent, and by March 2025 they had accumulated to £31,500 across 47 separate incidents.
Eight members of the warehouse and goods-in team had access to the cash receipt process during the loss period. The company's management were clear from the outset that all eight were valued employees and that they were not prepared to act on suspicion alone. Three audits and nine months later, they had exhausted every conventional investigative option available to them.
Why Three Audits Failed to Break the Deadlock
Each audit made progress. None reached the threshold required for action. Understanding why illuminates exactly what P300 EEG addresses that audit cannot.
Audit 1 — Internal finance review (August 2024)
Confirmed the discrepancy pattern was real and not attributable to counting errors or process failures. Established that the losses occurred on shifts where goods-in cash was processed. Could not identify which specific transactions were manipulated because the manual log did not record who handled each receipt — only who was on shift.
Inconclusive — process gap identified, perpetrator unidentifiedAudit 2 — Enhanced shift reconciliation (October 2024)
A tighter reconciliation process was introduced, with individual sign-off required on each cash receipt. The discrepancies reduced significantly but did not stop. The new process identified that losses were occurring on shifts involving specific team combinations — narrowing the pool from eight to five — but could not isolate an individual without creating multiple simultaneous suspects.
Partial — pool narrowed to 5, still no individual identificationAudit 3 — External accountant review (January 2025)
An external forensic accountant reviewed the full nine months of cash records, shift data, and reconciliation logs. The report confirmed the loss pattern with high statistical confidence and identified the shift combinations in which losses had occurred. The accountant's conclusion was clear: the fraud was deliberate and systematic, and involved at least one individual with detailed knowledge of the reconciliation process. The report could not name a suspect.
Confirmed fraud — perpetrator still unidentifiedWhy audit reached its structural limit
What audit can do
- Identify that a financial discrepancy exists
- Establish the scale and pattern of losses
- Narrow the suspect pool by access and timing
- Confirm that fraud was deliberate rather than accidental
- Document the process failures that enabled it
What P300 EEG adds
- Tests whether each individual holds specific knowledge of the fraud's mechanics
- Distinguishes guilty from innocent within the narrowed suspect pool
- Documents exoneration for cleared staff with neurological evidence
- Identifies collaborative involvement when two people worked together
- Produces a result audit structurally cannot — individual identification
Investigation Design
Eight subjects in a single day required two examiners working in parallel across morning and afternoon sessions. All eight were brought to the site in individual appointment slots, with each subject isolated from others before, during, and after their session until all results had been delivered.
Probe design — what only the thief would know
The probe stimuli were built around four categories specific to the cash handling fraud:
- Reconciliation manipulation mechanics: The specific method used to abstract cash from the daily reconciliation without triggering the discrepancy at point of sign-off — a method reconstructed from the audit data but unknown to the general team.
- Transaction-specific knowledge: Details of specific high-value cash transactions that had been targeted — the supplier names, the approximate amounts, and the timing within the reconciliation window.
- Accumulation knowledge: The approximate total abstracted over the full nine-month period — a figure known only to the finance manager, the external accountant, and the investigation team. Not shared with any of the eight suspects at any point during the investigation.
- Coordination details: Specific operational details about how the fraud was managed across shifts — information that would only be held in the memory of someone actively involved in its execution.
Morning session block — Subjects A, B, C, D (Examiner 1)
Four subjects tested sequentially across the morning. Each 90-minute session included pre-test briefing, baseline calibration, and four probe sets. Verbal results held until end of day to prevent any information reaching afternoon subjects.
Afternoon session block — Subjects E, F, G, H (Examiner 2)
Four subjects tested sequentially across the afternoon in a separate area of the building. Same probe design, independently randomised stimulus sequences. No cross-contamination of results between examiners during the day.
End-of-day debrief — all eight results delivered
Both examiners delivered results jointly to the finance director and HR manager at close of the afternoon session. Results for all eight subjects presented simultaneously, preventing any interim action before the full picture was available.
Written reports — delivered next morning
Full written reports for all eight subjects delivered the following morning. Each report included raw EEG waveform data, probability scores for each probe set, and the examiner's documented conclusions.
Results
Two deception-indicated results — collaborative fraud confirmed
Subjects C and G both returned deception-indicated results across multiple probe sets. The pattern of their respective recognition responses was consistent with both individuals having direct knowledge of the fraud's mechanics — not merely awareness that it was occurring, but operational knowledge of how it was executed.
Subject C (senior goods-in operative) returned the stronger set of results — probability scores of 93%, 96%, 91%, and 94% across the four probe sets — consistent with having designed and primarily executed the fraud. Subject G returned deception-indicated results on three of four probe sets (87%, 92%, 88%) — consistent with involvement as a secondary participant who had facilitated specific transactions.
The shift data from Audit 2 was subsequently reviewed against this finding. Of the 47 incidents, 39 had occurred on shifts where both C and G were present — a pattern that had been visible in the data but had not been weighted as significant because neither had been individually identified as a primary suspect.
The six clear results — documented exoneration for six employees
Six of the eight subjects — including the shift supervisor who had been under the heaviest informal suspicion within the team — produced clear results across all probe sets. Each received a written P300 EEG report confirming no deception indicated. The finance director communicated the outcomes to all six cleared staff on the morning after the investigation, before any disciplinary proceedings against Subjects C and G were initiated.
Key Investigation Findings
- Two subjects returned deception-indicated results — confirming the collaborative nature of the fraud that the shift pattern data had suggested but could not establish.
- Subject C's strongest recognition responses were on the reconciliation manipulation probe (96%) and the accumulation total probe (94%) — consistent with having personally designed and managed the fraud mechanism.
- Subject G's recognition responses were strongest on the transaction-specific probe (92%) — consistent with the facilitation role identified by the subsequent shift data review.
- Six subjects — including the nine-year shift supervisor and two operatives who had been specifically flagged during HR interviews — produced clear results across all probe sets, providing documented exoneration for each.
- The investigation broke a nine-month deadlock in a single working day — before any further management time, legal cost, or workforce damage was incurred from a continued unresolved investigation.
- The shift data pattern identifying Subjects C and G as co-present on 39 of 47 loss incidents had been visible in the audit data throughout. It had not previously been acted on because neither had been individually identified. The P300 result provided the individual identification that gave the shift data its evidential meaning.
Investigation Outcome
Disciplinary proceedings — Subjects C and G
Both subjects were invited to formal disciplinary hearings. Subject C was provided with the full EEG report as part of the evidence pack alongside the audit findings, the external accountant's report, and the shift co-presence data. He was dismissed for gross misconduct — theft. Subject G was also dismissed following a separate hearing in which the same evidential package was presented.
Employment tribunal
Subject C submitted an employment tribunal claim for wrongful dismissal. At the preliminary hearing, the tribunal considered the evidential package — three audits, an external accountant's report, P300 EEG results from two examiners across eight subjects, and the subsequently analysed shift co-presence data. The claim was dismissed at the preliminary stage. Subject G did not submit a tribunal claim.
Civil recovery
The company initiated civil recovery proceedings against both subjects jointly for £31,500. A partial recovery was agreed in settlement before any hearing, with Subject C accepting primary liability and Subject G secondary liability reflecting their respective levels of involvement as identified by the investigation.
Investigation Economics
What This Case Demonstrates
Audit and P300 EEG answer different questions
This case makes the distinction unusually clear because three separate audits reached their structural limit before P300 EEG was instructed. The audits answered "how much was taken, over what period, and on which shifts?" P300 EEG answered "which individuals hold the knowledge of how it was done?" These are different questions. Audit cannot answer the second question. P300 EEG cannot answer the first. Used together they produce a complete evidential picture that neither can produce alone.
Collaborative fraud produces two independent deception results
The collaborative nature of the fraud was not known before testing. It was discovered through the P300 EEG results and then confirmed by reanalysing the shift data in light of those results. P300 EEG does not test whether two people worked together — it tests whether each individual holds specific knowledge of the fraud's mechanics. Two independent deception-indicated results from the same probe set, assessed against separate baselines by separate examiners, produced the finding that the investigation needed.
Eight subjects in a day ends deadlock faster than any alternative
The nine-month investigation had consumed management time, external accountant fees, HR resource, and — most damagingly — the morale and professional standing of six people who were entirely innocent but had been under diffuse suspicion for the better part of a year. A P300 EEG investigation commissioned when the suspect pool was identified at eight people would have resolved every question the company had in a single working day.
Has Your Audit Reached Its Limit?
When investigation confirms fraud but cannot identify who committed it, P300 EEG breaks the deadlock. Up to eight subjects tested in a single day. Initial consultation is free.