internal theft investigation