When the System Is the Problem
The sixth category, which is not time theft at all, and which is a large share of what gets counted as such.
The categories · Analysis
A substantial part of every "time theft" report is a record of the employer's own system failing, presented as a record of what people did.
What ends up in the column
A refused clock-in, so the punch happens later and looks like lateness.
A forgotten clock-out, producing an impossible shift length that someone then estimates.
A terminal queue at shift change, with the minutes landing on whoever was at the back.
An app that lost location, or a phone with a flat battery.
A break deducted automatically that was not taken.
Rounding that pushed the figure one way.
None of these is a decision by a worker, and all of them appear in the same report as the ones that are.
Why it matters beyond fairness
A disciplinary process built on this data collapses the moment the person says the terminal was not working, and they are frequently right.
It teaches people the system is arbitrary, which produces the workarounds that genuinely do cost minutes.
And it hides the real signal. If a third of the anomalies are system failures, the pattern that would have identified an actual problem is buried.
Separating them
Log failures, not only successes. A refused punch with a timestamp is what distinguishes a system failure from a late arrival, and most systems store neither.
Record the cause where the system knows it: no fix, no signal, terminal offline.
Look at the site before the person. A site with a high anomaly rate has a system problem; a person with many anomalies usually works at that site.
Check the queue at shift change with a stopwatch, once, which explains a great deal.
The measure worth watching
Anomalies per site, per week, with their causes.
A site far above the others is a fault, not a culture.
A rise across all sites follows a system change, an app update or a rota change, far more often than a change in people.
The rule
Before any anomaly becomes a conversation, check whether the system could have caused it.
Four checks: the site's anomaly rate, the terminal's uptime, the queue at that time, and whether the person's pattern changed or the site's did.
Most anomalies resolve at one of those four, and the conversation is then about a broken reader rather than about somebody's honesty.
Log the failure
The single most useful configuration choice in this subject.
Most systems store successful punches and discard refusals.
Which means a person saying the terminal would not accept them cannot be confirmed or contradicted.
Store each failure with its time, site and cause.
Ask for it at procurement, where it costs nothing, rather than discovering the gap during a disciplinary meeting.
Turn the boundary into a test
For a concrete product reference, more information here can help turn this boundary into a test. Verify the current behaviour with representative fields and record what reaches the destination.
Independent reference
For a thematic point of reference, see the National Institute of Standards and Technology. Consult the source directly because technical, operational and legal details change.