BlogBooks
Who should see what: staff access without giving away the shop
Most shops run on one login and one password everyone knows. That is not trust, it is an absence of a record.
Ask a shop owner in Ikeja who has access to the system and you get one of two answers.
The first is "everybody, it is one login". The second is "only me", said with some pride, by a man who now has to leave a family function to approve a ₦900 refund.
Both answers are the same mistake wearing different clothes. In one, nothing is recorded against anybody. In the other, everything waits for one person. Neither gives you what you actually want, which is a shop that runs when you are not standing in it and a record that says who did what.
The two failure modes, and what each one costs
Everyone has everything. Nothing is traceable. When the count comes up 14 cartons short, no fact in the system distinguishes a receiving error from a picking error from a person. You are left with a feeling, and a feeling is a terrible basis for a conversation with someone who has worked for you for four years.
Only the owner has anything. Now you are the bottleneck, and the workarounds appear immediately: your password gets shared "just for today", the price override happens on paper, the refund comes out of the tin and gets entered later, or never. A control that is too tight does not produce discipline. It produces an unofficial second system that nobody can audit.
The fix is boring and it works: give each person their own login, give each login exactly the permissions the job needs, and require approval for the four or five actions that actually move money.
What each person actually needs
Illustrative role structure for a shop with a counter, a supervisor and an owner. Adjust the names, keep the shape.
| Permission | Counter staff | Supervisor | Manager | Owner |
|---|---|---|---|---|
| Ring up a sale, take cash or transfer | Yes | Yes | Yes | Yes |
| See selling prices | Yes | Yes | Yes | Yes |
| See cost prices and margin | No | No | Yes | Yes |
| Apply a small discount (up to a set limit) | Yes, to limit | Yes | Yes | Yes |
| Apply a discount above the limit | Approval | Yes | Yes | Yes |
| Override a price manually | Approval | Approval | Yes | Yes |
| Process a refund | Approval | Yes, to limit | Yes | Yes |
| Void or edit a completed sale | No | Approval | Yes | Yes |
| Receive a delivery into stock | Yes | Yes | Yes | Yes |
| Adjust stock (write off, damage, count correction) | No | Approval | Yes | Yes |
| Record a credit sale to a customer | Approval | Yes | Yes | Yes |
| See the full day's totals and variances | No | Yes | Yes | Yes |
| See other staff members' shift records | No | Own shift only | Yes | Yes |
| Add, remove or change users and permissions | No | No | No | Yes |
| Export the full record set | No | No | No | Yes |
Two lines in that table do more work than the rest combined.
Cost prices. A counter staff member does not need to know what you paid for anything. Hiding cost is not secrecy for its own sake; it is the single most portable piece of commercial information in your business, and it walks out of the door in a phone photograph.
User administration. Only one person should be able to create a login or change what a login can do. If a manager can grant themselves permissions, the permissions are decorative.
Set the limits as numbers, not as judgement
"Use your discretion" is not a permission. Put a figure on it.
Illustrative example for a provisions shop: counter staff may discount up to ₦500 on a sale and may not exceed ₦2,000 of discount in a shift. A supervisor may refund up to ₦5,000. Anything above either line needs the manager. Write the two numbers on a card by the till.
The numbers matter less than the fact that they exist. A staff member who knows the ceiling never has to guess and never gets told off for a decision nobody defined. And every time the ceiling is hit, you get a log entry that tells you something about your pricing or your customers.
An audit trail is not surveillance. It is the only thing standing between an honest employee and an accusation nobody can disprove.
The four actions that should always need a second pair of eyes
Not everything needs approval. These four do, because each one creates a difference between what the records say and what is physically true.
Price overrides. The gap between the shelf price and the price rung up is the easiest money to take and the hardest to see, because nothing goes missing. Stock reduces by one, cash reduces by the discount, and the day still balances.
Discounts above the limit. Same mechanism, softer name. A discount is a price override with a friendlier story attached.
Stock adjustments. Write-offs, damages and count corrections are the drain that closes itself. An adjustment makes a shortage disappear from the record without anyone having to explain it. If one person can both create a shortage and erase it, you have no stock control at all, whatever your software says. Why your stock never matches your records walks through how this compounds.
Refunds. A refund moves cash out of the tin with no customer standing there by the time you read the log. Refunds after closing time, refunds with no matching original sale, and refunds in cash against a sale paid by transfer are the three patterns worth a rule each.
For scale: the US National Retail Federation put retail shrink at 1.6% of sales in FY2022, up from 1.4%, with internal and external theft together close to two thirds of it and process and control failures a significant share of the rest. That is a US figure and there is no equivalent published Nigerian survey, so treat it as the shape of the problem rather than your number. The part worth holding onto is that a meaningful chunk was never theft at all. It was people making untracked corrections in good faith.
The audit trail protects your best staff
Here is the argument that actually persuades staff, and it is true.
Without named logins, every unexplained shortage is shared by everyone on shift. The honest staff member cannot demonstrate that the ₦6,000 gap happened on the other shift, because the system does not know there were two shifts. Suspicion spreads evenly across people who do not deserve it, and the good ones leave.
With named logins and a trail, the record answers for them. Your best person can point at three months of clean shifts, which is worth more to them than the mild indignity of logging in.
Say that out loud when you roll it out. "Everyone gets their own login so nobody carries somebody else's mistake" is a sentence people accept. "I am putting in controls" tells the whole shop you suspect them.
How to raise a discrepancy without making an accusation
The moment will come. Handle it like this.
Bring the record, not the theory. "Thursday's count is 9 cartons short and Friday is exact" is a fact. "Stock is going missing" is a theory, and theories invite denial.
Ask what was different, not who did it. The question is "what happened on Thursday?" The answers are usually real: light went and we wrote sales on paper, the delivery came during the rush and nobody counted it in, a customer returned two cartons and I put them back without entering it, the printer jammed.
Fix the process the answer reveals, in front of them. If the delivery came during the rush, deliveries now get received before 10am. That tells everyone the exercise was about the gap, not about them.
Only escalate on pattern. One shortage is noise. Shortages that are always in one direction, always on one shift, and always on lines with a high value per carton are a pattern, and a pattern is a different conversation. Shrinkage: what it costs and the six places it hides covers what those patterns look like.
The first week, in five steps
| Day | What you do |
|---|---|
| 1 | Create a named login for every person who touches the system. No shared accounts, including yours |
| 2 | Set the discount and refund ceilings as naira figures and write them on a card at the till |
| 3 | Turn off cost price visibility for everyone below manager |
| 4 | Require approval for price overrides, stock adjustments and refunds above the limit |
| 5 | Brief the team in one sitting: why it protects them, what the limits are, who approves what |
Then leave it alone for a month and look at the log. Not to catch anyone. To find out which approval you set too tight, because there will be one, and the tell is a staff member who stops asking and starts working around it. The daily numbers that matter is the routine that surfaces it.
Frequently asked questions
What access should a shop assistant have in a retail system?
Enough to sell and to receive stock, and no more: ring up sales, take payment, see selling prices, apply a small capped discount. Not cost prices, not margin, not stock adjustments, not refunds above a set limit, and never user administration.
Should staff be able to see cost prices?
No, below manager level. Cost price is the most valuable and most portable commercial information in a small business, and there is no day-to-day counter task that requires it. Selling price and stock level are enough to serve a customer.
How do I stop staff giving unauthorised discounts?
Set the discount as a hard numeric ceiling in the system rather than a verbal instruction, require approval above it, and review the override log weekly. The ceiling removes the judgement call, and the log turns a suspicion into a countable number.
Does an audit trail damage trust with staff?
Only if it is introduced as a response to suspicion. Framed correctly it does the opposite: named logins mean an honest employee can no longer be blamed for a gap created on somebody else's shift, which is the protection most staff actually want.
Give everyone their own key without giving away the shop
Wayg has team roles with permissions and audit trails, on the same records that hold point of sale, inventory, store management and bookkeeping. Every sale, override, adjustment and refund carries a user and a timestamp, so a discrepancy becomes a question about a shift rather than an accusation about a person.
Get started freeThe free plan needs no card.