As with any accusation of theft, the onus of proof is on the Employer to establish the culprit. Therefore the business needs to have an appropriate policy in place to investigate such allegations. An Employer should have a Right to Search policy in place in their Contracts of Employment and Company Handbook. If there is no such policy, an employee has the right to refuse a search of their personal items.
To uncover the person responsible for the theft, there should be markers placed on notes and then a search carried out to obtain the proof. If there is CCTV in place, then the recorded evidence should be obtained.