Methods for detecting robbery/anomaly on sales time series

#1

The context of this question is a local business where we sell entrances to a playground. As it is a service (no inventory) is very easy for a vendor not registering the sale on the system. Then he is stealing the money of the order.

Sales data is a transactional database. Each order for each customer is registered (date, hour, amount).

My question is

Which mathematical/statistical approach could be more adequate to detect this robbery pattern on time?

Sales goes down when robbery occurs of course but it is also possible because of seasonality and many other factors.

#2

Without some sort of model of expected sales I don't see how you could detect theft with any reliability. Are there multiple vendors? Then comparisons between them might shed some light, but really it sounds like a job for an actual audit.