Day-of-week patterns in employee voids — what they tell you

Aggregate void rate is the wrong window. A 1.8% network void rate is healthy; a single server with 1.8% might still be running a scheme — if all of his voids happen on closing shifts when the manager's gone.

The diagnostic is concentration. For each employee with five or more voids in your window, build a histogram of their void timestamps by day-of-week. Now look at the max bucket. If 40% or more of that server's voids cluster on a single weekday, you have a pattern worth a review.

Why 40%? A perfectly distributed schedule would put 14% on each weekday (1/7). A schedule weighted toward weekends would put 25-30% on Fri/Sat each. Anything above 40% on a single day signals deliberate timing, not natural distribution.

What to do next: - Cross-reference the day-of-week with the closing manager that night. If the same name appears as closing manager on every void day, you have a coverage gap. - Look at the tender split. Day-of-week + cash-only is the strongest combined signal — that's the classic post-payment skim. - Pull the actual tickets for those voids and read them. Most schemes leave a paper trail.

The Never 86'd Leak Detector runs this check automatically against ticket-level CSV exports. The card shows up in the result whenever an employee crosses the 40%-concentration / 5-voids-minimum threshold, with the day name and the ratio (e.g. "Tue · 6/6 · 100% concentration").

Pattern detector, not verdict detector. Same rule as Void Hunter.