Finding Theft in Tender Sales I am a bit new to this, but I was hoping to get some guidance.  I have a large dataset of cash register sales.  It shows items sold, returned, or given away for free by the sales person.  The 3rd item is what I want to look at to see if 1: this can be used to predict theft?  2: Is a manager at a given store more likely to appease a customer or over generous.  
I would like to do this with sklearn's models.   I was thinking an using Outlier detection to find managers who tend to give more items away than the other managers.  Is this a valid way to look at it? Should I normalize the the data somehow because some stores do more sales than others?  If so, what is a good way to normalize the data?  Percent given away? or some other scoring method?
 A: I'd suggest you don't actually bother with the fancy approach. Sum up how much each manager has given away, divide by the total revenue of the store, and see if any managers have a very different number than the rest by hand. Remember:


*

*Things you find out via machine learning are often, often overfit or (especially in cases like this) aren't quite answering the question you think you're answering. The best case for a real-world situation like this would  be it highlights managers who you should look more into personally.

*Given that, if you desperately want to run scikit-learn on it, then one possible solution I see for you is indeed with outlier detection. Assuming you can link all give-aways to the manager in charge during them, and assuming your daily numbers are independent of each other (which is patently untrue but may work anyway, since time series modeling is difficult), what you can do is generate a vector per manager, in which each feature is the number of items given away for a particular day. So your vector would be of size (number of days in the dataset)x1. Then you could, assuming you have enough managers and stores, use a one-class SVM. 
A: This question is a bit subjective. Anyway, I do not think that you can/should assume theft based on such statistical numbers (So Q1: no it is not a 'very objective' valid way). But for sure you can use it to see where relatively more or less generous behavior occurs (without making a statement of good/bad).
Sklearn seems good if you have sufficient data. In that case you won't need to make a model yourself which may be difficult/impossible/subjective/etc
Take care that 


*

*The data collection is done carefully.

*Sufficient confounding variables are taken care of (Q2: So yes you should "normalize" somehow. I believe if you add factors to your classification problem then the normalizing thing is dealt with. For specific details you should re-ask or update your question).

*You do not fall into the trap of the prosecutor's fallacy
While this answer is quite general, and does not give you a specific solution (which I believe is difficult), I would like to add a link to a legal case that has some connections with your problem and is very interesting to read since it provides very good insights into careful statistical thinking. Several errors and simplifications had been made in that legal case, and there is lots of subjectivity behind the numbers and calculations with different views (such as Bayesian probabilities) providing completely different outcomes.  


*

*'Elementary Statistics on Trial (the case of Lucia de Berk)' 2010 by Gill, Groeneboom and de Jong 

*'On the (ab)use of statistics in the legal case against the nurse Lucia de B' 2006 by Meester, Collins, Gill and van Lambalgen
A: I don't know what skleans models are. What I glean from your post is that you want to detect unusual activity in " daily given away" taking into account the total sales for a particular day for a particular manager. To do so one might need to take into account daily/weekly/monthly factors and perhaps holiday factors while dealing with level shift, trends and unusual values while incorporating memory (ARIMA structure). The idea is simple and profound .. identify typical response to assess/detect unusual activity via Intervention Detection. see this URL for an introduction http://docplayer.net/12080848-Outliers-level-shifts-and-variance-changes-in-time-series.html . His examples are purely univariate but the approaches have been easily extended to causal models . See this http://www.math.cts.nthu.edu.tw/download.php?filename=569_fe0ff1a2.pdf&dir=publish&title=Ruey+S.+Tsay-Lec1 where transfer function models are discussed and here for an overview http://autobox.com/cms/images/dllupdate/TFFLOW.png.
This can be accomplished by identifying/building a causal model this is normally called a Transfer Function model which is a combination of regression structure and time series featutes.
If you wish to post data for 1 example (real or contrived) I and others might be able to help further as this looks to me like very promising problem in search for a very promising solution leading to value. Essentially what you are trying to do is to convert data to information to action.
As a warning be aware that many regression type solutions premise data that is free of autocorrelation i.e. non-time series but that assumption is usually not disclosed . One has to be concerned with model assumptions and their validation.
Models need to be complex enough (fancy enough) but not too complex (fancy). Assuming that simple methods work with complex problems is not consistent with  scientific method following Roger Bacon and tons of followers of Bacon.
