Well at first you shouldn't be that worried.
His actions are the consequence of a different way of thinking that you do. Children think in the moment not the future. If they see something they like they deal with the question how to get it as easy and fast as possible but not, what might happen or even what he is actually doing.
With the stealing example: He sees candy and he wants the candy, so he is working on the plan how to get it from his friend. In this moment he isn't realizing that he is stealing, he doesn't think of consequences, he especially doesn't think about, what happens if he comes home with the candy, he is just looking for the easiest way to get it. And when he comes home and is confronted from you, about it. It is again a situation where he will look for the easiest way out. Telling the truth means loosing it and a lot of more trouble, lying means keeping the candy and no trouble, so he goes with lying. That lying can fail and what happens if it fails, that is already to far in the future. So you need to understand that this isn't "evil" behavior, and that he isn't planing against you. As well as that he is honestly sorry about doing what he did when you confront him, because the moment you ask him if where he got it, is the moment for him when he actually realizes what he did.
Now how to deal with it. If you want your child to become a "good" person, you need to aproach it from two fronts, empathy and consequence.
In the consequence part you seem to be already on the right track. Just make sure he really understands the conection between his action and your reaction. And you might, if possible let him fix what he did.
Now the other part is a little more tricky.
And the other part is empathy, he needs to learn to see the consequences of his actions for the other side and to feel what others feel. For example if he lies he needs to understand that you start to distrust him and that it makes you feel bad because you want to trust him, that if he steals, something, someone else is missing what he stole.
Here the best way after my personal experiences, is to remember children of their actions.
For example: Your kid did tell a few lies, now he is telling you something and wants to trust you. -> Be suspicious and tell him that you don't really trust him because he lied to you before.
Or if he gets something stolen, remind him that he stole something from someone else and make him understand that they felt as bad as he feels now.
But be careful that you don't use too old examples. Children need many chances for restarts.
Sadly I never really got a good time frame or even a rule of thumb, it seems to be a thing that can vary extremely.