Elements of an Incident Report

Regardless of whether an incident report is completed on paper or electronically in an incident reporting system, it includes several universal elements:

Loss prevention professionals are probably very familiar with writing incident reports for the typical shoplifting and internal theft cases. Almost all reports contain who stole it, what they stole, when they stole it, where they stole it from, and why they stole it.

Interestingly, this same methodology is used by many other departments in the retail organization. For example, the human resources department typically handles reports of violation of company policy. The human resource representative’s report will include who violated the policy, what policy they violated, when they violated the policy, where they violated the policy, and why they violated the policy.

Another example is the risk management department. This department is typically tasked with providing a safe work environment but is also responsible for processing customer and employee accident reports when things go wrong. Who had the accident, what kind of accident occurred, when did the accident occur, where did the accident occur, and why did the accident occur?

Get the idea? Incident reporting systems are not just for loss prevention. The flexibility provided by many solutions allows for the system to be utilized by other parts of the retail organization. Incident reporting systems can help the risk management team to manage accident reports just as easily as it can help the loss prevention group to manage theft investigations.

Benefits of Electronic Incident Reporting

Besides the ability to store incident data for many different groups within the retail organization, an incident reporting system has several other benefits. Most importantly, an incident reporting system has the ability to store the incident data in an electronic format at a central location. This seems obvious, but it actually represents the fundamental difference between centralized incident management and traditional methods of collecting and storing incident data. The data collected by an incident reporting system (database) can be a very powerful tool.

Incident reporting systems can be configured to interact with other business systems, such as

The database can be used to generate statistical reports that can help an organization to gauge various metrics. When combined with other data sources, the data in the incident reporting system can be used to identify trends that otherwise would not be visible.

For example, when linked with data from an HR system, it would be possible to pull a report to analyze the relationship between store shrink, employee turnover, and theft incidents. Another possibility would be to analyze the department in which a suspect was first observed compared to the time of day in shoplifting cases. These types of reports would require significant resources if compiled by hand, but with the use of an electronic incident reporting system, the data are easily accessible.

Pitfalls of Incident Reporting

The benefits of using a centralized incident reporting system can be numerous but require more than just a financial investment in order to be achieved.

The successful implementation of an incident reporting system requires planning, communication, and follow-through. During the implementation process, it is important to maintain partnerships with the departments that will be utilizing the system, the IT department, and the vendor’s technical staff. With communication, the vendor can provide a solution that is tailored to the needs of everyone involved.

After a solution is implemented, it is critical that management support the system. It is important that managers train end users on system operations. No matter how easy the system is to use, end users should be taught the proper way to input, retrieve, and report on incident data.

Finally, it is important that the system be kept up-to-date with changes in corporate policies. Invariably, with time, things change. Make sure that the system is reconfigured as needed to accommodate these changes.

Conclusion

Before any system is purchased, research and planning are needed. With a strong commitment from all involved, an electronic incident reporting system can provide a significant contribution to a retail organization.

Lessons Learned

Special events and celebrity appearances present challenging security problems, but the application of basic techniques and procedures, adjusted to meet the peculiar circumstances involved, with some imagination thrown in, will provide solutions.

What are some of the more important considerations in planning for a special event or celebrity appearance? We suggest the following:

Pre-planning: Who knows all the event details?

The venue: public area or within private property?

The celebrity: well-liked or controversial person?

The event: Length of event

Post event: Review event and conduct after-action review for lessons learned.

Check Washing

Using a process known as “check washing,” suspects erase the ink on checks using chemicals that can be found on the shelves of a local supermarket:

It is estimated that check washing accounts for over $815 million of fraud losses every year in the United States.

Here’s the way the scam works: A suspect removes checks that are often left in an unattended mailbox that the consumer has used to pay personal bills. The suspect then washes the ink from the check, leaving the original signature, but altering the payee and the dollar amount. The suspect often cashes the check at supermarket chains, small gas stations, check cashing outlets, and credit unions using a fraudulent identification.

Despite the fact that check manufactures have tried to prevent check washing and fraud by making checks difficult to wash or copy, many suspects have become so good at check washing that retailers and consumers are unaware until they are given notice from the bank that they were victims.

As a consumer, you can protect yourself by not leaving your mail unattended, using a postal drop box when possible, and using a “gel” pen when writing a check.

As a retailer, you can look for the security features that check manufacturers have used when ordering company checks. Security features may include the following:

Counterfeit Checks

Retailers often fall victim to counterfeit checks and again are not aware the check was counterfeit until they are given notice by their financial institution. Due to the advancement in color copying and desktop publishing, this is also become a fast-growing scam.

Suspects often get their check printing material at a local office supply store where the check writing paper is readily available. (Most over-the-counter paper does not contain the security features mentioned previously.) The suspect then uses an active checking account number and makes several blank checks using a color copier or scanner that is located at his or her home or local printing warehouse. The suspect is then able to use the home-made checks at any retailer that accepts checks. The suspect will frequently write the check for an amount over the purchase price to obtain cash as well as the merchandise.

Suspects also make up checks which appear to be payroll checks from known companies, since major supermarket chains cash payroll checks.

Many retailers combat the check fraud issue by, for a fee, using outside companies that guarantee their checks if the retailer follows certain steps when accepting a check. The benefit of using an outside company is that it guarantees the checks will be paid, regardless whether they are subsequently found to be a fraud. The outside company compares the check data against its database to determine if the company should accept the check from the consumer.

The retailer’s responsibility is to download the program, train its employees to take accurate information, and leave the rest to the outside company. Most large retailers are not equipped to investigate and attempt to collect bad checks. By using an outside agency that guarantees the check, that agency then becomes responsible for investigating, collecting, and perhaps prosecuting the perpetrator.

Where and When Permitted

Black’s Law Dictionary defines an arrest as “The apprehending or detaining of a person in order to be forthcoming to answer an alleged or suspected crime.”(1) Ex parte Sherwood, (29 Tex. App. 334, 15 S.W. 812).

Usually, arrests are made by police officers acting as agents of the government. The law gives these officers broad authority and a high degree of immunity while carrying out their duties. There are, however, times when ordinary citizens are confronted by criminal activity and no police officer is available to intervene. Because of this possibility, the laws of every state define certain circumstances under which private citizens are authorized to arrest or detain another person.

Some states permit arrest for a wide range of crimes. Others place strict limits on the type of offenses subject to citizen arrest and on the conditions under which the arrest can be made.

The exact circumstance under which an arrest is authorized varies with each state. Some authorize private citizens to make arrests for felony crimes committed in their presence. Others also allow for the arrest of felons even when the crime was not committed in the presence of the arresting person, as long as there is reasonable cause to believe that the person arrested committed the crime. Many states also permit private citizens to make arrests for other less serious public offenses committed in their presence.

A sampling of citizen’s arrest laws shows the following:

In most cases the person making a citizen’s arrest must actually witness the crime. However, many states have enacted so-called Merchant Privilege Statutes. These laws expand the authority of merchants to detain persons for shoplifting and certain other crimes based on a reasonable belief that a crime occurred.

Who Can Make an Arrest?

Although usually referred to as a “citizen’s arrest,” a more accurate description is “private person arrest.” In most jurisdictions where these arrests are permitted, the language of the law extends the authority to any “private person.” This may include noncitizens and even those in the country illegally.

Liability

Under the laws of most states, police officers acting lawfully in their official capacity enjoy considerable immunity from lawsuits arising from their actions during arrests. The same is generally not true for private citizens. Performing a citizen’s arrest exposes the arresting party to both civil liability and criminal penalties if their actions are later found to be in error or in violation of the law. Where they apply, “Merchant Privilege” laws often provide for limited immunity from civil liability if there is reasonable cause to believe that a crime was committed and the arrest was made in a legal manner.

Before someone makes a citizen’s arrest, it is important to fully understand what the law permits in the state where the arrest is to be made.

Do’s and Don’ts

Do’s

• All executives and loss prevention/security personnel have keys to lock doors as necessary.

• All executives and loss prevention/security personnel are in possession of the following telephone numbers:

Regional Command Post

Mall Management General Offices

Mall Security

Local Law Enforcement

Fire Department

Store Personnel Emergency Telephone numbers

• Assure trash is removed from the dumpsters on a daily basis, if possible.

• Assure that only “necessary” terminals are opened once threat of civil disturbance is known.

• Both store manager and operations manager should carry one of the security radios at the first sign of any disturbance, if possible.

• Make sure your store command center telephone is staffed at all times by security, senior management, or some other responsible individual at the first sign of any disturbance, if available.

• Have a portable radio available so that local news broadcasts can me monitored.

• Assign a team of store volunteers that would include members from security, stock, dock, etc., to be available to board up windows with premeasured and cut ¾-inch plywood sheets. Assure an ample supply of nails, hammers, gloves, and eye protection is available to handle this task safely.

• Predetermine whether the store will be evacuated upon reasonable belief that it may be in the immediate area of any riot or civil disturbance. This determination should also factor in whether any personnel will remain, to protect the store and its contents, after the general evacuation order is given. If some personnel are to remain, assure they have adequate means to communicate with designated senior management and whether any other special equipment, in the use of which they have been trained, will be issued.

• Determine, in advance, what the pay policy will be for evacuated employees for the period(s) of time off normal work schedules due to an evacuation of the store and/or inability to obtain transportation to work.

• In the extreme event that your store is over run with demonstrators while customers and employees are still present, establish a safe haven such as your office, dock, etc., to shelter these individuals until order is restored. As soon as possible, notify mall security, law enforcement, and regional command for assistance.

• If you are ordered to evacuate the building, obtain the name of the person and the agency he or she represents for insurance purposes.

• Assure all flashlights are in good working order; keep a spare set of batteries.

• Conduct an emergency generator test (if applicable) and assure there is an adequate supply of fuel available.

• Determine, in advance, whether to leave the lights on or off if the store is totally evacuated.

Don’t’s

Figures C-3 and C-4 are forms which may prove beneficial.

FIGURE C-3 Civil disturbance/terrorism incident report.

FIGURE C-4 Information log.

Background

Since the early 1970s states have been passing civil legislation designed to penalize anyone who removes merchandise offered for sale from a store or distribution center without payment. Each state law varies with regard to the penalty amount, damages, and if there is a criminal matter pending.

These laws have proven themselves to be very effective in helping to reduce shrinkage by generating resources for retail loss prevention departments as well as providing a financial deterrent. This income stream helps defray the costs of preventing theft to those who incur it or, in the case of a minor, to the parents.

The language of a few of these laws seems to indicate their intent is to be an alternative to criminal prosecution. Most of the civil recovery laws are not used as an alternative but rather as a consequence to a criminal act. Each of these crimes has a victim. The victims in these cases are retailers, but mainly their good customers who in the past have paid in the form of higher prices.

These laws are currently being used by retailers as an add-on to their loss prevention toolbox. These tools, when added to the entire picture, complement controls and procedures to help bring down shrink.

Generally, theft is a crime of opportunity, and nobody has more of that than employees. Those who are terminated for theft are liable civilly in all states. The major difference between internal and external cases has to do with the condition of the merchandise. Customers are usually caught “red-handed” still in possession of stolen merchandise, which is returned to the retailer once the matter has been dispositioned, either in-house or by the courts. In most employee situations, the case is often built from investigation of past theft, and merchandise is often unrecov-ered. In this situation the retail value of the loss is added to the penalty. The maximum amount is determined by the small claims maximum in the state where the incident occurred.

For best results, case work should contain a narrative, but the crucial element is the theft admission statement signed by the former employee. This process allows the person to pay back the losses incurred through restitution as well as a portion of the investigative cost involved through the civil penalty.

Recovered expense dollars bring 100% to the bottom line, income previously unattainable, and losses which had been previously written off are now being regenerated.

Procedure

Each case must be reviewed by someone who has been properly trained in the area of case review. The condition of the recovered merchandise should be noted, specifically if it was recovered in unsaleable condition or unrecovered. A complete narrative should exist, keeping in compliance with shopkeeper’s privilege and private person’s arrest procedures. Responsible parent information on minor cases should also indicate to whom the child was released. In all cases, the subject disposition should be indicated. The preceding conditions, together with state law, will determine whether a demand should be issued and for which amount.

A series of letters is then sent to the individual demanding payment, which is either preset by the law or based on loss prevention costs. This process is known as “civil demand.” It is an attempt to resolve a financial matter prior to a court action. Once the matter moves to civil court, copies of the demand letters are provided as proof of an attempt to settle this between the parties.

Since there has been no judgment made prior to the civil demand process, care must be taken to limit exposure to liability when engaging a nonadjudicated individual by making outbound calls. In other words, this situation should not be treated as a debt-collection exercise. Once an arrangement has been made between the parties, calls to the individuals are best cast as follow-up to those arrangements.

Recommendations

Upon release of the individual, a notice should be given. The notice should contain language which indicates the state law, the incident, the fact that the store may seek a penalty, and a phone number to call with any questions. Store personnel should not try to explain the notice. They should refer all calls to the recovery agency or suggest the person seek legal counseling.

Store personnel should separate themselves from the collection process. Penalties assessed should be done after the entire case has been reviewed.

A central point for collections and case review should be established so payments, calls, and correspondence can be controlled. A company attorney should be designated to handle inquiries and research.

It is wise to find out what limitations are contained in the individual state statutes. For instance, there are a few states in which a civil demand cannot be issued if there is a criminal matter pending. Understanding the specific criteria to be met on a state-by-state basis is essential.

Effectiveness

The most effective use of civil recovery laws comes in the way of dealing with recidivism. Especially among minors, although most states hold parents responsible, a good way of handling minor cases is by helping parents to exercise control. By allowing the son or daughter to make payments, the consequence for his or her action is realized. Also, this process will not alienate the parents, who are, many times, good customers.

Our internal studies show a rate of recidivism of less than 1% in cases in which the people paid the civil demand. More importantly, in a case study of a major retailer, the overall shrinkage was significantly reduced upon the introduction of a civil demand program.

Outsourcing Collection Services

When a decision is made to create a partnership with a firm to handle any portion of civil collections, several factors should be considered. The first element in this choice should be the services offered by the firm. Many firms today will offer to collect civil recoveries as a return on the services offered by their firm, such as investigation, sale data analysis, and interview costs. Others are law firms, which will add attorney fees to the amount collected and at some point will be retaining more funds than the retailer. Still other firms have the best interest of the industry in mind. They will bring experience in law, loss prevention, and retail. They make the connection between software manufacturers, loss prevention departments, and collection attorneys.

When doing diligence on potential partners, ask for references and also include a request for names of clients lost and why. These requests should also be included in any request for proposal (RFP). Also, some firms will advertise, showing the names of retailers which are only servicing a portion of the cases. Investigate the ownership of the firm, the length of time in the industry, and the amount of litigation encountered along the way.

Currently, there are a few companies active in this arena. My apologies if I have left out any:

Some History of Civil Restitution

In the early 1970s, the state of Nevada enacted a statute involving the theft of library books and civil remedies available to the victims of these thefts. Later, 10 Western states enacted similar statutes, but specific to the act of shoplifting. At the forefront of this legislation was Ron Clark, then Loss Prevention Director of Payless Drugs in Oregon. Ron recognized the opportunities such legislation offered to loss prevention departments and their retail organizations. It was definitely a useful tool to “manage” shoplifting expenses by passing such costs along to those who caused the losses. Additionally, many loss prevention professionals observed that criminal prosecution of shoplifters was being sidelined by reduced budgets in law enforcement, prosecutors, and what appeared to be an apathetic attitude by some jurisdictions.

In the early 1980s, more and more companies jumped on the bandwagon, after initial court challenges were overturned and the path smoothed by the early pioneers. Many members of ASIS International (then the American Society for Industrial Security) Retail Loss Prevention Council proselytized these laws nationally, and we saw additional states enacting such legislation.

Additionally, many states amended their laws to include parents of juvenile shoplifters.

However, these statutes did vary in language and recovery amounts. This occurred because they were enacted by legislators who had to be sensitive to the individual needs, concerns, and the laws of their various jurisdictions.

Most professionals regarded civil restitution as a business tool, rather than punishment.

To Utilize Civil Restitution or Not

Whether a company decides to process civil restitution paperwork internally or opts to use one of the many qualified outside services, several decisions should be considered prior to the adoption of such a program.

First and foremost, upper management must buy into the process. To facilitate this, educate them on the laws appropriate in the area in which you do business and what remedies you have under these laws. Besides running a cost-benefit analysis of using such remedies, it would behoove the loss prevention professional to cover such issues as possible loss of business from irate parents who have received demand letters for their miscreant children’s illegal acts.

If upper management is adverse to such exposure, one alternative is to send demand letters only to adult shoplifters.

Either way, though, you need to make a decision on just to whom you will send demand letters. Will it be all shoplifters? Just those you prosecute? Just those you convict? Just those shoplifters stealing more than a specific dollar amount? Once you have made these decisions, you are ready to proceed further.

Once you have the buy-in and decided to whom you will send these demand letters, you need to decide what amount you should demand. Working closely with your attorneys and financial staff, develop what your average cost of handling a shoplifter may entail and document this information.

Costs relevant to shoplifting prevention in your stores may include such items as electronic article surveillance (EAS) systems, electronic and mechanical shoplift prevention devices (such as cables and the like), and labor costs of plainclothes or uniformed shoplift prevention/detention personnel.

Also, in some jurisdictions, you are allowed to ask for a civil penalty and add on the actual cost of the item stolen. In these jurisdictions, the more the shoplifter steals, the more he or she will have to pay for civil restitution!

Prosecute Versus Catch and Release and the Issue of Extortion

Some jurisdictions require you to prosecute the individuals before requesting a demand amount. Most do not. You have the option of catching the shoplifter and releasing him or her, and still making a civil demand for your costs.

Upon review with upper management and your legal department, it will become obvious what tack your company wishes to pursue regarding the issue of prosecution. Every company must make this decision based on what it feel is best for the company, in each individual state’s jurisdiction.

Additionally, the issue of catch and release may cause some concern regarding juvenile shoplifters. Most companies will require either law enforcement contact or, in the case of release, parental/guardian response to the location prior to release of a juvenile. Again, this is a matter for each individual company to address.

It is recommended that you never present the demand for civil restitution at the time of detention. Any monies gathered at that time could be the basis for allegations of extortion from hungry attorneys who are always on the prowl for a lawsuit against “deep pocket” companies.

However, it is advisable that you give the shoplifter some written document or oral statement backed up in the report that will inform him or her of the possibility of civil demands to be made at a later date. This avoids “surprises” when your demand letter arrives.

Who Decides Who Gets the Demand?

Deciding who gets the demand is an option many companies have agonized about. Many will train their line shoplift detention personnel as to the company’s guidelines on sending a civil demand and leave it up to the agent to recommend or not recommend the issuance of such a letter. This approach seems to work best that way, as the person most knowledgeable of the case, with all the facts in hand and with good education of the company’s civil demand letter guideline template in hand, calls the shots.

Whoever makes this decision, however, must be cognizant of the company’s policy or guideline on the parameters of what qualifies a situation for a civil demand letter and must approve the release of such a letter. This would apply whether the letters are created in-house or outside the company.

Setting Up Your Demand and Collection System

If you decide to create demand letters in-house, you will need to staff up. Consider that you will have to develop a system that will identify which shoplift detentions will merit a demand letter, send a letter on these detentions, track collection or nonpayment, and take further action.

Depending on your jurisdiction and laws, you may wish to pursue nonpayers in civil court. If you decide to follow this course of action, you certainly must first make a decision as to whether it is cost effective to do so. As with decisions to send letters, it is important to be consistent in the application of your decisions. All of this will require time, labor, and systems.

Should you decide to use an outside agency to send your demand letters, your major chore will be to select which detentions merit a demand letter and forward that information to your outside civil restitution agency. In most cases, these agencies will require either a set rate per letter or a percentage of the monies collected. They will follow up on nonpayers, and, in many cases, will function like a collection agency in this matter, sending several letters and even, possibly, making telephone contact with the nonpayers to elicit a payment of the monies due.

It is up to you to determine which will be the most cost-effective method for your company.

In any event, it is always wise to ensure that you are consistent in to whom you send demand letters, and to adhere to your program. This may avoid some legal problems in the future.

Once It Is Up and Running, What Other Issues May Arise?

One major issue is to set up a mechanism that will raise a red flag if a shoplifter is prosecuted and found not guilty. In those cases, it may be advisable to rescind your demand letter. However, you may wish to consult with your company attorney for his or her advice.

Also, it is always advisable to regularly review your cost-benefit analysis regarding costs per shoplifter and, if necessary, change your demand amounts to reflect this cost.

Don’t forget to ensure your upper management, who supported your program, receives regular reports on the income generated from your civil restitution program.

In some cases, loss prevention departments will credit part of the costs, or all, back to the retail location which incurred the expenses. Or, it is used to reduce the costs of the loss prevention department. Either way, the company’s bottom line is enhanced, and everyone likes that!

Collusion Between Two Customers to Successfully Shoplift

Customer A attracts some attention to himself in the selection of a relatively small but expensive item of merchandise and “palms” it in his hand. He walks away from the display still carrying the item. Loss prevention takes up the pursuit, following discreetly in anticipation of his leaving the store with the goods in his hand, unpaid for. As this Customer A turns the corner heading toward the door, Customer B, in a group of other customers, passes Customer A. Customer B is carrying a shopping bag. As the two pass, Customer A surreptitiously drops the merchandise into the shopping bag. Both, without acknowledging each other, proceed in different directions. Customer A is stopped outside the store by LP, and he has no merchandise in his possession. Customer B exits by another door with the stolen goods in her shopping bag, unbeknownst to Loss Prevention. The stage is now set for a “false arrest” lawsuit.

Another scenario could be that Customer A intentionally creates a distraction in the middle of the store causing customers and employees to draw toward that area, while a colleague (Customer B) in the corner hides merchandise and subsequently carries it out of the store.

Ad infinitum.

Collusion Between a Customer and an Employee to Commit Theft

Customer A is the roommate of Employee A. Customer A fills her shopping cart with various items of merchandise and enters the checkout lane leading to the checkout cashier, Employee A. Employee A intentionally fails to record the prices of various items. The total sale may reflect the correct price of 20 items of merchandise, but 9 items of merchandise were never rung up or paid for, as intended in this collusive plan.

A second example: Customer B is Employee D’s sister-in-law. Customer B brings into the store a store bag and a receipt for $60 worth of merchandise charged to her account, but no merchandise. Employee D writes a fraudulent charge credit for the amount reflected on the charge receipt, which amounts to a theft of $60. The prior agreement between B and D to this scheme for committing this theft is also the crime of collusion.

Collusion Between a Second Party and an Executive, Buyer, or Purchasing Agent for Payment of Goods, Supplies, Materials, or Services Not Received and/or Rendered

The chief engineer of the warehouse and distribution center receives an invoice from a “painting contractor” for painting jobs around the facility. In reality, the painter painted the engineer’s mountain cabin and prepared the invoice reflecting work completed on company property, which was never done. The chief engineer approves the invoice and the painter is paid.

The buyer for hardware makes a deal with the stepladder supplier to inflate the invoice by $6 for each ladder purchased by the retailer, with the agreement they will subsequently split the $6 difference between the correct price and the inflated price paid by the company.

The store manager approves an in-store purchase of Christmas decorations, and the invoice is prepared by his brother-in-law. No decorations were received. His brother-in-law isn’t in the business of selling decorations. This arrangement represents collusion between the two to cheat the store and illegitimately receive money to which they were not entitled.

Two actual collusion cases are reviewed in the “Fraudulent Outsourcing and Invoicing” section in this book.

In the retail environment, there are endless possibilities for collusion between employees themselves, employees and customers, and between employees and vendors. The possibilities are limited only by imagination and creativeness. This potential for losses, which can easily reach into the thousands of dollars, is but one, albeit an important one, of the reasons for instituting a system of checks and balances and frequent audits, including the vetting of vendors, particularly those of the small independent contractor variety.

Contract Security Guards

Since uniformed guards remain the most prevalent use of contract security in retail, it is appropriate to quickly review the key advantages most often cited in deploying “outside” guards.

Flexibility: The better guard companies can fill an immediate need almost instantly. Whether the need is temporary or permanent, night or day, fixed post or patrol, one officer or 10, LP directors using established providers can reliably summon the help they need with one call.

Few LP programs rely solely on contract guards for shrink control. However, the role of contract security officers has expanded well beyond the traditional “door guard”: Companies now employ contract security for lobby reception positions at the home office, permanent shift work at warehouses and distribution centers, augmented store presence for special events and the holiday sales season, overnight security on construction and renovation details, and response to adverse incidents such as robbery and other workplace-related violence.

Economy: The flat-rate, hourly billing formula indigenous to contract security provides cost control and accurate expense forecasting more reliably than the vagaries of payroll rates of proprietary staff. Fixed costs, with pay-as-you-go scheduling, allows for planned budgetary allocations by location and shift that eliminates expense “surprises” and provides an unambiguous cost/benefit analysis. Compared to technology and systems-reliant LP resources where ROI justification is sometimes elusive, guards are a tangible commodity, easily quantified: “this many dollars buys this many hours.” Further, it has been long held that for some security positions, contract security is more cost effective than proprietary, or in-house, security employees. Contract security advocates point to the corporate pay scales that often result in higher wages for security employees, coupled with overtime opportunity and a benefit package that includes medical insurance, worker’s compensation, vacation, sick days, and more to argue that the hourly rate charged by a security service provider can be significantly less costly in the long run than an in-house counterpart. These advocates do not contend you get a better guard—just a cheaper one.

New realities to the marketplace, however, should prompt the prudent LP director to periodically revisit the cost ratios between contract and proprietary security. Liability insurance, worker’s compensation, licensing and certifications, unemployment insurance, and payroll taxes continue to encroach on security companies’ profit margins, and escalating costs are passed along accordingly. In some states, sales tax can add another 5–8% to the bill in addition to the quoted hourly rate. The contract security industry is also keeping a close eye on the efforts of the Service Employees International Union (SEIU) and others in their drive to organize contract security officers. Such an event, security companies contend, would further elevate their cost of service.

Having quantified the advantages of contract security from the business side, its effectiveness as a loss prevention tool can be examined. It would be appropriate here to first outline the expectations a retail LP executive would have when engaging a contract guard service:

Welcomed, but not necessarily expected, value-added services may include the following:

Reasonable expectations of the service provider include the following:

The ability of service providers to meet or exceed expectations rests chiefly in the relationship cultivated between subscriber and the provider.

Vendor loyalty plays a significant part as providers often “go the extra mile” in both guard quality and cost accommodation for clients offering the prospect of steady work and consistent deployment requirements. LP directors can enhance the guard’s effectiveness with detailed post orders and site-specific training, a reasonable and self-serving accommodation the client can make, provided the company assigns a security officer who is educable and committed to making the investment in time worthwhile. For a contract security officer to make a contribution to a store’s performance, the cost is both money and time.

Many retail LP practitioners cite a “disconnect” between their expectations and the deliverables from guard companies. Grooming and professional appearance are issues; demeanor and conduct on post are increasingly casual; relevant training vis-à-vis shrink control is virtually absent. There is a perception—some would say a reality—that standards among service industry workers across-the-board have declined and that the contract security officer has followed this trend. As a result, the user’s expectations of the service provider may require reconsideration, even on something as basic as credible background checks.

Security jobs are often temporary positions, and the applicants are often transient workers; a criminal background check in one state may not always reveal misdeeds in another. Reference checking can be suspect as well. In some instances a security officer is hired one day and dispatched to your store that same night.

Security companies reflect the changes to the American workforce, and as the workforce continues to absorb workers from outside the country, a state criminal check for a security guard applicant recently immigrated is unlikely to yield any adverse information; fingerprint checks are not run through Interpol. An applicant’s criminal past in another country would likely go undetected.

Expectations for relevant training may also have to be curtailed. State and local licensing regulations require costly certifications and training, little of which is relevant to preventing inventory shrink. As a result, any orientation an entry-level security officer receives is that of a “generalist,” and the contract provider has little opportunity for additional training specific to the retailer’s needs. The days of a guard “in training” standing post with a seasoned officer at the security company’s expense are long gone. Moreover, as security companies attract and hire more foreign workers, it becomes questionable how well traditional training curricula allow for cultural differences and language limitations, and enables newly immigrated security officers to interact with retail customers and employees in a manner that reflects positively on the client company.

Another contributing factor for expectations falling short is the reality of litigation-avoidance that guard companies must address aggressively if they are to survive. Costly litigation, punitive awards, and rising premiums have had a numbing effect on the industry, and “marching orders” issued to guards by their employer to prevent confrontation and litigation can be so restrictive as to boil down to a mantra of “see nothing, say nothing, do nothing.” The long-held security officer’s credo of “observe and report” may now include the caveat: “and take no action.” Understandable? Certainly. Does it endear the guard to the store manager who is told a man just ran out with an armful of dresses as the guard looked on? Certainly not.

As with all resources, contract security guards have their benefits and their limitations. The savvy LP professional will understand that background checks are limited, training is questionable, and the security companies must look out for their own bottom line before that of their client. These factors will be weighed in the context of security needs and the economic realities of budget. If a provider cannot balance the mutual interests of the client as well as his or her own, other options will emerge.

Contract Store LP Agents

Store detectives (now called LP agents) had once been the core component of retail LP programs. Over time, as shrink control became the purview of both store operations and finance, these one-dimensional assets dwindled in import and number. Some were redirected to audit functions, others became employee investigation specialists, but many became the payroll trade-off for capital expenditures in systems and technology that have collectively and consistently reduced inventory shrink industrywide.

Yet, occasionally, certain situations arise in which only the apprehension of a shoplifter or dishonest employee is going to protect the assets. There is a hard-core element that will not be deterred by uniformed guards at the door, signs in the fitting room, or cameras behind smoked domes, whether they be daredevils, opportunists, or foot soldiers in an organized retail theft syndicate.

In the days before imbedded EAS, covert CCTV, automated POS exception analysis, RFID inventory control, and extensive security fixturing, it was the store detective who protected merchandise from theft. Some were nondescript floor walkers who blended in; others were eccentric characters who raised the game to an art level. Each, however, possessed a vanishing skill set to exploit the selling floor terrain and observe, react, and close on shoplifters and employees alike, with an impressive record for clean, substantial cases. But their payroll burden on downsizing companies, coupled with the exposure to litigation, augured the winnowing of this profession and ushered in the era of technology and audit, with undeniably favorable results.

Many LP directors understand program effectiveness is cyclical, and although store detectives will never again be the catchall LP solution, some still prefer to have a deployable asset on call that can enter a market and mitigate a debilitating external theft condition. Enter the entrepreneurial contract security provider, eager to either create or diversify product offerings to meet a need in the marketplace.

Since the mid-1990s, contract store detectives have been an innovation touted in discussion but embraced only at arm’s length in practice. Variations on the theme have included a “shared pool” of LP personnel provided to multiple users on a mall-by-mall basis; to uniformed guard companies offering “plain-clothes” personnel for patrol and added deterrence; to specialists who monitor CCTV stations remotely or onsite and communicate live-time to store personnel.

Economically, the program suffers from being an “add-on” expense rather than a “trade-off” cost, as would be the case where a contract guard replaces an in-house security employee. The contract security company providing personnel incurs real setup costs in training, travel expense, and exposure to litigation that drives up the hourly rate to the point at which the program becomes an indulgence rather than a necessity. Even success can be damaging to the program: The plaudits earned from sensational cases heralded at the time as legitimate justification wane over time as the case winds its way through the criminal justice system, generating costly invoices for time spent in courts, not in stores.

Still, the concept continues to garner interest. For companies unable to fund advances in systems and technology and unwilling to bear the payroll cost of full-time, in-house store detectives, a contract store detective program can be properly honed to deliver presence, deterrence, and perhaps a quantifiable return on investment through the recovery of merchandise.

Independent Contractors and Consultants

Many retail companies operate with nominal LP staffing; some with only a single LP executive at corporate; others with a small field staff reporting into store operations; still others with none at all. These are generally smaller, regional retailers or growth companies poised to expand through acquisition, or distressed companies that have significantly downsized. As LP needs become realized, management often turns to independent contractors and consultants to provide expertise, guidance, and procedural development to fledgling LP programs.

The ranks of independent LP professionals marketing their services today include some of the best known and highly accomplished practitioners in the industry. They are often called upon to invigorate a company’s LP efforts, tasked with creating awareness and training programs, developing policy and procedural guidelines, and negotiating vendor contracts.

It is not unheard of for companies to have an LP professional on retainer, involved in internal audit and inventory control, store planning and construction recommendations, logistics at distribution centers, security planning for special events, and incident management. These are executive functions normally carried out by LP directors, but where that position does not exist, LP consultants have sought to fill the void.

The trend and the resource has by no means been lost on larger companies with fully developed LP structures. In many cases, LP contractors are engaged on a temporary basis to nurture special projects through the developmental stage, provide or augment specialized functions within IT or finance, or fill a crucial job position during an executive search process.

Consulting engagements tend to be costly, and as such, companies prefer a finite timetable for contract security projects. Seldom do consultants remain for extended periods in positions better suited to an executive employee.

As the business of loss prevention continues to evolve and expand, expertise becomes more compartmentalized. Outsourcing to independent contractors proficient in specialized areas of the retail business, loss prevention included, should remain a viable option for companies determined to improve shrink performance.

Introduction

Crime Prevention Through Environmental Design (CPTED) is a practical concept that has received considerable interest during the past four decades. It is based on the theory that the proper design and effective use of the built environment can lead to a reduction in the incidence and fear of crime, and to an improvement in the quality of life. This concept is supported by the fields of geography, psychology, and criminology, where it has long been known that

CPTED has been used to reduce crime, premise’s liability, and fear in a variety of settings. They include schools, neighborhoods, convenience stores, malls and shopping centers, parking structures, transit sites, hotels, hospitals, office buildings, and parks. There are state statutes, regulations, and safety standards that have been developed to promote the use of CPTED concepts. It is important to note that CPTED does not replace traditional approaches to crime and loss prevention. Moreover, it is a tool that helps to remove many barriers to social and management control.

The use of CPTED concepts requires that human activities and spaces be designed or used to incorporate natural strategies. Crime prevention has previously relied nearly exclusively on labor-intensive or mechanical approaches. Guards, hall monitors, and police patrols are examples of labor-intensive strategies. Security cameras, locks alarms, and fences are examples of mechanical approaches. These methods incur costs that are additional to the normal requirements for personnel, equipment, and buildings that are needed to carry out human activities. The four most common CPTED strategies are

Natural surveillance and access control strategies help to limit opportunity for crime. Examples include the placement of windows to overlook sidewalks and parking lots, the use of transparent weather vestibules at building entrances to divert persons to reception areas, the placement of employee work stations in open areas to increase the perception that these locations are being monitored, and the use of maze entrances in public restrooms to decrease the isolation that is produced by an anteroom or double-door system for entry. These concepts increase the perception that people can be seen by others and that there is a clear difference between public and private space. Potential offenders are made to feel at greater risk of scrutiny and that their means of escape are limited.

Territorial reinforcement promotes social control through a variety of means. They include an increased definition of space, improved proprietary concern, expanded sense of ownership, and enhanced activity support and motivation reinforcement. These objectives may be achieved by increasing the assignment of space to the normal users and reducing public or unassigned locations. Residents or desired users of space who participate in the routine maintenance of space increase their proprietary concern through “sweat equity.” Placing amenities such as seating or vending machines in common areas helps to attract larger numbers of normal or desired users of these areas. Scheduling activities in common areas increases the proper use, attracts more people, and increases the perception that these areas are under control. This makes the normal user feel safe, and the potential improper or undesired user feel at greater risk of apprehension or scrutiny.

Effective management and maintenance of activities and locations are crucial. Well-managed and maintained spaces have greater return on investment. A well-planned activity will result in fewer unanticipated problems. A well-maintained site will have fewer repairs and interruptions to scheduled activities. Accordingly, there will be fewer exposures to crimes and losses.

CPTED Historical Precedence

CPTED has its origins in the early history of the development of communities. The conscious planning of human habitats to include identity and protection goes back as far as our knowledge of human existence. Eighth century Chinese practitioners of Feng Shui promoted the design of harmony in space, from the size of the smallest rooms up to the planning of cities. Eighth through eleventh century plains dwellers in North America developed hierarchies of family places, community identity, and protection through the design of living space. The cliff dwellers (U.S. Mesa Verde National Park) developed impregnable living areas on the faces of cliffs that were accessible only by ladders and entrances that could be sealed. The cliff dwellers are also important examples of early attempts to use passive environmental engineering for climate control.

Modern warfare demonstrated how design can obviate technological and numerical superiority in the City of Hue, Viet Nam, and in Kuwait City, Kuwait. Both cities were of traditional French design with twisting, narrow streets that allowed for a small number of defenders to block the movements of large numbers of opposing troops. Post WWII residential development replaced grid pattern streets with curvilinear streets, which (in some settings) has improved safety, security, and neighborhood identity and property value.

CPTED Strategies

Many CPTED practitioners use the following strategies to guide their assessments of space and conceptual approaches to design:

Related Topics

A number of related concepts have often become confused with the CPTED operating theories and applications. Some of these concepts overlap with CPTED, whereas others are very different. Following is an explanation of the unique elements of the related concepts:

It is clear from a review of these apparently competing concepts that they overlap and are extremely compatible. Many were developed to provide a vehicle for incorporating organized and mechanical strategies into a free-standing model. However, most long-time CPTED planners view CPTED as a small subset of the total set of things that have to be done in crime prevention and control. Criminologists know that a comprehensive system must include strategies on a continuum that ranges from prenatal care to dementia among elderly persons. It would be unconscionable for anyone to think otherwise.

Following are some of the many examples of CPTED applications:

Visual Bubbles, Landscape, Art, and CPTED

Human beings are born with natural responses to certain environmental stimuli. Others are learned within the context of culture, education, training, and experience. Tests with newborn humans and animals reveal that they inherit natural responses to visual stimuli. For instance, when newborns are shown a film wherein they are approaching the edge of a cliff, the subjects will automatically react when they think they are going over the side. Visual stimuli are some of the most important to humans, but by no means are they mutually exclusive of other forms of perception.

Humans establish “visual bubbles,” which vary in depth, height, and width according to territorial definition and geography. A visual bubble may be defined as that space in which a person consciously recognizes things within the environment. Most environmental cues are dealt with subconsciously outside the visual bubble, unless something unusual happens to bring one of these elements to a conscious state.

Why is this important to a study of CPTED? The answer is that the visual sense scans the middle and far environment to collect information for immediate survival and protection. Environmental cues are assessed by all of human perceptual systems. But, the visual sense provides information about hazards, way finding, identity, and attractions For instance, highway safety is almost totally linked to visual perception. Traffic engineers know that certain locations have a high volume of accidents. Other locations seem to induce excessive speeds.

Following are some examples of the importance of planning for visual space in CPTED:

CPTED in the United States

Early interest in CPTED began with the research of Jane Jacobs in her book The Death and Life of Great American Cities, published in 1961. Jacobs described many observations of the relationships between urban design and crime. Her work stressed the importance of increasing territorial identity and natural surveillance.

Oscar Newman demonstrated the importance of natural surveillance, access control, and territorial concern in his 1972 book, Defensible Space. Newman proved that a relationship exists between space management and design and crime in public housing environments.

Dr. C. Ray Jeffery coined the phrase “Crime Prevention Through Environmental Design” in his 1971 book by that title. Jeffery described the relationship between urban design and crime. His book provided quotations from a 1968 report from the National Commission on the Causes and Prevention of Violence (USA) that warned the American public of the direct relationships between urban design and crime. This commission studied the massive urban violence and racial unrest that had occurred in U.S. cities between 1964 and 1968.

Richard Gardiner, a landscape architect and developer, successfully demonstrated the use of CPTED concepts in residential areas. His 1978 manual, Design for Safe Neighborhoods, presented the results of a successful project in a Hartford, Connecticut, neighborhood, which significantly reduced crime and improved the quality of life.

The most significant CPTED developmental effort in the United States was conducted from 1972–1980 by the Westinghouse Electric Corporation through a massive contractual effort that was funded by the U.S. Department of Justice. Westinghouse managed a large group of consultants and subcontractors who were responsible for adapting CPTED concepts that had been proven in public housing environments to retail, transportation, and school environments. Much was learned from these efforts, which provides the basis for current CPTED uses in the United States.

Interest in CPTED at the U.S. government level waned during the decade of the 1980s. However, state and local units of government took over the lead and produced a large number of successful projects. These led to the incorporation of CPTED into local building codes. Design review ordinances have been modified to require the use of CPTED in building design. Several state governments have passed legislation and developed new regulations governing the design and management of schools and the convenient food store industry. The states of Florida, Virginia, and Kentucky have taken the most steps by passing legislation and actively conducting training for the public and private sectors.

The National Crime Prevention Institute at the University of Louisville created the first CPTED training program in 1985. A design studio was created to assist in the teaching of CPTED concepts. This program has been attended by thousands of participants who have spread the use of CPTED concepts in their communities around the world. The content of this training program formed the basis for the 1991 book, Crime Prevention Through Environmental Design: Applications of Architectural Design and Space Management Concepts, by Timothy D. Crowe. This book—and its second edition (March 2000)—is the most widely used manual for CPTED at the present time in the United States.

The American Institute of Architects conducted the first national CPTED conference in December 1993. The U.S. Conference of Mayors conducted a National CPTED conference in June 1995 to report on the results of their nationwide survey of mayors. This survey documents the extent to which local governments have implemented CPTED concepts.

Results of CPTED

There are many case studies, which demonstrate reductions in crime and fear of crime. Significant results have been produced in many settings, including residential areas, convenience food stores, malls and shopping centers, transit stations, and parking structures. Journal and newspaper articles have reported on these successes.

Descriptive studies have reported on historical relationships between crime and the environment. The U.S. Department of Justice has published a number of bibliographies and documents about these observational studies. Small to medium-size cities have also reported on considerable crime and fear reductions directly attributable to CPTED traffic management strategies.

Statistical results are too numerous to list here, but it is clear that much documentation exists. Moreover, the historical basis of CPTED makes the success of these concepts self-evident. Following is a sample of the many success stories that have resulted from contemporary uses of CPTED concepts:

The Need for CPTED

Profit, productivity, and quality of life are compelling reasons for the use of CPTED concepts. A key element in the CPTED planning process is to develop clear behavioral objectives for spaces. This leads to improved decisions regarding design and use techniques. Civil liability provides a legitimate excuse to use CPTED concepts, that is, if improved profit, productivity, and quality of life are not enough. The U.S. Department of Justice has issued guidelines for the use of CPTED concepts to protect businesses from wrongful death or injury litigation.

The recent case law in general and premises liability has increased the responsibilities of property and business owners. Liability has been extended to architects, engineers, lending companies, and security contractors, when a wrongful injury or death suit is filed. Parking lots have been found by courts to be inherently dangerous, which means that an owner or operator is liable even when there have been no prior incidents. Likewise, the isolation of restrooms by location and by design has been determined to be inherently dangerous. The standard by which a property owner or operator is judged is based on proof of due diligence or having done all things reasonable to prevent injury. Employee, owner, and customer convenience is perhaps the greatest obstacle to maintaining safety and security in retail environments. More accidents and victimization are caused by the defeat of good security practices due to inconvenience than any other hazard. It is worse to have procedures that are not followed than to have none at all.

New properties and operations are held to a different standard than existing ones. The designer, planner, and owner of a new property or operation will be held accountable for conscious decisions that affect the propensity for subsequent injury. Accordingly, a final decision about the design and use plan for a property must be defensible. The opinions of a recognized expert in the substantive area of the loss, peril, and hazard establish proximate cause, which then makes injury foreseeable.

The so-called test of reasonableness that is the backbone of civil liability allows for the support of many factors in making conscious decisions. Aesthetics, mission, life safety, accessibility, feasibility, and environmental factors are weighed in the final determination of the adequacy of a property owner’s or manager’s duty and responsibility in the care and protection of the users of space. This is why CPTED has become so important to the civil law, because it allows for the blending of good aesthetics, profitability, and safety.

The Future of CPTED

CPTED in the 21st century will emulate the lessons from the past. The first decade has already been a transition period heralding an explosion of technological and space management advances in the use of the environment to promote behavior that is desired and conducive to human existence.

CPTED is a self-evident concept, which has been used successfully for the past 40 years. It has confirmed what many people think—that it is just good, common sense. The greatest impediment to the widespread use of CPTED is ignorance. Many people have never heard of CPTED. Some of the few who have heard of CPTED have attempted to exploit it, without developing an understanding of the concept. Others have attempted to pass off CPTED as another fad that will go away with time.

Note: For additional information on the role of CPTED, see the April 1996 issue of National Institute of Justice, published by the U.S. Department of Justice, Office of Justice Programs, discussing CPTED as applied to parking facilities and to premises liability.

Crisis Management

CAS, JHC

The time that crisis management will be required cannot be predicted; hence, the key to successful crisis management is preparation and planning for that eventuality.

Since retailers operate businesses which have members of the public on their premises during business hours, as well as employees during both business and nonbusiness hours, it becomes vital that plans exist to minimize injury to both customers and employees, as well as to protect the other assets of the business during emergency situations.

The start of the preparation process is the formation of a crisis management team and the formulation of their mission and responsibilities.

The purpose of a crisis management team (CMT) is to have a designated group of individuals who, in the event of a major emergency or crisis, are empowered to make decisions and authorize extraordinary action on behalf of the corporation. In general, a crisis exists whenever there is a business-related clear risk of life or grave personal injury to a company employee, a member of his or her family, or a customer or other person, or when some disastrous or calamitous event occurs which disrupts the essential processes of the corporation and threatens its ability to function.

In the event of a crisis, the CMT may be activated by any member; those immediately available from the total membership will then form the CMT.

Because of the extraordinary authority to act independently in the event of a crisis, and the potential for civil liability and/or just plain “finger pointing” based on any actions taken by the CMT, it is essential that the individuals comprising this group be of very senior rank, including the Chief Executive Officer (CEO), Chief Operating Officer (COO), Chief Financial Officer (CFO), Chief Security Officer (CSO), Executive Vice President (EVP), and other senior vice presidents. Both the senior HR person as well as the senior civic affairs or publicity person should be included, since many anticipated actions will involve personnel decisions and/or the need for press releases. Corporate counsel should be included on an ad hoc basis.

A final key component of the CMT (although not a decision-making member) is a recording secretary. From the moment the CMT is activated, the secretary (or someone else in his or her absence) should begin making minute-by-minute notes of the various decisions and actions of the CMT and any factors (such as recommendations by an expert) prompting such actions. A portable battery-operated audio recorder is a valuable aid in keeping such a record.

The CMT should be unfettered to the maximum possible extent in the exercise of their extraordinary responsibilities. However, because reliance upon expert advice is a defense to charges of unlawful or negligent conduct in such matters, early and continuing cooperation with appropriate law enforcement or other public safety agencies should be part of the CMT’s operating procedure, recognizing, however, that normally the CMT will be responsible for the ultimate decisions made.

In any crisis, communications assumes paramount importance. With this in mind, the establishment of a predesignated message center is mandated. Such a message center should also have an alternate location should the primary location be within the area of the emergency and unavailable for occupancy. Whenever the CMT declares a geographically large area as within the emergency zone, a pre-established toll-free (800) number should be activated for emergency use.

The CMT should have primary responsibility for

Finally, the CMT should be responsible for a post-event review to determine any weaknesses in pre-emergency planning and making recommendations for corrections to and/or modification of existing plans.

Types of Accidents/Injuries

When the topic of customer accidents is brought up, slips and falls come to mind. These may be the most common types of accidents, but retailers need to be mindful of other causes, such as

Purpose of Investigating

Why did the accident occur? What was the cause? The more detailed, the better. Any and all information can be used to help prevent future injuries. A thorough investigation can often limit the company’s liability and can expose fraudulent claims. But what I’ve found to be common is to find the truth in a claim that has been overly exaggerated from what actually happened. Detailed accident investigations will help lower a company’s annual loss.

Investigative Steps

So, you’ve been notified that an accident or injury has occurred. What now?

Step One: Speak with the injured person. I’ve always encouraged my loss prevention agents to always carry a pen and notepad while on the sales floor. That way, they can respond immediately without having to search for a notepad. Besides, showing up at the scene with a legal pad and clipboard could signal to the customer that this is a more serious situation than he or she thought. Your first duty is to make sure that the customer doesn’t need any medical attention. Listen carefully to his or her entire side of the story; then ask any open-ended questions that will help fill in any gaps. Next, ask the customer if he or she would like to make a report. If so, pull out your pen and notepad and jot down the customer’s name, phone number, address, age, date, time the accident occurred, exact location, and note the type and condition of shoes. The type or condition of shoes could be an important cause of the fall.

Step Two: After you’ve spoken with the customer, locate any possible witnesses. The witness could be an employee or customer who happened to be in the area of the accident. If the witness is a customer, get his or her side of the story, obtain his or her phone number, and ask if he or she may be contacted if any further information is required. If the witness is an employee, have him or her write a statement on a legal pad and sign it.

Step Three: Secure the scene. This will ensure that no other customers will be injured and will also protect any evidence of the accident. Immediately take pictures of the area using multiple angles. Every loss prevention or safety department should have a digital camera of at least 3 megapixels. This is enough to allow you to enlarge an image without degrading the clarity. A standard 35 mm camera will work as well; however, development and enlargements will have to take place offsite and could take up valuable time. Most of the time you will not have to bother with a tape measure at the scene. Most stores use tile flooring that is 1×1 foot in size and will allow the investigator to make approximate measurements.

Step Four: Compile your data. Now that you’ve collected the necessary information, write a narrative of your investigation starting with your interview with the customer. Do not quote the customer within your narrative. You should use another part of your report for the customer’s statement. On the report form, include your narrative, customer statement, accident scene observations, and the customer’s biographical information that you obtained during your interview. Print and attach photographs of the scene and save the photos to a disk to be included in your accident file or separate storage area. During this process, you should also search your store’s camera system to see if it captured the accident. If any video is captured, immediately copy this to disk or tape. Finally, contact your company’s insurance company or risk management department. Let them know at that time if you’ve captured the accident on tape or if you suspect that the accident claim is fraudulent or has been exaggerated. Also, if the accident was caused by a product or display fixture, hold it as evidence until risk management or the insurance company has given you permission to dispose of it.

The work you put into each investigation will serve you for some time to come. Accidents should be reviewed monthly with management. Discuss how these situations could have been prevented and implement these ideas to prevent further accidents.

Introduction

Let’s start with general cyber crime statistics. The following are some indications of the seriousness of the problem.

Identity theft has become of major concern to people. And they are right to worry, as indicated by the following statistics. A survey conducted by the Federal Trade Commission (FTC) in 2006 estimated that 8.3 million American consumers, or 3.7% of the adult population, became victims of identity theft in 2005. Most of the financial losses are suffered by credit issuers and banks, as victims are rarely held responsible for fraudulent debts incurred in their name; however, victims often bear the responsibility of contacting their banks and credit issuers after an identity theft has occurred. The same FTC survey determined that victim consumers spent over 200 million hours in 2005 attempting to recover from identity theft. (2)

Even the period of time between when a computer comes online and when it is probed for vulnerabilities has shrunk. An example is found in a study from a major cybersecurity research center. Researchers took an out-of-the-box Linux PC without any special features, connected it to the Internet, and did nothing to announce its existence. The attacks started almost immediately.

Cyber crime has evolved over a relatively short period of time. Starting in the 1980s, some of the early crimes were often unsophisticated, involving methods of guessing, stealing or “social engineering” passwords, gaining physical access to machines, or relatively easily bypassing security controls. As this form of crime advanced, criminals learned how to misuse the technology in order to gain access to computer resources, services, and information. That stage of evolution involved hackers and others who were familiar with vulnerabilities of systems and the use of social engineering to manipulate authorized users. When increased protections were implemented by information security professionals, intruders expanded their illegal activities to cover a larger range of damages, such as distributed denial of service, virus destruction, and scanning of a user’s remote access to their organizations.

Currently, there are widespread malware intrusions, including spyware and spamming, while others seek to take advantage of users by means of phishing and identity theft. As wireless communication has grown, attacks on wireless devices have become more frequent. Some of the newer attacks are automated, attention is being directed toward drivers, and thumb drives have become useful crime tools. (5) (6)

There have also been increases in the impact of cyber crimes, creating damage to companies, customers, and the larger society. These damages are like pebbles thrown into water, expanding out from the initial point of contact. There are direct and indirect costs involved with a publicized unauthorized incursion into a company’s system. Research findings on these costs indicate that retail firms which have been attacked are penalized financially as well as in terms of customers’ willingness to continue to shop with them.

The lessons are quite clear. Technology has become a major tool for criminals. They can attack retail companies, targeting them for money, stock manipulation, ransom, trade secrets, customer lists, competitor espionage, or entrance to the larger financial complex within which the company operates. The damages can be severe and may lead to such drastic events as the bankruptcy of companies.

Cyber Crimes in the Retail Industry

Whether it is called “computer crime,” “data crime,” “information protection,” “cyber crime,” or countless other terms, the issue discussed is how computers and other high-tech devices are used to gain unauthorized use of information and other assets. The term used here will be “cyber crimes.”

These crimes are unique from earlier retail security problems. There are three major new aspects to these crimes that make them so distinctive:

Retailers face increased competition and difficulties in making profits. Cyber crimes are causing the industry to have to decide on how best to survive this additional problem. The cybersecurity discussion to follow will indicate the fundamental choices that will have to be met.

Cybersecurity in the Retail Industry

Some recent retail computer crimes provide us with important lessons about the need for cybersecurity. TJX, BJ’s Wholesale Club, and DSW are not the only retailers that have had security difficulties, but their very public problems appear to be leading to the creation of additional laws and regulations over how a company processes and protect data. As indicated in the Sarbanes-Oxley Act and Gramm-Leach-Bliley Act, business violations are leading to cybersecurity becoming a requirement that has to be met in order to be in compliance. Similarly, since retailing is a global activity, cyber crime and cybersecurity-related laws in other nations also have to be met.

Retail cybersecurity must develop an approach that is most appropriate for its environment. A major complication, however, is that changes in cybersecurity may run counter to the ways that security has been treated in the industry to date. IT and cybersecurity professionals and a growing number of C-level executives have accepted the view that security is no longer a technical problem but is an enterprisewide approach to business issues.

The result of this important transformation is that basic security concepts have shifted. The network of concern is no longer simply the hardware, software, and infrastructure. It is now viewed as the people, processes, and business units. Rather than viewing a major technical requirement as protecting the perimeter boundaries of the organization, the enterprise requirement focuses on matters of privacy and asset protection. The assets that a firm must protect are more than the desktops, laptops, servers, and databases. Now, in the enterprise view, the most important assets are customer data, employee data, and communication of information. Finally, technical matters are no longer the responsibility of IT and system administrators. Rather, technology and security are enterprise core competencies. (10)

These changes in retail cybersecurity affect how technology must be treated. Many of the newer retail services that are profitable are the result of technological innovations. Technical products and processes offer large opportunities and retailers must use their technology to its fullest. And, under-protected technology may indeed have an impact on that survival.

Technology has a dual use: providing new approaches to store profits as well as opening up opportunities for criminals to drain profits from these companies. If we examine several of the major advantages of technology for creating profitable environments, a parallel list can be drawn of how cybersecurity enhances those same technical features. Given that customers are central to the retail experience, we will emphasize the customer-oriented nature of technology. Certainly, cybersecurity has to be carefully applied so that it will not become counterproductive to the friendly shopper message of retail today.

Table C-7 indicates the contributions that a secure technology can provide to retailers. The technology itself can assist with attracting and gaining customers, but a secured technology will contribute significantly more to improving those efforts.

Table C-2 Security as Value Added to Customer Centered Technology

These points apply to all aspects of the retail process. The process can be highly effective in anticipating and creating customer interest in particular products and services. International order fulfillment can be established, and monitoring of inventory can change the ways that prices are set. Stores can be opened online, and product presentations can be individualized to be based on a customer’s prior purchase patterns. Instantaneous payment is possible, and new profit centers can be established. Updates can be sent to customers with frequent purchase plans creating buyer loyalty.

At the same time, the process can expand the risks. For example, when a company connects to its partners and suppliers in the supply chain, the company potentially opens itself up to the security weaknesses of those involved in these relationships. It is the weak link theory applied on the global level.

Core Features of a Retail Cybersecurity Program

As mentioned earlier, a number of laws and regulations require security in organizations. In essence, those requirements point to elements of a cybersecurity program that companies should initiate. An additional feature of these requirements is that senior executives must sign off on reports that indicate the presence and the adequacy of those requirements in their organization.

Due to the centrality of credit card transactions, retailers have been encouraged and even pushed into accepting the Payment Card Industry Data Security Standard. The PCI DSS spells out the details of security that must be in place and can serve here as one model of the needed elements of a cybersecurity program.

As Dubin points out, “PCI DSS is not groundbreaking; it is simply a set of information security standards no different than those at any large bank or publicly held corporation. But it has molded security throughout the credit card industry lifecycle, from how banks issue cards to how retailers accept them.” (11)

In total, there are 12 PCI DSS-required controls. They cover access management, network security, incident response, network monitoring and testing, and information security policies.

Additionally, these 12 controls are grouped together under 6 PCI DSS “control objectives.” They include:

These are the essential elements of a cybersecurity program. The elements are basic features that are found in many other industries but found less often in the retail world. As has been indicated here, there is a large price to be paid by businesses that do not follow these fundamentals.

TJX is the poster child of the price to pay. That company had stored old account information instead of deleting it. The company thus violated a PCI requirement, which mandates that a company remove data it no longer needs. During the breach, hackers stole an undetermined number of credit card accounts, some of which dated back to 2003. As a result, dozens of banks reported incidents of fraud from the compromised cards. There seems to be little doubt that TJX will be punished financially, it will lose customers, and its public reputation is in shambles. Unfortunately, TJX will not be the last retail company to discover that it is less expensive to prevent cyber crimes than to detect them.

Conclusion

The retail industry is struggling through a period of uncertainty. New forms of meeting customer demands and competition from a variety of sources have led to a complex playing field. Technology has added its own complexities, creating new possibilities for profit making as well as new opportunities for criminals. Today’s retailers have little choice in deciding whether to have adequate cybersecurity. That question has been resolved by legal and customer pronouncements. How cybersecurity programs will be integrated with business needs will turn out to be a major determinant of which companies will succeed and which will fail.