Introduction

Prevention of crime in the workplace typically is the sole province of the security professional. In the retail sector, internal dishonesty and shoplifting offenses are the primary loss prevention concerns of in-house or contracted security agencies. Aside from those occasions when advanced technology needs to be adopted or mystery shoppers employed, external consultants are rarely used in the typical retail establishment’s loss prevention efforts.

Workplace violence is a unique concern in the retail environment. While industrial facilities and many service businesses can establish basic perimeter defenses against suspected threats, the retail establishment’s need for open access creates vulnerabilities not seen in other industries. The unrestricted environment of the retail sector allows both the general public as well as former and current employees (some of whom may have hostile intent) to closely approach intended targets.

Because of the unique demands of workplace violence prevention efforts, the retail security professional needs to be aware of the specialized and generally accepted principles of Threat Assessment and Management (TAM). This approach blends the expertise of the security professional with those of other consultants. In this section, we discuss how psychological and security professionals, working closely together, can add value to a retail organization’s efforts to reduce the risk of workplace violence due to disgruntled employees or known outsiders.

A Special Loss Prevention Problem

Traditionally, loss prevention investigators have had the task of gathering evidence relating to a known crime that has already occurred, or one that is believed to be already occurring. In those cases, either normal reconstructive or constructive methods will be applied. The who, what, where, when, why, and how aspects of the process of investigation will guide the investigator to collect and present evidence that can be used to justify appropriate action. In the private sector, the goals of loss prevention, economic recovery, and employment termination are typical, whereas in the public sector, the goal is normally the bringing of criminal charges.

There is, however, one kind of investigative problem that differs significantly from these norms. This type of investigation centers on the problem of targeted violence and has received increasing attention in the past 20 years. The relevant questions are not merely “What happened?” or “What is happening?” Rather, they are “What is likely to happen in the future?” and “What can be done to prevent it?”

The approach that has developed since the early 1990s is known as Threat Assessment and Management, or TAM. For our purposes, we will concentrate on the application of TAM to workplace violence prevention because this is an area of frequent occurrence in which loss prevention professionals can make important contributions. Therefore, knowledge of workplace violence is essential.

Types of Workplace Violence

There are generally considered to be four categories of workplace violence.(1) They are

The first two types of violence will tend to be addressed through normal crime prevention strategies and are typically investigated in a post-incident or reactive context. These violent incidents tend not to involve perpetrators who are targeting specific individuals for violence. One example is the convenience store or gas station robbery, an act whose criminal motive is not violence, but monetary gain. Another example is the outburst of anger that a drunken patron may direct at a bartender. This type of outburst is known as affective violence and is typically an immediate emotional reaction to a stressor, devoid of criminal motive.

In the last two categories, there is much more likely to be a specific individual who is being selected for violent victimization by the perpetrator. This is known as “targeted violence” and is the kind of violence that frequently exhibits a number of warning signs. If those warning signs are properly detected and assessed, they can give the organization the opportunity to steer the situation away from a violent outcome.

This kind of violence will tend to be what is known as predatory violence, which is violence that is planned, purposeful, and emotionless. The perpetrator will engage in behavior that is akin to hunting the intended victim(s) and may provide clues to intentions, methods, and targets prior to an actual attack. It is in these situations that TAM is intended to be used. Our focus will be on predatory violence relating to type II, III, and IV workplace violence.

Threats

The topic of threats is an area in targeted violence prevention that carries great potential for misunderstanding that leads to ineffective action or overreaction. In many organizations there exist workplace violence policies that prohibit employees from making verbal threats against others. The statement “I’m going to kill you” will generally be understood as a threat, and action will be taken. Consider, too, the statement “Unless something around here changes, people are going to get hurt.” Is that a threat or not?

The ambiguity involved in these situations requires refinement. The term “threat” tends to be used in two ways:

Another term we will use here is “instigator,” by which is meant a person who has either made a threat or poses a threat to the targeted victim(s).

Red Flags

It should be clearly understood that there are no reliable profiles that can be of meaningful use to TAM practitioners. No set of attributes will be present in all those who perpetrate lethal targeted violence. Likewise, the absence of those attributes should not be taken as a signal that the instigator does not pose a danger to a particular target. For these reasons, “profiling” is not a responsible approach to take when considering potential targeted violence.

Some factors have been identified in cases involving targeted violence that do bear attention. Organizations should train supervisors and employees to be aware of these red flag items.

If they are present, the red flags should not be used to conclude that a danger is actually posed. In fact, in the majority of instances, individuals who exhibit one or more of these items never will carry out, or even desire to carry out, targeted violence.

The presence of the red flags should signal to the organization that some level of assessment should be performed to determine whether further concern is justified. Only after an adequate TAM process is completed is it wise to specify appropriate action by the organization. In many cases, TAM investigation will determine that the person of concern lacks the grievance, violent ideation, inclination, means, or preparation necessary to carry out an attack.

Employees should be encouraged to report the red flags (or any other reasons that cause them concern) to the TAM team with the understanding that no negative action will be taken against the person of concern solely on the basis of their report. To do otherwise may make employees hesitant to share information at an early stage when there still exists ample opportunity to address the situation while the instigator is still capable of being diverted.

TAM Teams

TAM is a complex undertaking that has the twin objectives of determining whether the current situation is apparently moving toward a violent act and specifying a set of measures the organization can undertake to divert the instigator away from violence.

The practice of creating specially trained teams has arisen to provide the talents of a multidisciplinary group to both sort out the complexities and handle the numerous tasks associated with quality assessment and planning in the high-stakes endeavor of targeted violence prevention.

These teams are known by a variety of names. They may be called threat management teams, incident management teams, threat assessment teams, crisis management teams or go by any number of “committee” names. In any case, the teams will often include TAM-trained representatives from the following parts of the organization:

In addition, someone in the management chain above the affected employees will often be included so that the team has sufficient information regarding the day-to-day operations of the relevant department.

Certain outside consultants will often be contacted to assist the team in its assessment and planning duties. Some such consultants may include

Finally, the TAM team should be headed by a manager with the authority to fully commit the organization’s resources to the effort and expense necessary to take meaningful protective measures immediately upon determining that they are essential. This TAM team leader should make the final decision on the organization’s response if the team cannot reach consensus. If either the authority to proceed or sufficient decisiveness is lacking in this key person on the team, undue delay, inaction, and very possibly physical harm may ensue.

The Role of the Psychologist in Threat Assessment and Management

Many experts in the field of workplace violence risk management suggest that mental health professionals, particularly psychologists, should be available as consultants to TAM teams.(5) Inclusion in this process acknowledges the necessity of having a better understanding of the mental status of the instigator, and the critical role that psychologists serve in acquiring and using this knowledge.

Psychologists are typically used by TAM teams in one of three capacities: background consultants, co-interviewers, and referral resources. In each capacity, the right psychologist can add value to the TAM effort by sharing their knowledge of mental illnesses, risk assessment, diversion techniques, and community treatment resources.

The Fitness for Duty Evaluation as an Investigatory and Diversion Method

The primary goal of TAM processes is to acquire sufficient information to increase the probability that instigators might be diverted into nonviolent courses of action. For those instigators who are employees of organizations, the fitness-for-duty (FFD) evaluation provides a method for not only data acquisition, but also for diversion.

After the Employer Decides: Monitoring the Status of the Instigator

After receiving the fitness for duty evaluation and also reviewing other consultant reports (e.g., legal and security), the employer ultimately determines whether to retain or terminate the employee. It is our view that this is only a decision that can be made by the employer, and we offer no direction to the employer on this issue. What we do provide, however, is a range of management options that are individually tailored to the needs of each situation and dependent on whether the employee/instigator is ultimately discharged or retained.

In a retention situation, the instigator typically requires a range of treatment options that may include one or more of the following: hospitalization, anger management, psychotherapy, medication, assertiveness and communication skills, or substance abuse treatment. The results of the TAM-FFD can be used by the employer to justify conditions of continued employment including referrals to various programs. While treatment providers can be invited to examine the TAM-FFD report, we urge caution about releasing a copy of the report to the provider if the employer has concerns about the contents of the report being seen by the employee. Once released, the report will become a permanent part of the instigator’s treatment file, subject to his review and permanent possession. It is our experience that instigators are unlikely to view their own TAM-FFD with objective detachment.

Some employers may ask, “Why not just make the treatment referral ourselves and save the money on the evaluation?” It is our experience that a comprehensive assessment allows for better case management. For example, a quick and simple organizational referral to, say, an anger management program may miss the complex treatment needs of the instigator. Furthermore, merely sending the instigator to a psychotherapist will not lead to a complete identification of the treatment needs. Rarely will the instigator self-identify all the factors leading to a referral and his own failings that need psychotherapeutic attention. An examination of the TAM-FFD will allow the therapist to better understand the client’s situation.

Monitoring compliance with TAM-FFD recommendations is a role frequently performed by the Employee Assistance Program (EAP), the employer’s counseling and referral resource. The EAP consultant can review the TAM-FFD and meet with the employee to review conditions of continued employment. The EAP can then monitor the instigator’s compliance with the programs and ultimately communicate with the employer about return-to-work readiness. On particularly complex cases (e.g., involving methamphetamine-induced persisting psychosis), the second author has suggested a second, return-to-work FFD, following completion of all treatment. Some employers may feel reassured when their TAM-FFD psychologist makes a final assessment of the employee’s readiness to return to duty.

In a discharge situation, the employer may consider the advantages of providing financial security and other benefits to the employee who will be terminated. We typically consider approaching the instigator with a package that includes incentives for him to “move forward” and disengage from his employer. Severance agreements typically include several months of continued salary, medical insurance (considered important so that the instigator can access treatment), and outplacement counseling.

Meeting the goal of disengagement requires that the ex-employee minimize or refrain from contacting the company. Sometimes the discharge agreement specifies that only one person in the organization (typically in HR) is designated as a contact point, either for the instigator or sometimes limited to only the instigator’s spouse. Alternatively, we have employed the services of the TAM-FFD psychologist as the contact person. Having previously developed a relationship, the ex-employee may see the psychologist as a comfortable conduit to the former employer. Using the psychologist as the only liaison also helps to sever the perceived bond between the employee and organization, thereby facilitating the separation process.

An additional role that can be employed by the TAM-FFD psychologist is to monitor the progress of the ex-employee. Regular telephonic contacts can assess the instigator’s perception of the helpfulness of the outplacement counseling, any problems in finding a new job, and whether the instigator appears to be coping and disengaging from the former employer.

In functioning in this monitoring role, it is important that the psychologist clarify that he is acting as a consultant to and liaison with the employer. The instigator must know that there is no confidential communication and that the consultant’s job is to assess “how things are going.”

Functioning in this role, the second author has had occasion to suggest modifications of the termination package, such as a longer period for outplacement counseling. Maintaining contact with the instigator also allows for feedback to other providers about the effectiveness of their interventions. For example, after one instigator had difficulty in finding a new job, it became evident that his interview skills needed polishing. A telephone call to the outplacement counselor served to alert the counselor to this need.

TAM Countermeasure Planning

If the TAM investigation substantiates a concern that a legitimate threat is posed by the instigator, certain countermeasures or other actions must be planned.

The key question for the TAM team process is simply, “What can we do to promote safety for the target and others in this situation?”

Unfortunately, the retail environment poses certain security problems not encountered in most office or industrial environments. In a law office, for example, all the working staff can be placed within secure space, and each visitor can be individually screened before being admitted. In insurance companies, all claimant meetings can be placed in a common set of rooms or booths situated outside the secure office space. In a factory, high perimeter fencing, gated driveways controlled by a security access booth, and rolling gates can substantially impede instigator access to targeted individuals. Retail store space is specifically designed to be inviting to the public and must allow visitors unimpeded access to the entire sales floor, other customers, and the majority of employees. In addition, the employee parking areas for retailers tend to be openly accessible to the public, so attacks in these areas are relatively simple to accomplish.

Retailers also have the added burden of loss of public confidence if a worst-case attack is accomplished in one of its retail stores. If a mass murder occurs in the factory where autos are manufactured, the public does not automatically relate it to any personal danger. If a similar attack is successful at a retail location, the resulting television coverage can have wideranging negative impact on the store’s branding efforts.

The TAM team cannot plan only short-term, immediate safety steps. While some factors, such as improving access control to the workplace, may be of immediate priority, the team should understand that the instigator may be a lasting problem for the target and entire workplace.

In light of the fact that physical separation of the targets from the instigator may not be achievable by barriers, locks, and traditional access control measures, the retail TAM team must consider relocation of the targeted employee to another store. In some cases that relocation may require that the employee agree not to tell friends, family, or associates where the new store is located. In extreme cases, the employee may even have to be relocated to another city or state. Depending on the severity of the threat situation, the employer may wish to negotiate a relocation and employment termination agreement with the targeted employee.

Certain long-term, and expensive, measures may be necessary. For instance, a short-term solution may be to have an armed security officer in the parking lot of a convenience store or at the entrance to a mall store. At the same time the retailer’s loss prevention department can ask the mall security department to be on the alert for the instigator. The store staff should be given particular instructions on what to do if the instigator is observed near the store, in the parking lot, or mall security advises that he is nearby. A long-term solution may be the transfer of the targeted staff to other stores. Some retailers, due to the size of their operations, may have the ability to transfer the targeted individual to stores located in other cities or states, effectively hiding the target from the instigator. Even after the period of immediate threat has passed, these security enhancements can continue to provide benefit by making workers feel safer in the workplace.

The TAM team must look at all major components of the problem in addressing possible solutions. The TAM team should ask itself, “What can be done to affect the situation in which the instigator operates to reduce the likelihood of an attack?” Likewise, the question “What can be done to alter the expected event to reduce the likelihood of violence?” should also be answered. Finally, the team should address the question, “What can be done with the target (person or site) to reduce the likelihood of an attack?”

The TAM team should not be afraid to be creative in its approaches to the problem. While it must be cautious, it can often determine solutions that fit the complexities of the situation well if it is willing to think “outside the box.”

Examples of this kind of thinking might include using the services of an FFD professional. Based on the results of the assessment, the organization may consider referring the instigator to anger management training, psychological counseling, and psychiatric treatment. If the instigator is willing but not able to afford the training and other services, the organization may consider funding these programs. Further, if the instigator is going to be terminated, and it is known that he is concerned for the long-term treatment of his child’s chronic disease, should the TAM team recommend a separation package that includes continuation of medical plan benefits for a certain period paid for by the organization? Also, if the target’s current workplace is well known to the instigator, should the organization consider a transfer for the target to another branch or even another city?

In addition, the TAM team should realize that most organizations cannot afford to “go to war” with the instigator. If an organization is pushed, it may fire the instigator or threaten a lawsuit. If an instigator is pushed, he may commit mass murder. He possesses offensive options that organizations simply cannot use.

Provocative, punitive, prosecution-based solutions will rarely net the enhancement in safety that the organization requires. It is often difficult for organizations to put aside an adversarial posture when dealing with instigators. Such actions tend to increase the intensity of the conflict with the instigator, not reduce it.

The TAM team should seek disengagement from the instigator, not further entanglement in lawsuits or criminal actions. While doing otherwise may satisfy an organization’s desire to somehow obtain “justice,” such pursuits will rarely provide a lessening of the safety problem. The instigator may not initially commit a serious criminal act that will lead to long-term incarceration. Making misdemeanor prosecution a centerpiece of countermeasure planning may only increase the likely danger. Courts will only be able to impose moderate sanctions at an early stage, which are unlikely to reduce the threat posed in a meaningful way. A series of arrests for minor offenses or being dragged through prolonged litigation initiated by the organization may simply add to the instigator’s reasons for viewing himself as the victim of injustice. He may then feel warranted in escalating his responses to this perceived provocation.

Having the instigator escalate to a stage where serious criminal justice sanctions can be employed is precisely what the TAM team should be working to avoid.

TAM Reports

The TAM team should attempt to express, preferably in writing, its combined opinion on the state of the situation as it relates to whether the instigator appears to intend violence, is capable of carrying out that violence, and has engaged in pre-attack behaviors. The assessment should detail the methods used in obtaining the information and reaching the opinion, including any input received from outside consultants, researchers, and investigators. The assessment should also provide details of the information that persuades the TAM team that the situation is moving toward or away from violence.

The TAM report must also lay out the recommended steps the organization should take to prevent a violent outcome.

It is important to note that the TAM report and the assessment upon which it is based are both valid only as long as the underlying situation remains unchanged. As such, it is a “snapshot” in time which documents conditions as they were at a particular moment. Threat situations are extremely dynamic, constantly changing as new events occur. Therefore, new assessments and management plans also may need to be evaluated in light of these new events or when previously unknown information comes to light.

For example, if the instigator brandishes a firearm on day one, threatening to shoot his estranged wife, the assessment may be that the situation is one of high risk. If the instigator is taken into police custody on the morning of day two, the assessment may be downgraded only to shoot up again in a few hours when the instigator is released on bail. In a similar vein, if the target leaves town for a week to vacation at a location unknown to the instigator, the assessment of danger will probably lower, while it may rise upon the target’s return home.

Any TAM report must inform the reader that the assessment is subject to immediate change upon new developments or information. It should also identify any information limitations and assumptions included in the assessment.

Case Study: A Threat in the Warehouse

The regional human resources manager of a multinational corporation phoned the first author on Monday afternoon saying that a warehouseman fearfully reported to her a threat by a delivery driver to shoot a supervisor who rescheduled the driver to start his day two hours later than before. They worked at a small branch operation 300 miles away.

The HR manager was authorized by the corporation to engage our TAM services. A temporary TAM team was formed that included two individuals from out of state: a corporate security manager and a psychologist retained for TAM services by the corporation’s national headquarters. The regional HR manager and the authors rounded out the team.

While the corporate officials traveled across the country, the first author discretely interviewed two workers who provided information about the instigator, “Tom”:

The team, including the corporate officials, met on Tuesday evening. The HR manager confirmed from company records that Tom’s health insurance covered his wife and that it was widely known that she could not work due to illness. Several members of Tom’s family had died at young ages, and he was afraid to die and leave his family destitute. Early contact with low-ranking police officials netted a directive to call “if something bad really happens.”

It was decided to directly contact the chief of police that night. The corporate security manager placed the call, informing the chief that there was a grave situation which had called him and the corporate psychologist to town, but that he was hesitant to discuss it on the phone. The chief agreed to meet the following afternoon.

Early the next morning the TAM team flew to the small town and secretly met with the local branch manager at a local hotel. He was shocked by the information the team had developed, but believed Tom was capable of carrying out the threat. Later that day the team briefed the police chief and his senior commanders. They pledged their cooperation, and one commander was assigned as liaison. The police believed Tom could have access to guns.

It was decided that Tom needed to be quickly removed from the workplace and armed security officers placed at the warehouse as soon as he knew he was being suspended. The TAM team wanted to get possession of his guns and allow the two psychologists to interview him at length. Obviously, the physical security of the psychologists during any meeting was paramount.

Flying home that night, the team discussed how to ensure Tom was not armed during the intervention meeting. Passing through the airport security checkpoints produced an idea. On Wednesday morning, the team had the HR manager telephone Tom at work and tell him that he was to fly to the regional headquarters to participate in an employee focus group over the next 2 days. He would stay at a hotel paid for by the company. He agreed.

On Thursday, the HR manager picked up Tom at the airport. Tom carried a small bag, which he had carried aboard the plane. Having passed through airport security, we were certain that he was not armed.

Meanwhile, we arranged for a provider of armed security guards to have two officers posted at the warehouse each day from 5:30 a.m. until 7:30 p.m., covering all hours that staff was at the site.

The psychologists and corporate security manager waited at the interview site, which included a conference room outfitted with covert audio and video monitored by two armed security officers in a nearby room. The first author’s investigators coordinated all the diverse parts of the plan.

Upon Tom’s arrival, the HR manager introduced him to the security manager and the psychologists. During the course of the next 4 hours, the psychologists spoke with Tom, assessing his attitudes, willingness to follow direction, and introducing him to the idea of his suspension. He was persuaded to allow the police to search his residence and vehicle for weapons. The first author coordinated with the liaison police commander, who dispatched a team of detectives to Tom’s house. They met with his wife and, after conducting the search, took away a number of weapons. Tom agreed to meet with a psychologist in his town who had previously been contacted by the second author. When he flew home Friday, he was calm, had explained the situation to his wife, and understood that the company was going to continue its inquiry into his actions and complaints. He accepted the fact of his suspension (with pay and benefits).

The armed security presence remained in place for a few more days, until it became clear that Tom was continuing his sessions with the psychologist, and a determination was made that he no longer posed a significant threat. The second author kept in phone contact with him on a regular basis, monitoring his progress and attitudes toward the company. He also conferred with the treating psychologist to confirm Tom’s compliance with his treatment plan. A few weeks later, Tom agreed to separate from the company and accepted a settlement package that provided a small amount of severance pay, extended family health coverage, and provided for the services of an outplacement firm. At last report, Tom had embarked on a new career, with different attitudes about work and coworkers.

This case study illustrates perfectly how a well-ordered response to a frightening initial informant report, using a multidisciplinary team and the threat assessment and management process, can move a potentially violent situation to a safe outcome. The investigative professional can fulfill a crucial role in that team, but only if he understands the proper methods and goals of TAM.

Conclusion

TAM investigations are becoming increasingly important for loss prevention professionals to master. The opportunities for coworker dispute, employee terminations, or even domestic violence to create real danger for the workplace through targeted violence are incalculable. The stakes can be extremely high, and the complexity of each situation must be carefully considered.

The retail loss prevention profession must take seriously its duty to protect employees from targeted violence. TAM is the set of actions, if learned and carefully employed using all the resources available to the employer, which minimize the likelihood of a catastrophic event occurring in the retail workplace.

As the specialized approaches used in workplace violence threat scenarios have become more widely adopted, the loss prevention practitioner is provided with the chance to divert, delay, redirect, or disrupt situations that might otherwise escalate to lethal violence.

While the threat may be forestalled today, the instigator may someday return. As such, these cases are rarely considered fully closed. They may become dormant for a while, but as long as the instigator can focus on the target and is at liberty to mount an attack, the situation will probably bear long-term monitoring.

We have found that, when an integrated approach is used and security professionals and psychologists work together, better outcomes can be achieved than when the professions work separately. Simply put, using such an approach creates a safer and more promising future for both the instigator as well as the rest of the workforce.(14)

Data-Driven Security

It has been argued that security is more of an art than a science. While that belief is generally true, the business of security is not an art. The security department is a business unit, not unlike other business units within a company that must justify their existence. The higher security moves up the corporate ladder, the more challenges the security director will face and the more business acumen will be required. A commonly accepted business paradigm is what cannot be measured cannot be managed. With the exception of shrink rates, the acceptance of this paradigm within retail security is not far reaching. No longer can retail security professionals rely solely on gut instincts. Data-driven security refers to using measurable factors to drive a retail security program, and one of the tools for allowing data to drive a security program is a threat assessment. Too often recommendations from the security department are presented with little or no thought as to why certain procedures or security equipment should be used. Often, the reason for deploying a security measure is that other companies are doing it. It is all too common in the security industry for there to be a propensity for using certain security measures without complete understanding of the problem or a thorough analysis of the security measure’s ability to be effective given the specific situation. Threat assessments can help retail security directors overcome this problem by identifying key concerns. How can security professionals justify to senior executives a sizable and usually growing annual security budget? By now, most security directors are keenly aware that a security program’s success depends on the commitment and support, or “buy-in” as it is commonly known today, of senior executives. Using anecdotal evidence to justify spending on physical security measures and costly protection personnel no longer suffices. A data-driven security program helps management understand that security is more than a must-have expense; it justifies costs to management by showing the proof of success that, when presented effectively, can garner the necessary buy-in from upper management and demonstrate a convincing return on investment. Security expenditures, just like other departmental budgets, need to be justified with empirical data and supplemented with cost-benefit analyses and comparisons.

Security Metrics

Threat assessments are also helpful in developing security metrics, which communicate vital information about threats to the retail stores and drive decision making. Metrics for various security components, such as the protection force or access control system, can be an effective tool for security professionals to understand the effectiveness of the overall security program. Metrics, as previously discussed, may also identify risk based on failures or successes of security components and can provide solutions to security problems. Security metrics focus on the results of security decisions such as reduction in thefts after implementation of a closed-circuit television (CCTV) or an electronic article surveillance (EAS) system. Security metrics help define how secure we are. They assist retail security professionals in answering basic questions posed by management, such as

Baseline measurements are often difficult to obtain, especially in the business of security where companies are, out of necessity, secretive about their protection systems. In recent years, security industry associations such as ASIS-International, the National Fire Protection Association (NFPA), and the International Association for Professional Security Consultants (IAPSC) have promulgated standards, guidelines, and best practices. In addition to published and accepted industry standards, the courts have outlined baselines of measurement for the security industry. An example of this is a Texas Supreme Court case, Timberwalk v. Cain, which outlines the specific factors necessary for establishing foreseeability of crime in premises liability lawsuits. In Timberwalk, the court set forth five criteria for measuring the risk of crime including recency, proximity, publicity, frequency, and similarity of past crimes. The professional security practitioner will stay abreast of industry standards and the law. While laws must normally be reasonably followed, security professionals may fine-tune published industry standards to meet the needs of their company.

Asset Identification and Existing Security Measures

All security programs, regardless of their complexity or industry application, are designed to protect assets, and generally speaking, assets are anything of value. Generally, assets consist of people, property, and information. A retail company’s assets include customers, employees, products sold by the retailer, and the supply chains and support services for getting the product to store shelves.

Asset attractiveness should also be considered in the threat assessment. Certain assets and businesses have a higher inherent threat level because of their inherent attractiveness to the criminal element. One example is electronics stores. Despite no previous crimes at a particular electronics store, the threat level for thefts of MP3 players is still high. The threat exposure is there, but the vulnerability need not be.

Existing security measures may include security personnel, physical measures, and policies and procedures. Security personnel include people specifically designated or indirectly working toward the protection of assets. Uniformed security officers would be the most visible and recognizable example of security personnel. Others may be involved in the protection as well who are not as easily identified, including undercover shoplifting agents, security managers dressed in business attire, and clerks trained in crime prevention. Physical security measures may include a range of low technology items such as barriers and curbing to high-tech measures such as closed-circuit television (CCTV) cameras, biometrics, and fencing. Physical security measures may also include items not visible to the naked or untrained eye, such as pressure mats and alarm sensors. Policies and procedures are written documents which relate directly to asset protection and guide the security program. Security manuals and security post orders are examples of policies and procedures.

Asset + Threat + Vulnerability = Risk

“Risk” is a commonly misused term, often used interchangeably with “threat.” Risk is basically a function of threats and vulnerabilities. In essence, risk is the possibility of asset loss, damage, or destruction as a result of a threat exploiting a specific vulnerability. Since threats are the focal point of this section, it is important to understand how threats impact a retailer’s assets. As you can see Figure T-2, reducing one of the factors that cause risk can reduce losses. A comprehensive security program attempts to limit all three in an effort to reduce risk to an acceptable level. Vulnerabilities are reduced through the application of security measures; assets are reduced to a level needed for business operations, with excess product stores in offsite warehouses; and threats are reduced through prosecution of shoplifters, proactive policing, and other methods.

FIGURE T-2

The retail security professional’s strategic goal of countermeasure deployment is to reduce the opportunity for security breaches to occur by reducing vulnerabilities. Opportunities relate to targets in that removing or hardening an asset will lead to a reduction or an elimination of vulnerabilities. Asset protection programs integrate a combination of policies and procedures, physical countermeasures, and security personnel to protect assets against a design-basis threat. The characteristics of asset protection programs include deterrence, detection, delay, and defeat.

Controlling the capability and motivation of adversaries is a difficult proposition for retail security professionals. Motivation is created by the actual crime target and is considered the reason for security breaches. Since businesses usually require assets to operate, the removal of motivation is not always possible. Most retailers must instead turn their attention to blocking the opportunity of crime.

Threat Assessments

As discussed previously, threat assessments are evaluations of human actions or natural events that can adversely affect business operations and specific assets. Historical information is a primary source for threat assessments, including past criminal events, while real-time information is also being used with increasing frequency due to its availability in some arenas. Threat assessments are used to evaluate the likelihood of adverse events, such as robberies and assaults, against a given asset. Threat assessments can be quantitative or qualitative. Crime analysis is a quantitative example of a threat assessment. Retail security professionals use threat assessments as a decision-making tool that helps to establish and prioritize safety and security program requirements, planning, and resource allocation. The process of threat assessment includes

Threat Information Sources

Retail security professionals should endeavor to seek out all possible sources of threat information. Threat information should come from multiple and redundant sources. Depending on the nature of the assets in need of protection, the sources of threat information may include internal information, security breach investigative reports, law enforcement data, security consultants, media news reports, and industry associations, such as the Food Marketing Institute (FMI), National Retail Federation (NRF), and Retail Industry Leaders Association (RILA). Among the basic questions that retail security professionals ask are

Many retailers also maintain internal records of security incidents, breaches, and crimes. This information should be reviewed by retail security professionals on a regular basis while looking for trends and patterns that might indicate existing threats or point to a vulnerability that can be solved with remedial measures. External threat information should also be reviewed. This includes crime data from the local law enforcement where the facility is located. This is known as crime analysis and will be discussed in depth later in this section. Other external sources include private threat specialists.

Assessing Threats

After collecting, reviewing, and summarizing threat information from all available resources, retail security professionals must apply the threat to specific assets. Critical assets are the primary concern during the assessment; however, other assets may also be considered during the assessment phase. The goal of the assessment then is to estimate, quantitatively or qualitatively, the likelihood of occurrence that a threat will attack an asset.

Because of a lack of quantitative data, scenario-driven, qualitative assessments are appropriate for high-value assets that have suffered no prior attacks. A qualitative threat assessment is defined as a type of assessment which is driven primarily by the threat’s characteristics and are highly dependent on the assessment team’s skills. The threat assessment team or individual, using a qualitative approach, considers each asset in light of the given threat information for that asset and develops scenarios that may be used by adversaries to estimate the likelihood of attack. Using a qualitative rating system, the threat assessment team assigns a linguistic value to each scenario.

Accurate threat assessments are critical for retail security professionals; however, not even the best threat assessment can anticipate every possible scenario, including the addition of more assets. Criminals always adapt to and overcome updated countermeasures. In today’s world of technology, state-of-the-art countermeasures are outdated at an increasing pace, and criminals usually move at a similar pace. Retail security professionals should keep abreast of the latest threat information using the best available sources of information. Using the threat information sources discussed previously and adding to them where possible will assist in keeping the security professional abreast of the latest threats and the assessment report up-to-date.

Threat Dynamics

Everyday crimes, rather than terrorism or natural disasters, are the most common threat facing retail security professionals in protecting their assets, and a thorough assessment of the specific nature of crime and security breaches can reveal possible weaknesses in the store’s current security posture and provide a guide to effective solutions. A full understanding of everyday crime’s dynamic nature allows retail security professionals to select and implement appropriate countermeasures to reduce the opportunity for these incidents to occur in the future. Thus, the following section focuses on the dynamics of everyday threats, identifying their key elements, and how to analyze these elements to block specific threats. The retail security professionals should be well versed in a number of threat dimensions before selecting countermeasures. As conceptually outlined previously, these dimensions include

Situational elements are those characteristics of the retail store that create an environment which is more or less conducive to certain types of crimes or security violations. For example, a shopping mall may suffer more from auto thefts in the parking lot than the average number in the community due to the number of targets (customer cars) in a small area. Another example of situational elements affecting crime may be the proximity of the facility to escape routes such as dense fields or wooded areas that can be used to conceal the offender on foot or quick escapes via highways used by the criminal in a motor vehicle. Situational elements also include the nature of the activities that occur on the property. Businesses face different problems than residential areas. The type of business that is conducted on a property may attract more crime. Jewelry stores, for example, maintain two types of attractive assets: large amounts of money and small, easily concealed property. While retail stores’ primary concern is usually shoplifting, an analysis of past crime data may reveal other threats that may not be evident. For example, a retail store that has a history of car-jacking robberies and assaults of customers may only be fully known by reviewing internal security reports or police crime information. Stores with high levels of auto thefts can narrow the field of targets by using threat assessments and crime analysis to determine which cars are more prone to theft.

Criminal motivation and capability are key to understanding the nature of crime on the property. Criminals, more often than not, are rational decision makers capable of being deterred or enticed to commit their acts. In modern criminal justice, it is widely accepted that certain people can be generally deterred from committing crimes given swift and severe punishment. Specific deterrence measures can be taken at the property level by introducing countermeasures that increase the risk of detection. For example, the presence of an EAS system or closed-circuit camera systems (CCTV) may deter many criminals. By the same token, people may also be encouraged to commit crime by providing them with ample opportunity and a low risk of detection. The criminal’s capability must also be considered by the retail security professional, whose goal is to reduce encouraging elements and increase the risk.

A criminal’s ability to select specific targets is a process by which the rational criminal will select the easiest target that provides the highest reward. Criminals also select targets where the rewards are high. Malls, for example, provide ample auto theft opportunities for the perpetrator who specializes in stealing cars. Target selection can be thought of primarily as a force of opportunity. The goal, then, for retail security professionals is to reduce the available crime opportunities at the facility.

Opportunity reduction strategies address the characteristics of the store that either encourage or deter crime. Each store will be different in terms of the solutions that are effective because each property has its own unique characteristics and unique threats. Unfortunately, what works at one store may not work at a similar store in a different geographic area. Opportunity reduction strategies may take the form of enhanced policies and procedures, physical security measures, or security personnel. Though the focus of this section is on cost-effective solutions to everyday crime concerns, you should not feel limited to using what is discussed herein, but rather are encouraged to be creative in your search for appropriate solutions for your particular concerns. While this section is not intended to be comprehensive in addressing every possible threat, it will endeavor to cover the more common crimes that affect many facilities. Retail security professionals are encouraged to study in depth the particular crimes that have historically occurred at their facilities.

Robbery

Robberies are a big concern for most retail security professionals and adversely affect business in a number of ways, including injuries, loss of property, negative reputation, and liability. There are two primary types of robberies: robberies of people and robberies of business. Shoplifting escalation (shoplifting incidents which legally escalate into robbery with the introduction of violence or force) and retail holdups are business-related robberies, and personal robberies include carjacking, purse snatching, and mugging.

A store’s situational characteristics which contribute to a robbery-prone environment are easily identified by experienced retail security professionals once they understand the precise type of robbery impacting the property. Poor lighting, hiding places, and unprotected assets provide ample opportunity for personal robberies. Poor employee training, unfettered access, and easy escape routes can create an environment prone to business robberies. Among the better security concepts developed in recent years is improved parking lot designs at retail stores and shopping malls. Additional curbing has been used to control the flow, direction, and speed of traffic, all of which create a deterrence to robbery and other crimes by creating obstacles to a robber’s escape from the property.

Robbery target characteristics depend on the nature of the robbery. Purse snatchings obviously require an unaware female holding a purse, while carjackings are limited to areas where cars can travel or park. Why does a convenience store experience more business robberies than another convenience store located across the street? Perhaps poor lighting and store windows cluttered with signs at the robbery-prone location are factors.

A robber’s motivation is typically a rational balancing of risk and reward. If an asset is valuable (high reward) and unprotected (low risk), the probability of attack increases. Jewelry stores are susceptible to robbery because of the high reward for perpetrators. As such, jewelry security professionals institute various strategies for protecting assets. Capability is dependent on the type of robbery executed. Jewelry store robberies take more skill than purse snatchings.

What does a robber look for in an attractive target? Regardless of the type of robbery, targets are rarely selected randomly. Obviously, the balancing test of risk and reward is a factor. Purse-snatch robbers seek out unaware women to target, with the reward being higher in higher socioeconomic areas.

Robbery opportunity reduction strategies vary with the type of robbery occurring on the property, but generally increased physical security measures, enhanced natural and artificial surveillance, and security personnel provide protection. Retailers may implement silent alarms or install bulletproof glass to protect against robbery. Convenience store owners may remove obstructive signs from windows to increase surveillance both into and out of the store. Often, simple and inexpensive changes in policies and procedures can have a positive impact on robbery reductions.

Theft and Auto Theft

Similar to robbery, there are many types of thefts. Situational elements at a facility are a primary determinant to the types of theft which occur. Retail stores are prone to shoplifting, while large parking structures experience auto thefts and burglaries of motor vehicles. Each year the automobile insurance industry releases data on the nation’s most frequently stolen cars and trucks. While it might surprise some readers that BMWs and Mercedes don’t make the top-10 list, it won’t surprise most security professionals. Other cars, such as Hondas, Toyotas, and Chevrolets, are easier to hide among the masses, are more easily fenced, or are more easily parted out for use in other cars. These characteristics lend certain cars to auto theft more than BMWs and Mercedes. What characteristics of your assets make a target more attractive? Cigarettes are a good target for young men, hence their location behind the counter in convenience stores.

The motivation and capability of thieves are subject to the risk-and-reward balancing test. Grocery stores, for example, often suffer from high levels of baby formula and over-the-counter drug thefts because of the high value of both items. These items are often turned over to a fence, or middle man, who will pay decent amounts to the thief and then sell the items back to the retailers. The capability of a thief is limited only by his skills and creativity. Some thieves work alone committing petty thefts, stealthy thieves may be pickpockets, and organized thieves may band together to commit larger thefts.

Normally, what a property owner finds valuable about an asset is also the same characteristic that a thief finds attractive. Jewelry is a good example, since it is valuable and easy to conceal because of its size. Financially motivated thieves will seek assets which they can later sell for a profit. Personally motivated thieves will steal assets which they can personally use, like drugs or expensive basketball shoes.

Opportunity reduction strategies for theft range from simple to the most complex, from moving an asset out of sight to installing vaults, alarms, and camera systems. Auto theft reduction may take the form of simple alarm systems to monitored tracking systems. Some grocery stores have taken to storing baby formula and over-the-counter drugs in locked cabinets. Clothing retailers have used electronic security tags (EAS) to prevent their clothes from being shoplifted. Here again, it is incumbent upon the retail security professional to fully understand the type of theft experienced at the facility to implement appropriate countermeasures.

Regardless of the retail crime experience, the threat assessment will help identify the problem qualitatively or quantitatively. While most retailers use a quantitative approach, a quantitative approach is much better for their needs given the vast amount of crime data available in the retail environment. It should be noted that the biggest failing in threat assessments is a lack of specificity. This is the key shortcoming of demographic social disorder models, which is a qualitative approach. Crime analysis, on the other hand, is a quantitative threat assessment approach and is as simple to implement as the qualitative approach.

Crime Triangle

Reducing the opportunity for crime to occur is a strategic goal of retail security professionals. The reason for this is the concept of a crime triangle, whereby three elements must exist for a crime to occur:

With little or no control over a determined offender’s desire, retail security professionals focus their attention on the remaining elements of the crime triangle by attempting to block opportunities and remove motivation, both of which can be controlled to a large extent by an effective security program. Motivation is created by the actual crime target. In the private sector, a criminal’s motive is the asset(s) that the security program is created to protect. Here again, assets include people, property, and information. Since organizations usually require assets to operate, the removal of motivation is a difficult task, if it is possible at all. Most businesses must instead turn their attention to blocking the opportunity of crime. The crime triangle is a simple yet effective method for illustrating how a crime can be prevented. As you can see in Figures T-3 and T-4, blocking opportunities for crime leads to a reduction in crime.

FIGURE T-3

FIGURE T-4

Purpose of Crime Analysis

Sir Arthur Conan Doyle, in his Sherlock Holmes mystery A Study in Scarlet, wrote, “There is a strong family resemblance about misdeeds, and if you have all the details of a thousand at your finger ends, it is odd if you can’t unravel the thousand and first.” It is on that basic premise that crime analysis is based. Whether a security professional is working proactively to address security concerns or reactively in litigation or during the investigation of a crime, crime analysis is an effective tool. From a security perspective, crime analysis is the identification of risk and vulnerability, and from a liability prevention perspective, crime analysis is the determination of foreseeability. Broadly speaking, crime analysis is the logical examination of crimes which have penetrated preventive measures, including the frequency of specific crimes, each incident’s temporal details (time and day), and the risk posed to a property’s inhabitants, as well as the application of revised security standards and preventive measures that, if adhered to and monitored, can be the panacea for a given crime dilemma (see Vellani and Nahoun).

While the preceding definition of crime analysis is holistic, it can be dissected into three basic elements:

Examining crimes perpetrated at company facilities is commonplace in today’s business environment. In larger retail companies, there may be a person or group of people who are solely dedicated to the function of crime analysis usually working under the risk management or security departments. In smaller retail companies, the crime analysis function is carried out by someone who also has other security management duties. Crime analysis may also be an outsourced function, whereby company personnel simply utilize crime data that a contractor has collected, entered into a database, and possibly provided some analytical workup or the tools to do so.

The second element is the analytical component. Crimes are analyzed in different ways depending on what security professional is trying to accomplish. Most commonly, facilities are ranked based on the crime level or rate. Generally, facilities with more crime or a higher crime rate are given a larger piece of the security budget, whereas less crime-prone sites are given less security money. Crimes are also analyzed on a store-by-store basis, allowing retail security professionals to select appropriate countermeasures. The various types of crime analysis methods are discussed in depth later in this section.

Finally, crime analysis is used to assess and select appropriate countermeasures. Crimes that are perpetrated on a property can usually be prevented using security devices or personnel; however, it should be noted that not all measures are cost effective nor reasonable. Certainly, a criminal perpetrator would be hard-pressed to steal an automobile from a small parking lot patrolled by 20 security officers, though that type of security extreme is not reasonable nor inexpensive. Crime analysis guides security professionals in the right direction by highlighting the types of crimes perpetrated (crime-specific analysis), problem areas on the property (spatial analysis), and times they occur (temporal analysis), among others. Using this information, security professionals can more easily select countermeasures aimed directly at the problem.

In summary, crime analysis seeks to

Why would a retail security professional need to know how crime occurs? Understanding the factors that lead to crime, coupled with a comprehensive study of crime on the property, assists retail security professionals in creating effective security programs to block opportunities for crime. Crime analysis seeks to answer these questions:

Answers to these questions helps retail security professionals better understand the particular nature of crime on a given property and formulate specific responses. The What question tells us what specifically occurred. For example, was the crime against a person or property, violent or not, completed or attempted? What also distinguishes between types of crimes that require different solutions, such as whether a reported robbery was actually a burglary.

Where answers the location-specific question. Did the crime occur inside the walls of the location, in the parking lot, in the alleyway behind the site? If the incident occurred inside, did it occur in a public area or a controlled area? Determining the precise location assists retail security professionals in creating additional lines of defense around targeted assets. For example, if the crime analysis indicates that a vast majority of loss at a small grocery store is occurring at the point of sale, then little will be accomplished by installing a lock on the back office where the safe is located. In this example, the crime analysis will rule out certain measures, but by the same token, crime analysis will also spotlight certain solutions, such as increased employee training or updated accounting systems at the point of sale.

The When question gives the temporal details of each incident. Knowing when crimes are most frequent helps in the deployment of resources, especially costly security measures such as personnel. Temporal details include the date, time of day, day of week, and season that a crime occurred.

Who answers several important questions that help a retail security professional create an effective security program. Who is the victim(s), and who is the perpetrator? Knowledge of the types of criminals who operate on or near a given property assists retail security professionals in selecting the best measures to reduce crime opportunities.

How is the most consequential question to be answered by the crime analysis. How a crime is committed often directly answers this question: How can the crime be prevented in the future? More specific How questions may also be asked. How did the criminal access the property? If we know that a criminal has accessed the property via a hole in the back fence of the property, efforts can be taken to immediately repair the fence. Other specific questions reveal the method of operation (MO). How did a criminal enter the employee entrance of an electronics store to steal a television? How did a burglar open the safe without using force? Obviously, the list of examples is unlimited and retail security professionals need to ask as many questions about the criminal’s actions as possible to learn the most effective solutions. It is true that often the How will be the most difficult question to answer. This leads into a problematical area, as crime sources can be divided into two categories: internal and external. Internal sources of crime can be employees and other legitimate users of the space. They are called “legitimate users” of the space because they have a perfectly valid reason for attending the location, but in the course of their regular activities, they also carry out criminal activities.

External sources of crime are illegitimate users of the space whose prime motivation for coming to the site is to conduct some type of criminal activity. Security strategies may be vastly different between legitimate versus illegitimate users of space. For example, there can be several barriers between the outside public access and a specific target. If the property or retail security professional is concerned only with someone breaking into an area, then he will be ignoring the legitimate user who may have an access control card, personal identification number, password, biometric feature, or any number of other avenues of entry.

With these answers, security professionals are better armed to attack the crime problem.

Data Sources

Law Enforcement Data

Police data are the most widely used source data for crime analysis because they present an accurate crime history for a property and are from an objective source. Since police departments don’t have a stake in a company or any associated liability exposure, their crime data are considered reliable and unbiased. Though some instances of crime statistics manipulation have occurred historically, rarely, if ever, are the statistics for specific facilities skewed. Most crime data manipulation occurs to overall city crime levels to serve various political goals. At the facility level, there is little reason for law enforcement agencies to skew the statistics.

Another advantage of police crime data is the vast availability due to extensive reporting, capturing, and maintenance of the crime statistics across most jurisdictions in the United States. While costs for the data vary from jurisdiction to jurisdiction, most fees are reasonable. The only downside to police data is the time required to obtain it from police agencies, with the necessary time ranging from hours to weeks.

Various crime data and analysis methodologies have been published and used by many cutting-edge companies in the protection of assets. Crime analysis methodologies have been published and subjected to peer-review in various security and police text books, the definitive security book being Applied Crime Analysis.

Law enforcement data are almost always accepted by the courts, and in fact are sometimes required by the courts in determining foreseeability of crime. Though a particular methodology may be subjected to scrutiny, the data are normally admissible. The security professional tasked with testifying on behalf of his employer is safe to rely on crime data from police departments as long as the methodology used is sound.

Law enforcement data sources include Calls for Service (CFS), Offense Reports, and Uniform Crime Reports (UCR). These data sets are typically easy to obtain, and in the case of UCR for large geographic areas are online at the Federal Bureau of Investigation website (www.fbi.gov). Local law enforcement data are normally accessible via Freedom of Information requests or under individual state laws regarding public information. For state laws and detailed instructions, contact the state’s Office of the Attorney General.

Methodology

The best method for learning the true threat at a retail store is to analyze internal security reports and verified police data using a computer spreadsheet application or database software program, such as Microsoft Excel or Access. Once this information is in a usable format, a number of basic and advanced statistical analyses can be performed. The retail security professional will adapt the analysis to best meet the needs of his organization. While some security professionals prefer highly detailed charting and graphing functions, others prefer to view the raw numbers. Either way is fine as long as the security professional is comfortable and able to disseminate the information to those who need the data. Among the statistical tools available to the retail security professional are crime specific analysis, modus operandi analysis, crime rate ranking, forecasting, temporal analysis, spatial analysis, and pattern analysis.

The crime analysis methodology outlined in this section has been tested in the courts and in private organizations, is based on a logical foundation, and provides useful information for a retail security professional. By no means is the methodology limited to what is described, as to a large extent, retail security professionals may find that the information requires customization to meet company needs. Whatever the case, this methodology provides the cornerstone from which to build a more comprehensive analysis when necessary.

Whatever methodology is utilized in crime analysis, it should at minimum coincide with case law on issues of foreseeability so that claims of negligent security can be negated. Most states use crime data to determine if crime was foreseeable (predictable) and if management is on notice of crime. If management is found to be on notice of crime in the area or on the property, they normally have a duty to protect their invitees (customers, employees, etc.) against it. Though a foreseeability analysis is a good place to start the process of crime analysis, it certainly need not be the end. To be proactive, retail security professionals require more data analysis to efficiently track security deficiencies and deploy more effective security measures.

Courts have typically accepted 2–5 years of historical crime data in premises liability lawsuits, while for security purposes, 3 years of crime data is recommended. At this point, the Calls for Service and corresponding offense reports should have been requested and received from the law enforcement agencies, and in-house security reports will have been incorporated into the database or spreadsheet application. Though crime analysis can be conducted using paper and pen, software applications are recommended because they allow for quicker data entry, sorting, and analysis of the data. Software applications also allow users to easily create graphs, charts, and maps. A typical spreadsheet will start with keying in basic elements from the CFS and offense reports, including

Since most law enforcement agencies use different offense report forms, at first it may be difficult to ascertain each of the elements which are to be included in the database; however, given some practice with each law enforcement agency’s forms, the process is rather routine. Once all the information from the offense reports has been entered, security report information can be entered, taking caution not to duplicate entries from the offense reports. Additional codes may be created for incidents of concern to management that are not included in the UCR coding system. The crime analysis format should be versatile and expandable so that, when new data become available or when management needs change, different types of analysis may be added.

Once the data, including calls for service, offense reports, and in-house security reports for the property, have been assembled, they need to be translated into a standardized set of codes that denote actual crimes. To ease comparisons, the UCR codification system should be used because it is simplistic and other data sets already use it. If anything other than UCR codes are provided, then the crimes must be transferred to UCR codes. This is required because police reports may differ in how they are worded or coded from the norm or from one another. To simplify matters, the UCR coding system is recommended because it includes a fairly complete listing of possible crimes, which will make analysis that much more complete.

Using this main database, retail security professionals can sort information by store; by type of crime; or by date, time, or day of week. The database will also allow retail security professionals to begin performing basic calculations such as totals for specific types of crime at each site and the average crimes per site. They may also be able to discern any patterns or trends in crime types or temporally (date, time, day).

Another piece of data that should be entered on the spreadsheet is the store’s annual traffic level, which is generated from internal records. The traffic level will be used as the store’s population to calculate crime rates and trends. Traffic levels may also be calculated using transaction counts or other data which reflect the number of persons at a property. Most retail security professionals would add other people who are frequently on premises, including employees such as store clerks.

Several different types of analysis make up a crime analysis as a whole. They include temporal analysis, crime-specific analysis, crime rate analysis, spatial analysis, modus operandi analysis, and forecasting. Each of these modes of analysis examines an aspect of crime’s impact at a facility, identifies crime patterns and trends, and indirectly identifies security measures that are appropriate to counter the known risks.

Return on Security Investment

In today’s business environment, it is important for all departments to show bang for the buck, and this philosophy applies to the security organization all too much because often its budget is among the first to be cut. Showing a return on investment simply means that security measures are either paying for themselves or better, adding to the bottom line. Return on security investment is important because it helps the retail security professional justify costs and obtain future budget monies. Some security programs will not pay for themselves, whereas others actually become a profit center.

For example, crime analysis almost always pays for itself because it helps the retail security professional select the most appropriate security solutions for specific problems and efficiently deploy the resources. Without it, the effective retail security professional has little to guide him toward effective, adequate, and reasonable solutions. More expensive counter-measures such as CCTV systems and personnel are harder to show return on investment; however, over the long run, these measures become relatively inexpensive when compared to the financial turmoil that can occur from even just one indefensible claim of negligent security.

A recent case study published by the American Society for Industrial Security International in Volume 6 of its Security Business Practices Reference discussed a retail company that was able to generate a 7% savings on its projected security budget using crime analysis. To select and deploy appropriate security measures, the retailer outsourced its crime analysis needs to my security consulting firm. Using the crime data generated for each of its stores, the retailer expanded its risk model from internal security reports only to include the police crime information in assessing the threat level at each of the company’s retail stores.

Since the company’s retail stores cater to a diverse group of people and are normally the anchor stores in strip centers, a lot of the crimes reported from each store did not actually occur at the facility. Offense reports were used to verify all violent crimes to ensure that only those that actually occurred at the property and occurred as reported were included in the database.

The security department utilized a crime analysis software application to analyze the databases of crime data for each of its stores. The database includes the time and date of each crime and the specific nature of the crime that occurred. The software allows the department to quickly determine where the violent crimes occurred on the property and identify the victim. With this information, the security personnel are able to determine not only whether a store is high, medium, or low risk, but also who is being targeted—customers or the store itself. With this specific information, the security department can deploy appropriate security measures to reduce the risk at each store specifically.

By the end of their first year with this new program, the security department was able to realize a sizable return on investment. Based on the company’s 300 stores, an annual savings, or cost avoidance, of $9.2 million was gained in the first year after implementation. This savings reflects a number of changes to the retailer’s security program but primarily constitutes the redeployment of security personnel during higher risk times. Prior to this new program, security personnel were used haphazardly with no regard for actual risk levels.

Though the preceding example is tangible, most savings in the business of security are intangible and not as easy to assess quantitatively. One of these categories is the savings generated by reducing crime and thus the avoidance of security-related litigation. Regardless of a security measure’s ability to be quantitatively assessed, retail security professionals should strive to calculate a return on security investment.