Risk Management in Security and Loss Prevention

Almost anything of value may be stolen, given someone’s desire and opportunity. All organizations face a certain amount of risk, some departments or functions are much more prone to theft or fraud than others. It is essential to determine how much risk is acceptable and how to manage cost-effectively the risk while meeting the organization’s strategic and operational objectives. In March 2009, the ASIS Global Standards Initiative published the American National Standard ANSI/ASIS.SPC.1: Organizational Resilience: Security, Preparedness and Continuity Management Systems—Requirements with Guidance for Use. Over the years, this standard was implemented and submitted to ISO, for consideration as an international standard. Today, the management systems standard is globally in use and, applying the Plan–Do–Check–Act model, focuses on security, preparedness, and continuity management. It looks at how an organization can prevent, prepare for, mitigate, respond to, and recover from a disruptive incident that could turn into an emergency, crisis, or disaster. This report will be built following the standard previously introduce, to identifying the main causes of incongruences (that are recorded with Net and Gross Adjustments) between physical and virtual inventory. Working within Loss Prevention team, the focus of the analysis will be on shortages. First, the principles and concepts of Risk Management will be introduced to understand which are the key concepts to making organizations successful in delivering their objectives whilst protecting the interests of their stakeholders. Second, will be realized a flow chart of the operations for every process in the Fulfillment Center, to analyze the actual structure risk management and to deeply Know the Organization to establish the context in which the risk assessment will be designed. Third, to give a measure of the lost, to understand which are the departments where are registered shortages and which are the main items lost, it will be performed a quantitative data analysis related to thefts of the three quarters of 2018. This short period was decided because processes change continuously and oldest data would not have been consistent with the flow chart previously described. To conclude, the Risk Assessment will be realized using the Preliminary Hazard Analysis (PHA). The risk will be classified by considering likelihood and severity to determine overall risk level; detectability is not explicitly included in the risk calculation. The output of the risk assessment is a monitoring program based upon the identification of the critical control points (CCPs) applicable to the system under review. The resulting monitoring program serves as a structured detection plan focused on active monitoring of the most critical, and therefore the most vulnerable, points in a process. Detection is an output, rather than an input. Analysis, based on applying prior experience or knowledge of a hazard or failure to identify future hazards, hazardous situations and events that can cause harm, will be performed within the following steps: 1)??Threat Evaluation: identification and evaluation of the possibilities that the risk event happens, depending on the type asset to protect and the threat scenario; 2)??Risk Level Calculation: relative ranking of the hazard using a combination of severity and likelihood of occurrence; 3)??Mitigation Action: the identification of possible remedial measures.