Loss prevention personas - From firefighter to intelligence-led strategist

Loss prevention personas: from firefighter to intelligence-led strategist

Loss prevention personas are the practical output of new ECR research into how retailers decide where crime risk actually sits. The Retail Crime Risk Models study by Professor Emmeline Taylor of City St George’s, University of London, found maturity across the sector to be uneven. Retailers have models for health and safety, and for business continuity. For crime, a great deal of the industry still runs on experience and instinct.

That gap used to be a resourcing problem. It is now also a legal one. Foreseeability is appearing more often in litigation, and a retailer that cannot show why it put a security officer in one store and not another is in a weak position. A crime risk model turns that into a defensible decision, in both directions: it justifies the spend where risk is high, and it justifies removing cover where risk is low.

The research sets out five indicators of maturity, reframed as five red flags, and a self assessment tool, published with the report, that scores a business across all five and places it on a four-point scale: the firefighter, the reactive investigator, the analyst, and the intelligence-led strategist. Emmeline talks through the two ends of that scale in the episode. The tool also allows a business to sit at different points on different measures, which is the usual result. More on the wider picture at the retail loss, safety and security hub.

The full conversation follows.

How retail crime risk models drive loss prevention decisions: Colin Peacock and Emmeline Taylor in conversation

COLIN:

Welcome to the Sell more, lose less podcast. This week I am with Professor Emmeline Taylor and we’re going to go through some new research that she’s been doing for ECR. It’s around risk models.

Now in many ways, you could and should see risk models as almost chapter one of loss prevention, because in my mind at least you need to know where crime is being disproportionately happening, or even have some sort of foreseeability. So my expectation when we first started this research was there’s going to be a lot of risk models out there. There’s going to be a lot of rich learning about what’s a good risk model, what’s a bad risk model, how they’re being used, how they’re being validated.

And so when we produced these results, they were a bit surprising to me in some ways. And I’m going to let Emmeline take you through that. We have got something here that I think is pretty practical, and a way for retailers to start thinking about their own risk models and maybe looking out for a roadmap for improvements.

But hey, let’s hear about the research. Emmeline, thank you for joining us. And what is this research all about?

Two-thirds of retailers have no crime risk model

EMMELINE:

Thank you, Colin. So this project around risk modelling is really a follow-on from a couple of recent projects, thinking about most at-risk stores, fortress stores. And one of the questions that really emerged from those projects was how do you know where to invest your finite resources, whether that’s your people, your training, your interventions, your technology?

And overwhelmingly, there was some surprise because many retailers don’t operate with a retail risk model for their crime. They might have risk models for health and safety, they might have them for business continuity, but when it comes to crime, they didn’t necessarily have what could be defined or described as a risk model. So much so, sixty-eight percent of those who engage in this project don’t have an established crime retail risk model.

And another figure for you, more than one in four have no modelling whatsoever. Now I was astounded by that. And they cite cost, resources, concerns around their data integrity, and also some participants saying we don’t really know what a crime risk model is, or what are the benefits. It sounds like a lot of work. So that was the premise of the project.

And then moving on from that, what we then tried to establish was, okay, so those of you that do have a crime risk model that you think is credible, robust, and it’s driving really important internal decisions, what goes into it? What makes this a credible piece of information that is data driving those decisions? And we were able to find five indicators of maturity.

And that was around the data that goes in, both external and internal. It was about the range of decision making that it fed into, and how it was respected within the business beyond LP and asset protection. And then it was also about the frequency of the data refresh, so that it wasn’t always just looking backwards. It could also have some predictive capability.

And so it was really driving that, that we turned those five indications of maturity into five red flags. So as with most ECR Retail Loss projects, it’s actionable. So there is a benchmarking tool so any retailers can then assess their business against those five red flags or indications of maturity, and then see where you sit. What’s the persona of your business when it comes to managing and mitigating around retail crime risks?

COLIN:

I’m going to come back to that. That sounds quite intriguing. I’d like to know what those red flags are.

But first of all, you started off by saying that two-thirds don’t have something in which to plan out. You’ve got one hundred thousand pounds to spend on CCTV cameras. If you haven’t got a risk model, I guess it’s whoever shouts the loudest. Is it… I don’t know… every new store? I don’t know.

But there’s two other pieces that I seemed to pick up and felt from the research that were coming out here. Often it’s not, oh, lucky loss prevention leader, you’ve got a million dollars to spend on cameras. It’s more like, well, you’ve got a million now, but you’ve only got five hundred thousand now. So you can’t have the security guarding budget that you want. It’s got to come down by fifty percent. For me, how would you do that without a retail crime model?

And the second piece that perhaps worries me a bit more is that increasingly in this age of litigation and others, there’s a sense of responsibility that you know where crime is happening and you have some sort of science behind foreseeability. And so for those two reasons alone, plus the ones you gave, it’s astonishing, this two-thirds number.

Foreseeability, litigation and defensible decisions

EMMELINE:

Absolutely. And I know I’ve relayed this anecdote to you before, but I had a very insightful conversation with somebody who was now working in LP, having moved over from law enforcement. And I asked this question at a conference: how do you know where to deploy your resources? You’ve got over 2,000 stores. And he said to me, hey, I don’t need a weatherman to know which way the wind blows. Now, any music fans listening will know it’s a Bob Dylan lyric, his brilliant song.

But wow, this really got to the bones of that many LP practitioners do use gut instinct. They use experience in the field. And whilst those are really important elements to actually be able to sense-check things, that’s great. But we live in a data-rich world, and when you have a spread of stores, a large estate across multiple locations and geographies, there’s absolutely no way you can be across the environment of every single store. And so why not lean into the data? Why not use that to have that level of predictability?

And you’re absolutely right. There’s two things here. One is around foreseeability. We’re seeing that far more increasingly in litigation cases. Could that store reasonably predict that there would have been a serious incident that happened there? And if you don’t have a risk model, well, the answer is, well, not really, and that is going to create problems.

Flip side is, you could say, yeah, we knew that was a high risk store, and look at the suite of interventions that were then implemented to mitigate that risk. That stands up far more solidly in a legal challenge. And there’s that defensible decision making, and that can also feed into the emotions of the store associates. We know that many employees love to have a security officer. But if your risk model confidently suggests that an area is low risk, you can then take that decision to perhaps remove a security officer, and it’s a defensible decision, and you can communicate that to the store. So there’s loads of benefits, both internally but also externally, about how you can manage your portfolio of stores in this defensible and objective way.

COLIN:

We’ve had many examples over the years of store incidents that get onto the news. I can’t imagine the CEO of a company being interviewed by CNN or the BBC, saying, well, it was a terrible incident that happened at the store. Why didn’t you have a security officer? How was your risk modelling? And the answer coming back is, well, it’s like a song.

EMMELINE:

Yeah.

COLIN:

The weatherman.

EMMELINE:

Gut instinct told us we didn’t need one.

COLIN:

Yeah. Well, hopefully the producer of the podcast here is going to do a nice little interlude to make this look really very professional and surprise us all. But no, that’s fascinating. Let’s go to these red flags then, please. Let’s go through them. What are they?

The five red flags in a crime risk model

EMMELINE:

So first of all is that you’re blind to the outside world. And what we mean by this is that you don’t have comprehensive external data being fed into it. As a criminologist, I am more than aware that there’s only so much that you can control within your four walls. There’s a whole big world outside there, and there may be things like unemployment rates, demographics, indices of deprivation. We know that those social and economic factors can drive criminality.

But we also know there’s things in the built environment as well. So this may be transport hubs, for example. We know offenders love to zip in and then be able to get away very quickly from where they’ve committed a crime. So there’s these both static factors and dynamic factors that can potentially impact on how a store performs, that is completely out of control of the people that operate in that store.

But then there is internal data that can also inform how high risk a store might be. Some of that relates to crime, and the absolute number one data point that those with a risk model utilise is past incidents. So, how much theft do we get? How many violent incidents? How many burglaries, robberies, et cetera? But there’s also other internal data which potentially could correlate with risk, and that might be things like how many staff you have, how well trained they are, how long they’ve been in position and their experience, what are your trading hours? Are you open twenty four seven or do you close at six p.m.? We also know that those internal data points are really interesting to at least explore and see whether they correlate with crime.

Another red flag is that the model just sits in silo, that it’s only being used by the LP function and them alone. I think this has a place across the business. We need to have early conversations around new stores opening, acquisitions. There’s operating decisions that might be more to do with merchandising or HR or IT. So a really effective crime risk model sits beyond the LP function.

COLIN:

We had a great example, didn’t we, of finance, when you’re doing tests of a new idea, a new intervention. Let’s use the risk model to do match stores, rather than just how many sales they’ve got or how many front doors. So, sorry, I did cut a question there, but this point about don’t let it sit in silo is so important.

EMMELINE:

So important. And that’s what we found from the fortress stores project as well, wasn’t it? It was really about having that multi-cross-functional engagement with risk.

COLIN:

Well, we spent time with some retailers and we’ve looked at the assortment that turns up in some of these very high risk stores and thinking, Jesus, this is not an area where you want to sell a thirty pound bottle of olive oil.

EMMELINE:

Yeah, exactly.

COLIN:

And it’s just temptation.

EMMELINE:

Yeah, completely agree. So having those conversations across the different functions is so important. And you would hope that a robust risk model is respected by those functions, possibly in a way that sometimes just raises a concern that isn’t as evidenced with data perhaps gets lost, but with a really robust crime risk model, you would hope that it lands the point in a really objective and evidenced way.

Now the fourth red flag is around testing and validity. So I know there’s some crime risk models out there that have had a huge amount of work put into them, but they’re perhaps not quite measuring what the people using it hope that it’s measuring. And there’s several reasons why this might be the case. One will be the complexity of statistics and understanding the weighting of different variables. So that it might be stacked with high frequency but low impact crimes such as low level theft. And there’s no weighting of those very violent or high impact, low frequency events. So they get lost in the mix.

But we also know that some variables might essentially be measuring the same thing. I mentioned unemployment and deprivation earlier. They might need to be combined, otherwise you’re overweighting that as a variable. So there’s lots of ways that it can be tested, validated. One of the ways we talk about in the report is where you get these legal challenges. Has your risk model actually been through a court of law and put to the test? And there’s some participants in this project where that is exactly what has happened, and it’s enabled them to have confidence, even more confidence, in their risk model.

Now the fifth red flag is around that dynamic refreshment of data. I think the early iterations of risk models were very much about looking at the past, trying to explain what has happened, and then that will guide decisions. We’re moving towards a world where dynamic data is more real time, it’s refreshed more frequently.

I will just counter that with a really important point, and that’s that there may be two types of decisions coming out of a crime risk model. One is tactical, day to day. What are we doing? What are we seeing? How are we going to react? The other is strategic. And so that might be fine to refresh your data on an annual basis, because you don’t want to be chasing your tail and changing a strategy midway through. But this refreshment of data is really key so that you’re not only ever looking back retrospectively, you’re actually making proactive decisions about what’s coming next, what’s on the horizon.

Loss prevention personas: from firefighter to intelligence-led strategist

COLIN:

And you make a really good point about this, and it’s something that we’re going to be working on in the future, around how these risk models can be almost the foundation, the cornerstone to your LP programme, because everything kind of flows through an understanding of the level of risk by location, which is fantastic. So we do people, and we have got this new format, if you like, sort of self assessment tool. Just tell me a bit about that and where people can go and take the test, if you like, and what sort of personas we can create from that.

EMMELINE:

Yes, we got such great feedback on the maturity benchmarking tool for the fortress stores project. And so very similar to that, we’ve developed a self assessment tool to look at what is your loss prevention persona. And this could be anything from, there’s four different personas.

The first, or perhaps most basic, is the firefighter. So the firefighter only ever responds, puts out the fires as they occur. They’re busy. It’s a stressful position to be in because you can’t see what’s coming. You have no time to sit back and reflect. So the firefighters work really hard, but they never get ahead of the curve.

Now at the other end of the spectrum is what I’ve described as the intelligence led strategist. Now that persona is around using a crime risk model as the foundation of their approach to LP. So they understand the environmental factors, the socioeconomic factors that drive crime, but they also understand how that interplays with what’s happening within those four walls. And more so than that, they understand what levers they can pull, the suite of interventions that they can utilise to respond to each of their issues.

Now because they’ve got this robust and objective data in place, they’ve got the ear of the C suite. They’ve got the respect of HR and IT and merchandising, who listen when they say, look, we might have a problem here unless we mitigate in this way. Or why don’t we try something new in this store? So the intelligence-led retail crime strategist is in a really great place, because they’re utilising the data rather than just gut instinct to be able to win those conversations, to have the deployments that they need in the right place where they are most needed.

COLIN:

Wow. Fantastic. And that’s available on the ECR website. So you’ll be able to find that and the reports. Emmeline, thank you so much. Looking forward to working with you on the training that I think comes out of this around loss prevention, sort of foundational training around retail crime management, intelligence retail crime management. But for now, thank you very much indeed.

EMMELINE:

Thanks, Colin. Awesome.