Retail Crime Risk Models: The Foundation of Intelligence-led Retail Crime Control

Foreword

Across the globe, many retailers are experiencing rising and increasingly complex forms of criminal activity. At the same time, stores and supply chains are becoming more technologically enabled and data-rich, creating a significant opportunity to better understand and respond to these risks. Yet, despite these advances, much of the sector remains caught in a reactive cycle – operating in “firefighting” mode rather than taking a more proactive and strategic approach.

This report, Retail Crime Risk Models: The Foundation of Intelligence-led Retail Crime Control, examines how retailers are using risk modelling to move beyond reactive responses and towards more structured, intelligence-led decision-making. It highlights both the progress being made and the significant variation that still exists across the sector. Emmeline presents a clear opportunity to better harness data to anticipate risk and direct resources more effectively.

As with all ECR Retail Loss research, the aim of this report is to stimulate discussion and support practical action. We hope it encourages retailers to reflect on their current level of maturity and consider how risk modelling and intelligence-led approaches can strengthen their response to an evolving threat landscape. We also encourage readers to undertake the accompanying self-assessment to help benchmark their current approach and identify opportunities for development.

We would like to extend our sincere thanks to Professor Emmeline Taylor for undertaking this research and bringing her considerable expertise and knowledge to the project. Her work provides a clear and insightful analysis of how retail crime risk modelling is evolving, and the critical role it can play in supporting more effective, evidence-based crime control.

We are also very grateful to the many retailers who contributed to the study through surveys, interviews, and focus groups. Their openness in sharing experiences and perspectives has been invaluable in ensuring the findings reflect the realities of managing retail crime today.

Finally, I encourage you to not only read and share this study but also to take part in the work of ECR Retail Loss.

John Fonteijn

Chair, ECR Retail Loss Group

Executive Summary

The criminal threat facing retail has evolved rapidly in both scale and sophistication, becoming more organised, more aggressive, and more complex. Encouragingly, the analytical tools and technological capabilities available to businesses to identify and respond to these threats have also advanced significantly.

It is well known that crime is not evenly distributed in time or space. Instead, it is shaped by a combination of location-specific factors such as the built environment, population density, and store layout alongside operational factors, including trading hours, product range, and staffing levels. Adopting the premise that crime typically clusters due to a combination of these factors, the ability to identify which stores present the highest levels of risk – and determine what measures will be effective in mitigating that risk – presents a valuable proposition for retailers looking to drive down crime in a cost-efficient and defensible way. It is precisely this calculated methodology that retail crime risk modelling promises to deliver.

A Sector in Transition

Drawing on survey data, interviews, and industry focus groups, this study provides a comprehensive view of how retailers are currently approaching crime risk modelling and where gaps, challenges and barriers remain. The study attracted remarkable participation from the retail industry; we estimate that the sample represents approximately 10–12% of the global retail market, with a combined retail turnover exceeding £2.5 trillion. Collectively, these businesses are estimated to operate approximately 185,000 to 230,000 stores worldwide. The degree of engagement indicates that the sector is now focusing more on how data can assist with identifying and mitigating risk and looking for insights on how best to go about it; it is clear that there remains an absence of industry best practice and standards.

While the adoption of risk modelling in retail is growing, maturity is uneven; we found that more than two-thirds of retailers (68%) don’t have an established crime risk model; and more than one in four (27%) have none at all. Of those operating without a model, a third reported being unclear about the concept or its benefits. Barriers to adoption include limited time, constrained resources, concerns about data quality (internal and / or external), and uncertainty about how to build and apply models effectively. Even among those with self-described “established” approaches, confidence in data accuracy and completeness remains a recurring concern. The result is a fragmented landscape, with wide variation in how criminal risk is defined, measured, and acted upon across the sector.

What Good Looks Like: Indications of Model Maturity

The research identifies indicators of more mature risk modelling capability with clear differences between businesses with established crime risk models and those still developing their approach. Five key areas are highlighted: i) the breadth of external data integration, ii) the depth and relevance of internal data inputs, iii) operational and strategic use, iv) testing and validation, and v) the frequency with which relevant dynamic data is refreshed and accessed.

Overall, the findings suggest that more mature models use a wider range of internal and external data, have a strategically aware approach to refreshing dynamic data, are more likely to have been formally tested, and are embedded more deeply into strategic, operational, and investment decisions. In contrast, less developed models tend to rely on narrower and more static data sources, with more limited influence on day-to-day decision-making, and are often contained within the loss prevention function.

In short, more mature models are not just more data-rich, they are more embedded, more trusted, and more actionable.

From Data to Defensible Decision-Making

When well designed and applied, crime risk models become more than analytical tools, they can become decision engines as well as indicators of effective practice. Retailers can use them to:

• target resources where they will have the greatest impact
• avoid misdirected investment
• inform operational decisions such as staffing and trading hours
• inform and negotiate new site locations and associated costs (e.g. rent / insurance)
• prioritise sites for security interventions and technology
• allow for more robust testing of security interventions and risk mitigation strategies
• demonstrate due diligence in attempting to discern foreseeability of future criminal activity.

In practical terms, robust risk modelling can be the difference between a store that struggles to remain viable and one that can operate safely, sustainably, and profitably. Beyond this, we found evidence across the industry that credible data-driven approaches help improve engagement with senior leadership, strengthen cross-functional alignment, and enhance credibility leading to better relationships with law enforcement.

The Case for Intelligence-led Retail Crime Control

This report makes a case for a fundamental shift in approach to retail crime control: from reactive, incident-led ‘firefighting’ activity to Intelligence-led Retail Crime Control (IRCC). Inspired by developments in intelligence-led policing, and against a backdrop of Security Risk Management, IRCC is a structured, data-driven framework that uses timely and actionable intelligence to identify risk, prioritise resources, and target interventions where they will have the greatest impact.

Risk modelling and the IRCC framework is not about predicting the future with absolute certainty. It is about using data systematically to understand patterns, identify vulnerabilities, and make better decisions. In a context of rising crime, finite resources, and increasing expectations around accountability and foreseeability, this approach is essential for businesses operating in an increasingly volatile landscape.

Take Action: The Retail Crime Risk Model Self-Assessment Tool

To support the transition to IRCC, this report is accompanied by a Retail Crime Risk Model Self-Assessment tool. This enables organisations to identify their current level of maturity and benchmark their approach against four personas:

• The Firefighter
• The Reactive Investigator
• The Analyst
• The Intelligence-led Strategist

These personas reflect a clear progression from reactive response to proactive, intelligence-led leadership.

Looking Ahead: The Direction of Travel is Clear

There is clear momentum across the sector towards more advanced, integrated, and dynamic risk modelling.

Retailers are increasingly developing strategic approaches to risk built around robust, automated models capable of drawing on multiple internal and external data sources to support more defensible decision-making.

Alongside this (and at times integrated), there is growing demand for mechanisms that can deliver (near) real-time insight, enabling retailers to respond more quickly and effectively to emerging risks and time-sensitive operational challenges. However, challenges remain. Data quality, model design, and organisational capability continue to limit progress. Addressing these barriers – and building a more consistent, shared understanding of risk – will be critical to unlocking the full potential of risk modelling in the retail sector.

Retailers that embrace intelligence-led, data-driven risk modelling will be better positioned to protect their people, assets, and operations while those that continue to rely on reactive approaches will struggle to keep pace with an evolving threat landscape.

The future of retail crime control is intelligence-led and the transition has begun – have you?

Introduction

The retail sector is facing a period of profound change in the nature and scale of the crime risks it faces. Across many markets, retailers report that crime has evolved both in magnitude and sophistication to become more organised and aggressive. At the same time, stores and supply chains are increasingly data-rich and technologically enabled. This combination presents both a challenge and an opportunity. While criminal threats are evolving, so too are the tools available to identify, understand and respond to them.

Part of the challenge for retailers is knowing which levers to pull and in what locations, especially for businesses with many geographically dispersed stores. This issue was explored in a previous ECR Retail Loss project, Fortress Stores, which examined how to keep the ‘most at-risk’ locations trading, i.e. those stores facing the highest levels of crime and concern.¹ A clear finding from that study was that effective crime risk mitigation depends on good data. Without credible, reliable data, retailers cannot map relative risk, understand its underlying drivers, or assess whether their interventions are working. Yet, the Fortress Stores report found that very few businesses had robust systems in place to consistently report, collate, analyse, and use accurate, up-to-date data to inform their strategies.

This gap provides the starting point for the current study. Specifically, it seeks to understand how retailers are identifying differences in crime risk across their estates, and how this information is being used to support decision-making and shape security strategies.

Security Risk Management and the Development of Risk Modelling

To better understand the conceptual underpinnings of risk modelling, first, we looked to established methods, namely Security Risk Management (SRM) and Failure Mode and Effects Analysis (FMEA) to provide insights on how risk is identified and managed in other industries – and even in other functions of the retail business. For example, SRM is widely embedded within high-risk and high-reliability sectors such as aviation, finance, oil and gas, pharmaceuticals, and national security.² The approach requires organisations to identify credible threats, analyse points of vulnerability, and evaluate both the likelihood and consequence of harm.³ The result is a ‘risk register’ which can be used to inform decisions about control measures which are aligned to the level of risk that is deemed tolerable. The emphasis is on foresight, resilience and defensible decision-making in relation to the allocation of resources.

While there are examples of SRM being used in retail, it is more commonly applied to areas such as supply chain disruption, data breaches, and regulatory compliance. By contrast, retail crime control and loss prevention have tended to develop in a more reactive, incident-driven way. Furthermore, the Loss Prevention / Asset Protection function has often been viewed as a cost centre, rather than a strategic capability.

Another structured approach to risk is Failure Mode and Effects Analysis (FMEA).⁴ Originally developed in high-reliability engineering environments, FMEA focuses on identifying where and how a process might fail, assessing the consequences, and evaluating both the likelihood of failure and the chances of detecting it. Unlike high-level risk registers, FMEA works at a more detailed level, examining specific failure points and helping organisations understand how and why risks occur in practice. These risks are then scored and prioritised, allowing attention to be focused on the most critical vulnerabilities.

The relevance of SRM and FMEA to retail crime becomes clearer as the sector moves towards more data-driven and predictive approaches. Retail operations involve many interconnected processes – such as staffing, self-checkout, and security systems – all of which can create opportunities for crime if they break down or are exploited. Applying FMEA-style thinking within an SRM framework provides a structured way to identify and prioritise these vulnerabilities, supporting more targeted interventions and better use of resources.

Applying Risk Modelling to the Retail Sector

Decades of criminological research show that crime is not evenly distributed. Instead, it is shaped by a combination of location-specific factors such as the built environment, population density, and store layout – and operational factors, including trading hours, product range, and staffing levels, against a backdrop of broad socioeconomic and political conditions that can amplify or suppress criminal activity.

In practice, this means that every retail store has a different risk profile. Since crime risk is influenced by a mix of locational, operational, and situational characteristics, which can either increase or reduce vulnerability, even stores located close to one another – sometimes on the same street – can experience very different levels of crime. ⁵ This highlights a key point: understanding how store design, staffing, and day-to-day operations influence crime is just as important as understanding the surrounding environment.

Since crime typically clusters due to multiple factors, the ability to identify which stores present the highest levels of risk – and then determine what measures will be effective in mitigating that risk – presents a valuable proposition for retailers looking to drive down crime in a cost-efficient and defensible way. It is precisely this systematic approach that retail crime risk modelling can support.

Although many retailers operate with some form of risk model to identify relative criminal and security risks across their estate, the level of sophistication of these models, how they are used, and what decisions they inform is currently not well known or understood. Such risk models might seek to capture and analyse shrink, incidents of violence and aggression, criminal damage, as well as other factors that could signal vulnerability e.g. staff vacancies. At a time of record levels of acquisitive and violent / aggressive incidents in retail generating increased expenditure on security solutions and loss prevention strategies, knowing where to deploy finite resources is an important business decision for Loss Prevention / Asset Protection and security professionals; and they need to be able to do this based on a methodology rather than a ‘hunch’ or to satisfy the whims of a critical stakeholder.

The Research Project

The research outlined in this report sets out to explore how the retail sector is using data to inform decision-making and security strategies. In particular, the project aim was to shine a light on the different ways in which risk modelling is being used by retailers to identify, track, and respond to criminal activity in and around ‘bricks and mortar’ stores. Key areas of interest include how risk models are constructed (identifying areas of commonality and difference between businesses), which internal and external data points are included, how they are used, which decisions they inform, what status they hold within the business, and how they are reviewed and validated.

Methodology

An in-depth global study was conducted with more than 70 retail businesses directly participating, including many of the world’s leading retail chains. Based on this cohort, we estimate that the sample represents approximately 10–12% of the global retail market, with a combined retail turnover exceeding £2.5 trillion. Collectively, these businesses are estimated to operate approximately 185,000 to 230,000 stores worldwide.⁶ Many more retailers took part in online, and in-person focus group style discussions to challenge and refine our thinking as the project progressed. This remarkable engagement indicates the appetite of the industry to better understand and utilise crime risk modelling principles and approaches within their businesses.

• Literature review of risk modelling in different sectors. Relevant literature, focusing on how businesses identify and model risk, Security Risk Management (SRM) and Failure Mode and Effects Analysis (FMEA) provides a backdrop to the project.
• Online Industry Survey. A survey of retailers was conducted to answer the why, what, when, and how questions. The survey was hosted online using the Survey Monkey online platform and distributed to ECR Retail Loss’ membership, advertised on LinkedIn and emailed to known contacts. Over 100 responses were received to the online survey. Once non-retail participants and duplicates from the same business were removed, a sample of 72 responses remained.The findings from the survey provide insights on which companies are using a risk model, the variables that it incorporates and to what degree it has been tested for accuracy and reliability (either validated in house or scrutinised through litigation proceedings). It also explored whether multiple different models exist in the same business for different functions, the ways in which the model is used and by whom.
• Semi-structured Interviews. Using an international sample of senior Loss Prevention and Asset Protection professionals, interviews were conducted with 16 participants representing multiple verticals including grocery, homeware, mass merchandisers and fast-food outlets. Interviews were conducted with a range of individuals and role types, including Heads of Security and Loss Prevention Managers.
• Focus Group. An industry focus group was held in September 2025 attended by 35+ senior Loss Prevention and Asset Protection and security professionals to feedback on the emerging principles from the research and examine in detail what a maturity model should look like. The transcript was analysed and used to refine the approach being adopted; a key aspect was to ensure that the self-assessment tool was simple to use and interactive.

Structure of the Report

The remainder of this report is structured into the following sections:

Section 2, Key Findings: The Current Landscape and Future Direction which examines how retail crime risk models are being constructed and used currently, and the future direction of travel.

Section 3, Indications of Model Maturity highlights where there is divergence across the industry and begins to outline indicators of maturity in risk modelling approaches.

Section 4, Towards Intelligence-led Retail Crime Control brings together the findings from this study alongside insights from previous ECR Retail Loss research to present the case for Intelligence-led Retail Crime Control (IRCC) as the future direction for retail security and loss prevention. It also introduces the Retail Crime Risk Model Self-Assessment Tool, a practical tool designed to help retailers identify the maturity of their current approach to crime control and benchmark their organisation against four distinct personas.

In Section 5, Taking Action: The Retail Crime Risk Model Self-Assessment the report concludes by summarising the key findings and looking ahead to the transition from reactive, incident-led approaches to intelligence-led, data-informed retail crime control.

Key Findings: The Current Landscape and Future Direction

What a Retail Crime Risk Model Is (and What It Isn’t)

A risk model is a systematic framework used to identify, assess, and quantify potential risks within a given context, often with the goal of informing decision-making and mitigating adverse outcomes. It typically employs mathematical, statistical, or computational methods to evaluate the likelihood of specific risks and their potential impacts. Risk models are widely used across industries such as finance, healthcare, engineering, and environmental science, where they enable stakeholders to anticipate uncertainties and allocate resources effectively.

From the literature review, we learnt that industry risk models can incorporate various data inputs, including historical trends and real-time information, to generate predictive insights. For example, in finance, risk models may assess the probability of credit defaults or market volatility, while in healthcare, they may estimate the likelihood and severity of disease outbreaks. The accuracy and utility of a risk model depend on the quality of data, the assumptions made, and the robustness of the underlying methodology, which necessitates the ongoing validation and refinement to adapt to changing conditions.

In crime and security practice, the terms risk assessment, risk register, and risk model are sometimes used interchangeably but it’s important to clarify the difference between risk models and other approaches to quantifying and analysing risk. In this report the terms are used with the following distinctions:

Risk Assessment

A risk assessment is a structured process used to identify and evaluate potential threats, vulnerabilities, and impacts. In retail security this may include risks such as theft, organised retail crime, fraud, or violence against staff. The outcome is typically a documented evaluation of the likelihood and impact of risks, often accompanied by recommended mitigation measures.

Risk Register

A risk register is a management tool that records identified and specific risks in a structured list. Entries typically include a description of the risk, its likelihood and impact, existing controls, and the person responsible for managing it. In retail settings it functions primarily as a governance and tracking mechanism which usually focuses on issues such as supply chain disruption, cyber-attacks and business continuity.

Risk Model

A risk model is an analytical framework used to estimate or predict risk using data. In retail crime and security, models may use historical incident data – both internal and external – or statistical techniques to identify patterns, forecast risk levels, or prioritise interventions. It primarily focuses on quantitative data, but as we will see, there are approaches being taken to systematically capture qualitative data in a way that can be utilised by a model.

Relationship Between the Terms

Risk assessments identify and evaluate risks, risk registers record and monitor them, and risk models provide data-driven insights to support decision-making.

Current Adoption and Maturity of Risk Models

We asked survey respondents to first determine their level of maturity in terms of crime risk modelling ranging from an ‘established’ model through to not having a model in place for crime. For those that didn’t have a crime risk model, we asked a follow up question to find out why. We then explored what data points are included in their model(s) – both internal data and external data – and which decisions the crime risk model informs (divided into operational, property and LP decisions). In addition, participants were given the opportunity to add further details and information in open text boxes. Outlined below are the key findings.

Overall, 73% of respondents stated that they had one or more crime risk models in operation (Table 1). Of these, 44% reported that they considered their risk model(s) to be established, while 56% indicated that their model(s) required further development and refinement.

Table 1: Does Your Business Have a Crime Risk Model?

 

Table 2: Crime Risk Model Adoption: ‘Established’ vs ‘Developing’

Given the level of subjectivity currently present in retail risk modelling, and the absence of an agreed industry benchmark, it is difficult to determine whether what one business considers “established” would be viewed the same way by another. To explore this further, we analysed the data to identify whether there were meaningful differences in how organisations that considered themselves to have “established” models approached and applied them, compared with those still developing their capabilities. This is outlined in Section 3, but first we examine the reasons as to why some businesses don’t currently have a risk model for crime.

Understanding Non-Adoption

One in five businesses surveyed (21%) reported having no risk model in place at the time of the survey, with a further 6% developing a model that was not yet operational (i.e. 27% of respondents had no working crime risk model in place at the time of the survey). The reasons for non-adoption are summarised in Table 3. Notably, despite the significant advantages that risk modelling is purported to offer – particularly for organisations operating multiple sites across large geographical areas – 33% of respondents without one were either unfamiliar with the concept or unclear about its potential benefits. Overall, cost, lack of resource, and lack of time were identified as barriers to risk model adoption by a combined 42% of those without a model. Breaking this down, we can see that perceived cost / lack of resources was a leading challenge specified by 25% of respondents, and 17% highlighted a lack of time. Illustrating this, an interviewee representing a fashion retailer operating across Europe remarked:

We have a lot of data. What we don’t have is enough time – or the right tools – to manage that data. For example, the antenna systems, the camera systems, RFID, the stores incident reports all give a lot of data. We have a lot of information from the police and official sites. The problem for us is how to manage that data, how to analyse it properly and profit from that data.” (Fashion, USA)

Echoing findings from previous work, 17% identified unreliable data as the prohibiting factor in the development of a crime risk model. The need to improve internal data collection has been recognised industry-wide; too many incidents go unreported due to volume, a lack of staff time, and a lack of confidence that it will result in any action being taken by law enforcement and/or senior management.^{7 8}

Table 3: Reasons for Not Developing a Retail Crime Risk Model

A Patchwork of Approaches

It is important to acknowledge that crime risk modelling in retail is complex, and a variety of modelling approaches can be considered valid depending on organisational priorities, data availability, and the specific crime challenges faced. Indeed, our research revealed considerable variation and underlying uncertainty about what a crime risk model should include, how it should be constructed, and how it can best be used in practice. This section begins to unpack the process of developing an effective retail crime risk model by examining the types of variables typically employed, the use of internal and external data sources, and differing perspectives on model complexity.

Number of Variables

Participants expressed divergent views on the optimal level of model complexity. While some cautioned about creating “a kitchen sink model” (Grocery, UK) advocating for a minimalist “less is more” approach, others argued that incorporating a larger suite of variables enhances explanatory power.

We evaluated 140 different data elements and reduced them down to 18 metrics. We rank each one of those 18 metrics on a scale of 1 to 9 – with one being the lowest risk and high 9 being the highest – and then we weight each one of them based on its relationship to shrink. That way, the ones that are most predictive get the highest weighting.” (Homeware, USA)

Similarly, it was noted by a focus group participant that ‘overweighting’ could easily happen unintentionally if the person constructing the model included multiple variables that essentially measure the same thing.

By the time you have added a lot of socioeconomic and environmental factors, they can end up becoming proxies for other things. So, a simpler single metric that is reflective of all the factors [is preferable].” (Grocery, UK)

In practice, and consistent with established statistical modelling principles, multiple data sources often capture overlapping or correlated phenomena. In such cases, selecting a single, well-defined variable is typically optimal, or in some cases building a ‘composite variable’ comprised of multiple independent variables can improve model robustness by avoiding the overweighting of factors.

External Variables Typically Included in Retail Crime Risk Models

Forty-six respondents provided details on the external variables included in their crime risk models as presented in Table 4.

Table 4: External Variables Included in Retail Crime Risk Models (%)

*Other included the presence of different types of lodging in the area such as motels or ‘rent by the hour’ premises.

The main external variable included in risk models is, perhaps unsurprisingly, police data; 88% of respondents with an active model stated that it included this source. For 8% of survey respondents, this was the only external data source that was included in their crime risk model. Crime attractors e.g. transit hubs, deprivation levels and data on organised retail crime (ORC) were the next most frequently cited factors included in roughly a third of crime risk models.

A Note on Police Recorded Crime Data (and Lessons for Retailers)

Police recorded crime data is not a strong indicator of actual levels of crime for most crime types but especially high-volume non-violent crimes. It can be hugely unreliable as it is dependent on crime being noticed, reported, and recorded. As such, there are many opportunities for attrition in crime data.

The reliability of police recorded crime data varies by crime type and is thought to give more insight into lower-volume but higher-harm offences.

For example, it is likely that most unlawful killings are reported and recorded by the police, for obvious reasons. However, offences broadly grouped under the banner “retail crime” (including shoplifting, criminal damage, as well as physical attacks, threats, and verbal abuse towards shop workers) suffer from chronic under-reporting and are not well-reflected in police data.²¹

There are many reasons why retail crimes are not reported to the police, including the time it takes to report, a belief that nothing will happen, a lack of evidence, fear that it will increase insurance premiums, distrust or lack of confidence in the police, a fear of reprisal from perpetrators, or a perception that the incident was too trivial.

A consequence of this is that over time perpetrators become emboldened as they fear no consequence for their actions. Relatedly, it becomes difficult to make the case that finite police resources should be used to address what appears to be a relatively small-scale problem.²²

This can create a vicious cycle: when crimes go unreported, police forces fail to recognise the extent of the problem, leading to its de-prioritisation. This further discourages victims from reporting incidents, as they see no benefit in doing so.

It is not only police-recorded data that can be subject to significant inaccuracies. Retailers’ internal incident data can also present challenges; as noted above, 17% of respondents without a crime risk model cited unreliable data as a key barrier to development. Producing accurate and robust data has long been a persistent issue for the sector.

However, as physical stores become increasingly data-rich – supported by a growing network of sensors and digital systems – there is a clear opportunity to improve both the quality and availability of data. Over time, this should enable better integration of these data points into risk models, enhancing their reliability and, crucially, their ability to support actionable insights.

Internal Variables Typically Included in Retail Risk Models

Overall, 52 respondents provided details on the internal variables included within their established or operational risk models as shown in Table 5. ⁹

Table 5: Internal Variables Included in Retail Crime Risk Models (%)

*Other: proximity to bus stops, failed drug tests, square meterage, cash holdings, site of ATMs, number of floors and number of doors.

Unsurprisingly, the value and/or volume of theft incidents and the number of aggressive or violent incidents were the two most included variables, featuring in 90% and 87% of models respectively.

It is widely recognised within retail that employees play a central role in managing crime, risk, and shrink. For example, the Fortress Stores report highlighted ‘the power of people to protect a store, its assets, associates and customers.’¹⁰ Yet, as Table 5 shows, staff-related variables were infrequently incorporated into retail crime risk models. For example, staff turnover (29%), staff engagement (25%), and staff dismissals (23%) were each included in fewer than one-third of the models described by participating businesses. This is noteworthy given the centrality of employees to driving effective operations. For example, a well-trained employee can not only deter criminality by providing capable guardianship but can de-escalate potentially volatile and / or violent incidents. This would suggest that including metrics to measure the stability, engagement, and behaviours of the workforce might offer some explanatory value to crime risk forecasting such as providing a first line of defence against theft by delivering excellent customer service.

Environmental factors

There is a well-established body of criminological theory concerned with how environmental and social context shapes crime patterns.¹¹ Factors such as proximity to major highways, street visibility, lighting levels, neighbourhood socioeconomic conditions, and the presence of unmanaged or derelict buildings can significantly affect criminal opportunity. Techniques such as Risk Terrain Modelling (RTM) build on this insight by identifying environmental factors associated with crime risk and quantifying their influence on where crime is most likely to occur.¹² A key part of RTM is to proactively identify emerging crime locations and guide efficient resource allocation before incidents escalate.

For retail crime risk modelling, incorporating environmental variables offers an enhanced and more contextual picture of crime risks. The location of a store (i.e. high street vs shopping mall) was reported by 62% of survey respondents (Table 5) as being included in their retail crime risk model. As one retailer reported in an interview:

If the store is on a high street [main street], they tend to be weighted because we know they bring higher levels of drug user / addict type individuals; quite different to what you see in a community store or inside a shopping centre.” (Health and Beauty, UK)

Just as certain features of the built environment were perceived to elevate risk, other contextual factors were seen to shape it in different ways. The following example, shared by an experienced Loss Prevention leader, illustrates how crime can cluster spatially in relation to local geography – what could be considered as the ‘wrong side of the tracks’ effect:

A freeway can literally divide crime. You can have a store on one side of the freeway and drive a half mile north on the other side of the freeway and have no crime. If you didn’t have that qualitative insight and you were pulling all these different data reports, you might make a bad decision. So, I think you’re always going to need a little bit of discussion to understand the data.” (Mass Merchandiser, USA)

Some participants further expanded upon how they were attuned to environmental factors and incorporated them, when they could, into their modelling. This was often in relation to the use and type of nearby premises. For example, one interviewee described how they had found data on the number of vacant business units in a location to be a useful measure:

Our commercial development team have access to data feeds relating to vacant units so the number of vacant units in a location is built into the risk model. It’s the ‘broken windows theory’¹³; if you’ve got lots of shops that are closed, we know it generates a higher level of antisocial behaviour in the area.” (Health and Beauty, UK)

Similarly, another business highlighted that the type and nature of premises in a location could be used to signify the likelihood of crime and other issues.

One aspect that is a common denominator for us is our neighbours. So, if our neighbours are ‘questionable’ or sketchy, we find that those stores are a lot higher risk. We find that this is primarily along the lines of hospitality places such as hotels. If it’s not a mid-to top-tier hotel – if it’s a lower end or extended stay type – we tend to see the stores in that location as higher risk.” (Specialty, USA)

A store is not only shaped by what happens within its walls, but by the built environment, geography and social dynamics surrounding it. As risk models continue to evolve, integrating place-based criminological insight is an important way to ensure that stores are operating with as much risk insight as possible.

Finding (the right) Data Points

‘How do you find that golden nugget of information?’ one retailer asked rhetorically, capturing the challenge that social phenomena and features of the built environment do not always arrive in neat, quantifiable datasets ready for risk modelling. Participants consistently noted difficulties in identifying reliable indicators for complex social dynamics. There were respectful discussions around whether the presence of people experiencing homelessness might correlate with higher exposure to crime and antisocial behaviour in commercial areas – not because homelessness itself causes crime, but because social need, vulnerability, and place-based activity can interact in ways that affect retail environments. This issue was raised more frequently in the USA, where some locations include large street encampments. Whereas in the UK, retailers sometimes used the presence of ‘soup kitchens’ (a place where free meals are provided to those in need) as a proxy indicator for elevated social need in an area. In the USA, some considered mapping homeless shelters, though this was not always geographically relevant since the transient nature of unhoused populations also limits the usefulness of static data points. Ultimately, participants emphasised the need to approach such indicators with empathy and pragmatism, recognising that homelessness is fundamentally a societal and economic challenge rather than directly a criminal one – and as such other metrics would likely represent the same underlying social issues (see discussion on ‘overweighting’ factors in section 1.5.1).

When the model outcomes don’t feel “right”

A recurrent theme within the interviews was that there would often be times when the risk model outputs did not align with the lived experience and intuition of local experts i.e. those who are very familiar with a store’s operating environment and historical performance. In such cases, participants in this study reported concern that the underlying data may be incomplete, unbalanced, or missing crucial context. As one interviewee put it:

Sometimes you’ll look at a store rating and have a gut feeling that it isn’t accurate. So, you think, how do we get more data in and paint a better picture?” (Grocery, USA)

Similarly, others described a disconnect between the realities they experience, and the patterns reflected in the model’s ranking outputs. One retailer who was still developing their model, remarked:

The stores that we feel are high shrink or high risk aren’t really popping to the top of the list from a criminal aspect, so we’re trying to find out what the data point is that is missing to bring those stores to the top.” (Specialty, USA)

This tension between quantitative modelling and on-the-ground insight (or “gut instinct”) emerged as a persistent challenge that could sow doubt in the minds of some end users about the reliability and validity of the model. Whereas others took a more pragmatic approach to marrying up the perspectives of those with knowledge of the area and the output of the crime risk modelling:

The model enables us to make more data-informed decisions than just using gut feeling. Everyone has an opinion as to how difficult the store is going to be from a crime perspective. It’s always useful to have people’s personal experience, but if we have a baseline from an agreed upon methodology that comes up with a rating then it means that, yes, we can maybe deviate from what the score tells us, but you’re going to be closer to what it should be. You’re not going to have wild swings in opinion.” (Grocery, USA)

Models inevitably rely on the data they are built on; if certain types of incidents are under reported or if staff refrain from recording events they feel are routine, the model may produce distorted representations which can then translate into poor decision-making. As outlined above, some survey respondents were concerned about the quality of internal incident data. In the interviews this theme was also prominent with some participants expressing concern that the data used to furnish a crime risk model could be manipulated, particularly in the direction of overstating issues if the store thought that this might gain them additional staff hours and / or guarding. For example, one interviewee reflected that internal incident data is: “fraught with error and inconsistencies.” (Specialty, USA)

However, it’s important to note that not all anomalies should be dismissed as model failings. In some instances, they can serve as valuable signs or clues that require further investigation. A store flagged as “low risk” by the model but returning poor performance metrics could indicate:

• Incomplete / incorrect incident reporting (i.e. robberies are often mis-reported as thefts)
• Undetected / unrecorded internal theft
• Temporal shifts in local conditions
• Data-lag or non-standard recording practices

In this sense, anomalies are not annoyances or failings of the model that should be disregarded, but rather they can be vital clues. Being curious, scrutinising inputs, and interrogating unexpected results are important practices for ensuring that risk models remain valid and operationally meaningful. The objective of a retail crime risk model is not to reinforce “gut instinct” but rather to use intuition, on the ground knowledge and quantifiable data as contributions to a more complete intelligence picture. As one UK interviewee reflected on the use and interpretation of crime risk models: ‘it has to pass the “sniff test”’.

A balanced approach involves moving towards data-led decision-making without dismissing contextual knowledge held at local level. One promising solution is the systematic integration of qualitative intelligence from store managers, frontline teams, and regional leads. The ‘lived experience’ of those residing and working in specific locations is hugely important for those retailers with a large number of stores across disparate geographical areas because what is sometimes presumed to be happening at local level isn’t always the case. This was highlighted in the Fortress Stores report – particularly in relation to compliance and the (mis)use of security solutions. Having an informed view of the realities of a store’s locale can help drive decision making. For example, one interviewee in the present study outlined how he would contact other similar businesses in the vicinity to ascertain their perceived risk profile so he could benchmark. Similarly, some businesses actively sought local information from employees which they would use to caveat or sit alongside their risk model:

We send out a ‘site survey’; the store employees fill out a survey which then spits out qualitative data that we incorporate into our model.” (Mass Merchandiser, USA)

Being curious in this way can prompt a deeper dive into the store operations and situational dynamics which can provide clues as to what is driving crime and antisocial behaviour that might otherwise be missed:

We have a call centre and anytime anybody experiences anything other than a great day we ask them to call it in. If somebody came in and was really grumpy and yelled and screamed in a threatening way, go ahead and call that in. So, we can be curious: ‘is this store prone to more grumpy people? What’s happening in the neighbourhood or is our staff the problem? Is it cleanliness? Did a strip club just move in next door? After three years’ worth of data, it is very interesting. We’ve developed internal dashboards using business intelligence […] that looks for correlations.” (Fast Food, USA)

When captured and integrated, these qualitative insights provide an essential ‘sense check’ on quantitative outputs. They strengthen trust in the model, enrich the intelligence picture, and ensure that risk assessments reflect the realities of local environments rather than relying solely on imperfect or incomplete datasets.

How Retail Crime Risk Models Are Being Used (And How They Could Be)

The following tables outline how frequently organisations with one or more crime risk models use them for the functions stated below. As shown in Tables 6 and 7, overall, most active models in the retail sector are deployed to inform specific loss-prevention and asset-protection decisions. For example, 83% of respondents reported using their model ‘Most of Time / Always’ when making decisions about security investments and 79% used it to inform how and where to allocate security technology such as body-worn cameras.

Table 6: How Risk Models Are Used for Loss Prevention Decisions (%)

We can also see that the most common operational decision informed by the crime risk model is guarding coverage i.e. whether to deploy a security officer and for how many hours; 74% of survey participants utilised the risk model in this way, followed by product protection decisions (60%) and to inform training needs (37%).

Table 7: How Risk Models Are Used for Operational Decisions (%)

Conversely, some of the operational decisions that are known to correlate with criminal risk are not routinely informed by a risk model. For example, Table 7 shows that for 41% of businesses a crime risk model would ‘Never’ inform trading hours for an individual store even if it indicated heightened criminal vulnerability and for 32% it would ‘Never’ inform the merchandise assortment. In fact, just 2% of respondents said their model/s would always inform the opening hours of stores and just 4%, the range of products for sale – even if certain hours and products disproportionately attract criminals rather than honest customers.

Scales of Risk and Menus of Interventions

A common strategy for businesses is to categorise their stores in terms of risk with some opting for simple binaries of what they termed ‘basic stores’ (low risk) and ‘focused stores’ (high risk), whereas others had more disaggregated categories with up to a 10-point scale of risk. Furthermore, some companies were found to have separate registers for different types of risk e.g., for loss, food waste, or violence. Overall, most appeared to operate with – or be moving towards – a scale comprised of three or four risk ratings along the lines of ‘low risk’, ‘medium risk’, ‘high risk’ and some adding an additional category along the lines of ‘ultra-high risk’ or ‘extreme stores’.

Following on from the categorisation of a store is a ‘menu’ of interventions; lower risk stores receive a base level of security interventions that are common to most large companies such as CCTV and electronic article surveillance (EAS). Whereas the higher risk a store, the more sophisticated and / or expensive interventions would be deployed. This approach is similar to the Hierarchy of Controls, a security risk management process, most readily associated with the treatment of occupational health and safety issues. In essence, it is a structured approach that prioritises the most effective methods of reducing or eliminating risks before resorting to less effective ones.¹⁴ Its application to retail is apparent but fundamentally it cannot be effectively applied without the ability to accurately measure risks – or an understanding of which measures are most effective at tackling them. As a USA grocer outlined in an interview:

We started with the highest risk stores and if a store falls into this bucket, they will get these treatments – so that could include live view towers, security guards, blocking fixtures, push out prevention devices. So, we’re trying to determine a menu; if you fall into this bucket, you are expected to put these treatments in those stores at a minimum.” (Grocery, USA).

Another retailer outlined that the model was applied not only at store level but at product level, allowing for more granular decision making about how different lines are treated within stores.

Not only do we risk model the stores themselves, but we actually risk model the products in the stores. So ‘beauty’ for example, beauty’s an extremely high theft product. So even if we have a store that is only registering as a ‘moderate theft store’, they might be modelled as an ‘ultra-high beauty store’, which means they will need to have a full ultra-high beauty treatment [menu of interventions] applied.” (Mass Merchandiser, USA).

Having this data-driven decision-making not only improved consistency but also increased efficiency because the same conversation wasn’t continuously repeated. As the participant explained, ‘the merchant teams now automatically apply the measures when they order that product’.

Alongside merchandising, retail crime risk models are also used by some businesses to inform a range of specific decisions such as trading hours or the proportion of self-checkout terminals. As one participant outlined below, the range of operational decisions that the model can be used to inform is far reaching:

We might trim the late-night hours if it’s a high-risk store. It might inform decisions on the extent of self-checkout. If we have an increase in incidents in the store, it may indicate the need for more staff training. It might be merchandising, the extent of product protection fixtures, whether we lock things up or have shopping cart protection.” (Grocery, USA)

Disinvestment Decisions

Security disinvestment decisions are often some of the most challenging to execute. They require a large degree of understanding about which tactics and solutions work for which criminal problems. They need to be justified and defendable. The main disinvestment decision that was discussed in this project was with regards to physical guarding hours; either reducing the level of coverage or removing a security officer entirely from a location. Done well, this can save the business a large amount of expenditure. Done badly, and it can impact on staff morale and, of course, safety, leaving employees and customers feeling exposed and vulnerable.

The introduction of the risk model enabled us to respond to budget cuts in a sensible way. We identified stores that were actually lower risk stores than what they looked like. We were able to prove quite quickly that removing the guards from those low-risk locations would not result in high losses. In fact, the cost of the loss was less than the cost of the guarding would have been.” (Health and Beauty, UK)

Foreseeability, Litigation and Legal Challenges

Retail crime risk models can serve an important function in legal contexts, particularly in establishing foreseeability and demonstrating due diligence in cases where a retailer faces litigation. For example, following an incident of workplace violence or customer injury, a robust risk model can be presented as evidence that the business had systematically assessed crime-related risks and took proportionate, data-informed steps to mitigate them.

Foreseeability, in the context of retail crime, refers to the extent to which a retailer could reasonably anticipate that a criminal incident e.g. a theft, assault, robbery, might occur on their premises based on historical patterns, environmental factors, and available intelligence. The legal concept of foreseeability appears in various forms across many legal systems internationally, though the terminology might vary (e.g. phrased as “reasonably likely to occur”, “reasonable cause to anticipate,” or “appreciable chance” for example). In essence, foreseeability underpins principles such as duty of care and notions of negligence in virtually all common-law systems and the basic premise is that liability for harm depends in part on whether the harm was reasonably predictable. Retailers need to be able to say that they systematically monitored known risk indicators, anticipated where risk was increasing, and acted proportionately.

Our survey asked respondents who had a retail crime risk model, if it had ever been formally tested (e.g., as a litigation defence or foreseeability). Forty-four participants answered with a ‘yes’ or ‘no’ rather than ‘don’t know’ or skipping the questions; 16 (34%) responded that it had been tested. For some of these retailers, the test had come through legal and / or regulator testing, as explored below through the concept of ‘foreseeability’.

Starting from the established premise that most crime does not occur randomly, it follows that certain stores, locations, times, and situational conditions can predictably elevate risk. In legal terms, if a risk was predictable and identifiable through reasonable methods of analysis and monitoring, then failure to address it may constitute negligence. On the flipside, demonstrating a robust understanding of risks and responding appropriately to mitigate them can support a defence. A risk model itself might be subject to challenge in court, with claimants seeking to argue that the model was poorly constructed, ignored relevant data, or failed to highlight obvious risk factors. Ensuring that models are transparent in methodology, regularly updated, and supported by documented decision-making processes can therefore be critical.

I think we’re going to see a case prosecuted at some point [in the UK] and I think it will make front page news. It makes me nervous. I think it will happen, and I think it will probably happen in the next year or so given some of the things that we’re seeing across retail. The challenge will be ‘did you have the right investment?’ “(Health and Beauty, UK)

The above quote is taken from a research participant located in the UK. In other regions, lawsuits relating to charges of negligence that hinge on foreseeability are thought to already be commonplace. For example, in the USA negligent-security litigation is common and retail stores are among the types of premises routinely implicated. Illustrating this, a legal review of 1,086 reported cases from 1992 to 2001 found that approximately 10% of all premises-liability lawsuits involve claims of inadequate security. Unfortunately, the study did not disaggregate by premises type but included sites such as bars, parking lots and retail stores.¹⁵

There are no publicly available datasets that report on how often retailers are sued for negligence or lack of foreseeability relating to in-store crime. This is due, in part, to the fact that many such cases are resolved confidentially before reaching trial and that legal reporting rarely distinguishes retail premises from other commercial locations. While the exact number is unknown, the consistent appearance of retail cases within negligent-security litigation highlights the importance of demonstrating data-informed foreseeability, appropriate mitigation efforts, and clear documentation of decision-making. Against this backdrop, ‘gut instinct’ or ‘years in the business’ would not stand up to scrutiny should a case be brought against a retailer for something that occurs within their store or on their private land. As one USA grocer outlined, the positive contribution of robust risk modelling is that ‘the business can make more data-driven decisions rather than relying on gut feeling.’ In other ways the risk model becomes an integral instrument underpinning and defending strategic decision-making that might come under the scrutiny of regulators.

Frequency of Refreshing the Model

There are some businesses that build the risk model with a view to ‘set and forget’. However, others recognised a need for ongoing validation and improvement of the model to optimise its utility and ensure that it is perceived as credible and robust by all stakeholders and functions across the business.

Security and crime assessments are a living, breathing thing; they evolve every day.” (Specialty, USA)

The perception of volatility in some markets due to politics, the economy and social factors, has seemingly brought with it a desire for more robust risk assessment and some participants expressed the need for more regular updates and near real time data to stay ahead of these trends.

Table 8: Frequency with which Dynamic Data is Refreshed / Updated (%)

 

In fashion retail, you cannot build a model and fix it because you will probably need to change it faster than you expect.” (Fashion Retailer, Europe)

Some participants highlighted that retail crime risk models could be used in different ways and this would determine the frequency with which they are refreshed:

It’s important to understand what you want your model for.

Tactical models require frequent updating as they are used as response to current crime impacts such as guarding, plain clothes teams etc.

Strategic models need to be set in stone for a period of time that allow you to make a business decision and then follow it through. For a large organisation, a model that changes too frequently can make it more difficult to have an impact and garner trust from operators.” (Grocery, UK)

A middle ground was struck in some businesses with regular refreshment of the dynamic data (in this case every three months) and publishing the strategic model annually, as outlined below:

Internally we refresh it every three months to see what degree of shifts we have. If you had a location that moved from, say, a risk Level 1 up to a risk Level 3 or 4, you’d want to understand pretty damn quick as to what’s causing that.” (Beauty Retailer, UK)

Another approach taken was to run bespoke and ad hoc crime risk assessments in response to direct intelligence or requests suggesting that there might have been a significant shift in the profile of a location.

We use a crime index report, but we also get ad hoc requests for assessments. So, if a District Manager or a store feels that the crime has changed in that area, we might do an ad hoc assessment and look at, you know, current crime stats from the police department.” (Speciality, USA)

Embedding a Crime Risk Model into Cross-Functional Business Operations

‘The model is so trusted,’ stated one participant with 30 years of LP experience in the USA. In this business, that trust translated into wide-ranging adoption across multiple organisational functions. The finance team, for example, used the model ‘to establish store shrink goals,’ while the real estate team applied it ‘in assessments for stores that are nearing their lease expiry to determine if we want to continue.’ Alongside these strategic uses, it also informed more traditional Loss Prevention and Asset Protection decisions about ‘security investments required to make stores more profitable.’

When asked what drove this unusually high level of cross-functional confidence in the risk model – particularly among departments that historically operated at arm’s length from Loss Prevention and Asset Protection functions – the participant pointed to the platform itself. The model was built in software already widely used elsewhere in the organisation, which meant it was already “trusted” and “believed.” An added advantage was that these teams contributed their own metrics and datasets, strengthening the model’s predictive and explanatory power when combined with loss data and risk scores from an external provider.

The importance of achieving cross-functional buy-in is well recognised in the Loss Prevention and Asset Protection literature, as are the challenges associated with securing it. As one participant (USA) explained, ‘Asset Protection has a marketing problem; we have a problem getting the enterprise to understand what we can do for them.’ Several participants noted that credible data, transparent methodology, and a shared organisational language can help overcome these barriers – enabling discussions about risk and mitigation to take place consistently from the C-suite to the shop floor:

Asset Protection cannot be run on an island; it’s just not healthy for a company. We have so much buy-in; our CEO uses our language, and I don’t think there’s a single leader in the business who couldn’t tell you about these models.” (Mass Merchandiser, USA)

And similarly, in the Netherlands, an experienced Loss Prevention leader highlighted how robust and credible data could convince senior leaders in ways that hunches and instinct could not:

We have made progress through convincing by numbers rather than convincing by gut feeling.” (Grocery, Netherlands)

The report Most At-Risk Stores: How to Engage Others in a Cross-Function Risk Mitigation Strategy’¹⁶ presents a tool designed to engage functions beyond Loss Prevention and Asset Protection into thinking about how they can meaningfully contribute to risk mitigation. The aim is to generate buy-in from teams who don’t traditionally see themselves as needing to be concerned with loss prevention, safety and security such as Merchandising, Format, Auditing and Human Resources. Many interventions required as part of a comprehensive strategy are beyond the Loss Prevention and Asset Protection spheres of control and require their involvement e.g. hiring strategies, trading hours, or investing in data analysis software. Taking a cross-functional approach to risk mitigation involves breaking down silos, generating buy-in from senior management and aligning strategies. Yet for many years, the Loss Prevention / Asset Protection function has too often been perceived as “the ‘no’ department.” At best, regarded as the final gatekeeper that other business functions must navigate in order to progress marketing, trading, or operational initiatives designed to drive sales. At worst, a team to work around or avoid engagement with. Often positioned at the organisational periphery, Loss Prevention / Asset Protection teams have frequently found themselves competing for limited resources to invest in equipment, guarding, or staff training, rather than being embedded as strategic partners in decision-making. A familiar illustration is the installation of CCTV cameras, only for marketing signage or promotional materials to be placed directly in front of them, undermining their effectiveness and highlighting a lack of shared ownership or understanding.

Participants provided compelling examples of how robust, shared data is being used to facilitate more productive, joint conversations about risk across the business. One such example is outlined below:

What makes this business different to all the others that have worked for is that Loss Prevention is seen as a department to collaborate with, particularly early on when key changes to the operation are being proposed. It’s very rare that we’re left in the dark; that’s quite unique in my experience. Each season (twice a year), we lock ourselves in a room with finance and operations and we basically go over the stock loss, the incident reporting as well as the demographic risk. We look at where and how we deploy our resources, and then we decide what we need to do next. So, we don’t tend to use a system, a spreadsheet, or algorithms to make that decision but we do use the data to guide human beings on making those decisions about investment and deployment. (Fashion Retailer, UK).

One of the clearest insights in recent years from previous ECR Retail Loss projects e.g. the Fortress Stores project is the critical role that credible data can play in shifting the status of the crime and security function internally by creating a common language and reference point across functions that have historically operated, at best, individualistically, or, at worst, in competition.

Limitations of Crime Risk Modelling in Retail

Echoing earlier observations about under-reporting, participants expressed ongoing concerns about the validity, reliability, and timeliness of both internal and external data sources. Several also highlighted uncertainties around which variables truly carry the strongest explanatory power, and how best to weight them in practice; for example, balancing high-risk, low-frequency events such as armed robbery against lower-risk but high-volume incidents such as theft. Further complexity arises from the need to control for store-level differences including format, size, number of doors, etc., each of which can influence risk patterns in material ways.

These concerns are not unfounded; risk models are only as robust as the data that feed them; incomplete, outdated, or poorly constructed data risks producing outputs that are misleading and / or operationally unhelpful. Furthermore, an unreliable or incomplete crime risk model will not gain the ear of the C-Suite or other functions across the business. This is important because having multifunctional buy-in is essential for the future effectiveness of Loss Prevention and Asset Protection. These limitations and challenges underscore the importance of continuous refinement, data quality assurance, and analytical transparency in developing risk models that genuinely support effective decision-making. The following section now turns to explore some of the indications of crime risk model maturity.

Indications of Model Maturity

The previous section outlined how participants approach, construct and use crime risk models in their business. To explore this further, the data was analysed to identify where there are differences between those businesses that considered themselves to have “established” models and those still “developing” their capabilities.¹⁷ In a review of the survey data – and in combination with the interviews – we identify five core areas of differentiation. These are external data, internal data, how the model is used internally, testing and validation, and the mechanisms for refreshing / updating data feeds.

First, this section explores the data sources that the model is built on. The Fortress Stores research report, organised around the seven key strategic principles of Data, People, Control, Offenders, Guarding, Monitoring, and Joining Forces, outlines how each of these different factors can elevate or mitigate risk. It is no accident that ‘Data’ is positioned as the first principle. Without a credible evidence base, retailers cannot map relative risk, diagnose underlying drivers, or evaluate whether mitigation strategies are working. The analysis of the survey responses in the present study similarly highlights the importance of identifying and capturing relevant data sources.

Indication of Model Maturity #1: External Data

Businesses with self-described ‘established’ models incorporate an average of 4.4 external data sources, compared to 2.8 among those requiring further development. Table 9 outlines the ‘Top 5’ external data sources that show the largest differences in use between ‘established’ and ‘developing’ models.

Table 9: External Data: Top 5 Greatest Differences Between Established vs Developing Models

The findings suggest that more mature models are more likely to incorporate advanced external intelligence feeds and environmental context variables, whereas developing models appear to rely more on basic or traditional data sources. For example, ‘established’ models are almost 4 times more likely to include data from threat intelligence platforms and five times more likely to include population density than ‘developing’ models. They are also more likely to integrate shared intelligence from industry networks – not just raw crime data. It is also notable that more than a quarter (26%) of models described as ‘established’ accounted for ‘crime inhibitors / detractors (e.g. large areas of natural features e.g. lakes, forests, agricultural land)’ in their modelling, whereas none of those with ‘developing’ status did.

This external data integration indicates a more outward-looking and context-driven approach to risk among mature models. It would appear that more mature models don’t just use more data points on average, they use more connected data, particularly from collaborative intelligence sources. In contrast, less developed models rely more heavily on internally generated, historically driven data, with more limited use of external inputs.

Indication of Model Maturity #2: Internal Data

External data was found to offer more significant divergence between the ‘established’ models and the ‘developing’ than internal data. However, there are some inferences that we can take from the relative use of internal factors between the two. Both groups make extensive use of internal data sources (e.g. Volume / Value of theft incidents) with ‘established’ models using an average 8.6 of the internal data sources our survey specified compared to 7.8 among ‘developing’ models.¹⁸

Table 10: Internal Data: Top 6 Greatest Differences Between Established vs Developing Models

*HR data is more likely to be included in ‘developing’ models

Table 10 shows the five data variables with the greatest disparity between ‘established’ and ‘developing’ crime risk models. The factor showing the largest difference is the ‘physical survey of area’ which is 37 percentage points higher in established models. This suggests that established risk models rely much more heavily on on-the-ground physical assessments, while developing models may depend more on desk-based or simpler inputs. Four out of the ‘top 5’ five variables were more likely to be included in ‘established’ models (Physical Survey, Robbery, Vandalism and Burglary) and just one of the variables – HR data – was more likely to be included in ‘Developing’ Models. The findings suggest that established crime risk models place greater emphasis on operational and broader incident-based inputs (beyond theft), particularly physical surveys of an area, robbery, vandalism, and burglary data. This suggests that more mature models are typically informed by richer, location-specific intelligence and historical crime patterns, helping to strengthen predictive accuracy.

By contrast, the greater use of HR data within developing models may indicate that organisations with less mature approaches are still testing broader internal business indicators, rather than concentrating primarily on established crime and environmental risk variables. This represents an important area for further investigation, particularly as people-related data was hypothesised to be a significant predictor of risk; unpacking what HR data is useful for crime risk models – and that which is not – would be a fruitful way forward.

Furthermore, although not quite making the ‘top 5’, it is notable that 13% of those with an ‘established’ model identified factors beyond our 19 specified ones, whereas none of those with a developing model offered any additional ones. The ‘holistic / bespoke’ category included: proximity to bus stops, failed drug tests, square meterage, cash holdings, onsite ATMs, number of floors and number of doors.

Overall, these insights into the factors included across established / developing models might suggest that model maturity is in part attributed to the breadth and diversity of data sources – particularly the extent to which external data is leveraged to enhance contextual understanding. Models that rely heavily on internal data alone risk missing broader structural and /or environmental factors. These external influences may include economic conditions, local demographic shifts, policing activity, or wider social and political trends, all of which can directly shape the type and frequency of criminal incidents.

Indication of Model Maturity #3: How the Crime Risk Model is Used

Segmenting the analysis by those that self-describe their model as ‘established’ and those that considered the model to still be ‘developing’, additionally reveals differences in how they are operationalised and used. Businesses reporting ‘established’ models are more likely to embed outputs directly into decision-making processes, with a high proportion (approx. 70-75%) reporting active use in operational or strategic decisions compared to around 50-55% among those with models requiring further development. For those ‘developing’ their model capability, their use is more limited to monitoring or retrospective analysis. Tables 11, 12, and 13 outline the ‘Top 5’ greatest differences in how the models are used internally across ‘Loss Prevention Solutions and Strategies’, ‘Operational Decisions’ and ‘Property Decisions’.

Table 11: Loss Prevention Uses: Top 5 Greatest Differences Between Established vs Developing Models

Established models are used more extensively for strategic loss prevention planning, particularly in product protection and security technology decisions. This suggests mature models are more embedded in long-term prevention and investment planning.

Table 12: Operational Uses: Top 5 Greatest Differences Between Established vs Developing Models

As shown in Table 12, the largest gaps appear in day-to-day operational deployment, especially security guarding and resource allocation. This indicates established models are much more likely to directly influence frontline decision-making.

Table 13: Property Decisions: Top 5 Greatest Differences Between Established vs Developing Models

Established models are also used more for high-value property and estate decisions, suggesting greater organisational confidence in the model outputs when financial commitments are involved.

Across all three areas, established models are used more widely and more deeply than developing models. The biggest gaps are strongest where decisions are operationally critical or financially significant, implying that maturity is a key factor in whether models are trusted enough to embed their outputs into decision-making.

Indication of Model Maturity #4: Model Validation

Like above, from the survey findings we can observe a discernible pattern from the data in relation to model validation. Businesses with established models are more likely to have undergone formal testing (40.0% vs 27.6%), indicating that validation may be an important feature of model development and organisational confidence in using outputs for decision-making or defensibility.

Indication of Model Maturity #5: Frequency of Dynamic Data Updates

Differences are evident in dynamic data refresh frequency. The strongest difference is that established models are far more likely to be refreshed in real time or continuously (35% vs 14%), suggesting greater technical maturity, stronger data pipelines, and a more operational use of model outputs. More frequent updating enables organisations to respond faster to changing crime patterns and emerging risks.

By contrast, developing models are more concentrated in periodic or ad hoc refresh cycles, with higher proportions updating quarterly, annually or less often. This may indicate more manual processes, lower automation, or models that are still used primarily for retrospective analysis rather than dynamic decision-making. Although it is worthwhile considering the point made by the Grocery participant quoted in section 1.6.4 regarding the difference between strategic and tactical models; it could be the case that live / near time data feeds are received separately to the risk modelling.

Summary

Overall, these findings suggest that more mature models are not only more data-rich, but also more operationally embedded, systematically validated, and actively maintained as part of ongoing risk management processes. Taken together, these findings suggest that crime risk model maturity is not defined by the mere existence of a model, but by the extent to which it is comprehensive, validated, operationally embedded, and dynamically maintained. Organisations describing their models as established consistently demonstrate broader use of external intelligence, richer internal data inputs, stronger integration into strategic and frontline decision-making, greater evidence of formal testing, and more frequent data refresh cycles. By contrast, developing models appear more limited in scope, more reliant on traditional internal data, less embedded in high-stakes decisions, and supported by less mature governance and data infrastructures. In practice, this points to model maturity as a progression from static, descriptive tools toward dynamic decision systems that are trusted across the business and capable of informing proactive risk management. For retailers seeking to strengthen their capabilities, the results indicate that future progress is likely to depend not only on better analytics, but also on investment in data quality, validation processes, automation, and organisational confidence in acting on model outputs.

Towards Intelligence-led Retail Crime Control

Some readers might recognise the high-stress cycle of crime control that characterises large parts of the retail sector. When a crime-related incident occurs – be it a robbery, a violent altercation or a poor shrink result – the typical response in many retail environments is to shift immediately into “firefighting mode.” Exploration of what’s driving the problem can become eclipsed by a search for blame to diffuse immediate pressure rather than generate genuine insight – whether that’s attributing the incident to previous management, data quality, supply chain issues, or external offenders such as organised retail crime. The emphasis on immediacy and short-term resolution means that quick reactive, and often highly visible, action is favoured over structured analysis to understand root causes or evaluate impact. Over time, the urgency fades, focus shifts elsewhere, and the underlying issues remain unresolved, until, of course, the cycle repeats with the next incident or result.

Findings from this risk modelling research highlight the limitations of this reactive approach – or more accurately, indicate the significant benefits of an alternative way. While the ‘firefighting’ approach may address immediate symptoms, it does little to build long-term resilience or reduce future risk. Breaking this cycle requires a fundamental shift from incident-driven responses to a more proactive, structured, and evidence-based approach.

In relation to crime, one of the most common and recognised applications of criminal risk modelling is through Intelligence-Led Policing (ILP). Originating in the UK in the 1990s, and subsequently becoming influential across many regions, it uses crime analysis to guide police operations, focusing on high-risk individuals and high harm areas to disrupt criminal activity before it escalates. By focusing finite police resources on hot spot locations there is evidence that it can work to reduce several crime types (such as drug offences, disorder offences, property offences and serious violence).¹⁹

Building on this policing approach alongside principles of Security Risk Management (SRM), the present study sets out the foundation of Intelligence-led Retail Crime Control (IRCC). IRCC outlines a way of identifying and using data systematically to identify patterns, understand drivers of risk, and direct interventions where they will have the greatest impact. Rather than repeatedly reacting to problems after they occur, retailers can move towards anticipating risk, making more informed decisions, and delivering more consistent and sustainable crime reduction outcomes.

Intelligence-Led Retail Crime Control

Intelligence-led Retail Crime Control (IRCC) is a strategic, data-driven approach that uses timely, accurate and actionable intelligence to identify risk, prioritise resources, and target interventions where they will have the greatest impact. It moves LP/AP from reactive activity to proactive decision-making, while also fostering innovation that encourages and empowers retailers to rethink traditional practices, experiment with new solutions, and adapt approaches as needed to achieve the best possible results in a climate of finite resources and evolving threats.

IRCC is about using data and analytics to identify and respond to complex problems in a resource efficient way that achieves maximum impact without wasted effort (particularly useful when resources are tight). It is an approach that combines data, technology, and the most up to date and credible criminological insights to drive down risk and loss.

Looking Ahead: The Future is Intelligence-led and Data-Driven

Looking ahead, retailers expressed a clear desire for crime risk modelling to mature from relatively rudimentary scoring tools into more automated, dynamic, and visually intuitive systems. Several participants described aspirations for integrated dashboards that update in real time, draw from a wider pool of internal and external data, and reduce the manual effort currently required to maintain or interpret model outputs. A consistent theme was the need for the sector to develop a more unified, standardised language around risk – something that would enable loss prevention, merchandising, operations, and senior leadership to speak with greater consistency and clarity about threat levels, priorities, and interventions.

As one participant noted, ‘The next evolution for us will be more efficient on the use of the data – so we can do more with less,’ reflecting a broader ambition to embed intelligence-led processes into everyday decision-making. Ultimately, the future direction of retail crime risk modelling lies in creating systems that are automated, interoperable, and capable of supporting cross-functional risk management as an industry-wide expectation rather than an emerging practice.

The next section presents the retail crime control self-assessment tool which has been designed to enable retailers to assess and benchmark their approach to crime control.

Taking Action: The Retail Crime Risk Model Self-Assessment

Based on the findings outlined in this report, a self-assessment tool has been developed to assess crime and security related risk models in the retail sector. This diagnostic tool is the first step towards transitioning to Intelligence-led Retail Crime Control.

The tool, available as an interactive online quiz or a paper-based exercise, is designed to identify the ‘persona’ of the crime control function within retail businesses. The intention is that it can be used by retailers and the wider industry to ascertain progress in the development of a risk model that can be used to inform strategic decision making on things such as recruitment and staffing, fulfilment models, store design, trading hours, guarding budgets, investments in video deployments (e.g. body-worn cameras, headsets, locked display cabinets), etcetera. Many retailers operate with multiple risk models and assessments, so it is important to recognise this as distinct and focused on crime and security related risks.

The self-assessment tool explores the range of data sources utilised, their ability to adequately represent crime and threat patterns, how predictive and dynamic the model is, and how well integrated it is across business functions, as well as its status in the business i.e. how well-regarded and respected it is to use in core decision making activities.

The assessment tool is comprised of different modules based on the indicators of maturity outlined in this report:

1. Breadth of External Data Integration

Established models draw on a wider range of external data sources, including threat intelligence, population density, crime attractors, and environmental inhibitors. This indicates a more contextual understanding of risk, where organisations look beyond internal incident history to incorporate wider structural and environmental influences.

2. Depth and Relevance of Internal Data Inputs

While both groups make substantial use of internal data, established models place greater emphasis on operationally relevant and location-specific indicators such as physical surveys, robbery, vandalism, and burglary data. This suggests that mature models are informed by richer intelligence that more directly reflects the realities of store-level risk.

3. Operational and Strategic Use

The strongest differences were evident in how model outputs are used. Established models are more likely to inform frontline deployment, resource allocation, loss prevention strategy, and high-value property decisions. This demonstrates that maturity is closely linked to organisational trust and the willingness to embed model outputs into consequential decisions.

4. Testing and Validation

Established models were more likely to have undergone formal testing or been used in defensibility contexts, whereas developing models were more likely never to have been formally validated. This highlights the importance of governance, assurance, and evidencing model credibility as capabilities mature.

5. Frequency of Data Refresh and Dynamic Updating

Established models have the ability to be updated more frequently, with a greater likelihood of real-time or frequent refresh cycles. This reflects stronger technical infrastructure and enables organisations to respond more quickly to emerging threats and changing crime patterns, rather than relying on static or retrospective analysis.

Retail Crime Control Personas

‘The Firefighter

The Firefighter relies largely on instinct, local experience, and reactive responses to crime. Data is incomplete, inconsistently captured, or fragmented, and there is little structured assessment of risk across locations. Decisions are made in response to incidents rather than anticipated pressures, making it difficult to prioritise resources, demonstrate foresight, or defend decisions when challenged.

‘The Reactive Investigator

The Reactive Investigator recognises the value of crime risk modelling and has begun to formalise its approach, often building on historical incident data and basic external indicators. While insights are generated, the model is primarily retrospective and used to explain what has happened rather than anticipate what might occur next. Decision-making still relies heavily on local knowledge and experience, with the model playing a supporting role at times.

‘The Analyst

The Analyst has a well-developed crime risk model that draws on multiple data sources and informs many operational and planning decisions. While some processes remain manual or periodic, there is clear intent to act proactively rather than purely reactively. The model is respected within key functions, supports consistent decision-making, and is increasingly used to justify resource allocation and risk mitigation strategies

‘The Intelligence-led Strategist

The Intelligence-led Strategist systematically monitors a wide range of internal and external risk indicators and uses them to anticipate where risk is increasing. Crime risk intelligence is embedded across the business and informs proactive, proportionate interventions. Decisions about security, staffing, and investment are demonstrably data-led, defensible, and aligned to wider business objectives. The model is trusted, continuously refined, and used as a strategic asset rather than a technical tool.

The Self-Assessment Tool

The Self-Assessment Tool is provided in appendix 1 below, or you can fill it out online or  download the Retail Crime Risk Model Self Assessment tool from the ECR Retail Loss Website.

Importantly, participants and their crime control function can – and often do – reflect different personas across the five elements. For example, they could be ‘A Firefighter’ on their use of internal data yet an ‘Intelligence-led Strategist’ on how well the risk model is integrated and has status within the business. The assessment tool provides for this granularity which will help to focus attention to where it is most needed.

Conclusion

This report has outlined a patchwork of approaches to crime risk modelling in the retail sector. We reveal that a significant number of retailers do not currently operate with a crime risk model, typically citing issues relating to financial investment, lack of time, and concerns about the reliability of data as the main blockers to adoption. One in five businesses surveyed (21%) reported having no risk model in place at the time of the survey; 33% were either unfamiliar with the concept or unclear about its potential benefits thus indicating an industry need to strengthen awareness and build capability.

Overall, cost, lack of resource, and lack of time were identified as barriers to risk model adoption by a combined 42% of those without a model. Unreliable data was also flagged by 17% of respondents as a reason for not having a risk model. This theme was also prominent in interviews, even amongst those who had what they believed to be robust models because there was still underlying concern that data capture was not as accurate or comprehensive as they would like it to be.

Nearly three quarters of survey participants stated that they had one or more crime risk models in operation but just 44% regarded their approach as “established” and the other 56% reported that it required further development. It’s important to highlight that given the absence of an agreed industry benchmark, it is difficult to determine whether what one business considers “established” would be viewed the same way by another.

From Data Lakes to Actionable Intelligence

As bricks-and-mortar stores become increasingly equipped with sensors and computer vision, the volume of data generated will inevitably rise. As this data becomes more automated and integrated into credible risk models, there is significant potential not only to improve accuracy, but also to generate more timely and actionable insights.

However, without appropriate structures, governance, and analytical frameworks, data lakes risk becoming uncontrolled floods of information: multiple streams entering the system with no clear method for organising, managing, or extracting value from them. This is a particularly important consideration as the retail sector moves further towards data-driven decision-making.

A key question remains – one that sits beyond the scope of this project – is how retailers can effectively transform large volumes of internal and external data into meaningful and operationally useful risk models. There are multiple platforms and technological approaches through which such models could be developed, each offering different capabilities and limitations. This represents a valuable opportunity for future industry collaboration, particularly around the development of shared standards, methodologies, and potentially even accreditation processes for risk models that are robustly designed, tested, and validated. For now, and as a first step, we have presented the ‘indications of model maturity’ gleaned from this study.

Indications of Model Maturity

This study identified five clear indicators that distinguish more mature crime risk models from those still under development. Collectively, they show that model maturity is not simply a matter of having a model in place, but of how comprehensively it is built, governed, and embedded within organisational decision-making.

1. Breadth of External Data Integration

Established models draw on a wider range of external data sources, including threat intelligence, population density, crime attractors, and environmental inhibitors. This indicates a more contextual understanding of risk, where organisations look beyond internal incident history to incorporate wider structural and environmental influences.

2. Depth and Relevance of Internal Data Inputs

While both groups make substantial use of internal data, established models place greater emphasis on operationally relevant and location-specific indicators such as physical surveys, robbery, vandalism, and burglary data. This suggests that mature models are informed by richer intelligence that more directly reflects the realities of store-level risk.

3. Operational and Strategic Use

The strongest differences were evident in how model outputs are used. Established models are more likely to inform frontline deployment, resource allocation, loss prevention strategy, and high-value property decisions. This demonstrates that maturity is closely linked to organisational trust and the willingness to embed model outputs into consequential decisions.

4. Testing and Validation

Established models were more likely to have undergone formal testing or been used in defensibility contexts, whereas developing models were more likely never to have been formally validated. This highlights the importance of governance, assurance, and evidencing model credibility as capabilities mature.

5. Frequency of Data Refresh and Dynamic Updating

More mature models are updated more frequently, with a greater likelihood of real-time or continuous refresh cycles. This reflects stronger technical infrastructure and enables organisations to respond more quickly to emerging threats and changing crime patterns, rather than relying on static or retrospective analysis.

Overall, these five indicators suggest that crime risk model maturity should be understood as a progression from basic analytical tools toward dynamic, trusted, and enterprise-wide decision systems. Future development is therefore likely to depend as much on data governance, operational adoption, and organisational confidence as on modelling techniques alone.

Actionable Insights

In the absence of accurate, timely and actionable data to illuminate vulnerabilities, many businesses default to reactive or fragmented responses. Some adopt scattergun tactics; others become overwhelmed, ultimately resorting to permanent store closures. By contrast, retailers that invest in a more informed, proactive and “whole-of-business”²⁰ approach (many of which participated in the ECR Retail Loss projects) demonstrate markedly greater resilience. Their strategies draw on a richer understanding of risk, and this gains them the trust and ear of other functions and often the C-suite. Ultimately, having a robust and clinical picture of retail crime risk and vulnerabilities feeds into a stronger alignment between business functions so that they pull together rather than rub against one another.

Effective retail crime risk modelling offers far more than a static snapshot of current threats. When executed well, it generates intelligence and insight that directly informs operational decisionmaking. From optimising store layouts and adjusting trading hours to refining security protocols and workforce recruitment and training, robust modelling can support retailers in directing effort and investment where they will have the greatest impact. Overall, crime risk modelling in retail can provide significant value by enabling businesses to proactively manage and mitigate crime-related threats. Its benefits are broad, but one of the most immediate is the ability to identify and understand high-risk locations and behaviours. With these insights, retailers can deploy targeted interventions that reduce theft, violence, vandalism and other harmful incidents. In essence, a well-designed risk model becomes a decision-support engine that can guide both day-to-day operations and long-term strategic planning and investment. From this research we have ascertained that a well-built, understood, and respected crime risk model can help retailers to:

• allocate finite security resources and equipment more efficiently
• avoid unnecessary or misdirected investment in low-risk stores
• inform operational decisions such as staffing levels and opening hours
• prioritise sites for new security technologies or system upgrades
• demonstrate foreseeability and due diligence to support litigation defence

In summary, as highlighted in the Fortress Stores report, a well-designed crime risk model can mean the difference between a store that is forced to close and one that can operate safely, sustainably, and profitably.

Cross-Functional Engagement with Crime Risk

Of equal importance to the direct management of criminal risk, are the less tangible yet strategically significant outcomes of effective data-driven risk modelling. From the interviews we identified several peripheral benefits including greater cross-functional engagement with criminal risks, improved organisational alignment, trust and buy-in from senior leaders and enhanced credibility with external partners such as law enforcement. When retailers can demonstrate that their decisions are grounded in rigorous, evidence-based analysis, they are better positioned to secure internal buyin, influence broader organisational priorities and elevate their status with external bodies.

Moving Towards Intelligence-led Retail Crime Control (IRCC)

As retail increasingly adopts advanced analytics and AI-driven crime risk modelling, the integration of structured methodologies such as SRM and FMEA provides a conceptual foundation for more rigorous and defensible decision-making. Together, they support a transition from reactive, incident-led loss prevention toward proactive, intelligence-led security strategies, where interventions are prioritised based on quantified risk and an understanding of underlying failure mechanisms.

Drawing inspiration from Intelligence-Led Policing (ILP) and informed by insights from the ECR Retail Loss projects Fortress Stores and the Most At-Risk Stores study, a compelling case emerges for what we term Intelligence-led Retail Crime Control (IRCC). Around the world, police forces have evolved to manage complex, dynamic patterns of offending across dispersed geographies with finite resources – challenges that closely mirror those faced by large retail estates. The retail sector can adopt and adapt this thinking to build more dynamic, intelligence-driven approaches to loss and security.

IRCC represents a shift from reactive, incident-led responses to a proactive, structured, and analytical model of crime prevention. By systematically collecting, analysing, and applying intelligence on offenders, locations, and crime patterns, IRCC enables retailers to target the highest-harm risks and optimise the allocation of scarce resources. This approach supports a more strategic use of technology, people, and process, ensuring that interventions are both proportionate and effective. In a climate where violence, organised retail crime, and prolific offending continue to escalate, IRCC offers a sustainable pathway for making bricksandmortar stores safer environments in which to work and shop.

This is not about predicting the future with a crystal ball; it is about applying a systematic, robust methodology that draws on multiple data points to identify patterns, relationships, and emerging trends across a range of factors and criminal activities. By leveraging historical incident data, criminal behaviour patterns, demographic and environmental factors, operational factors (both static and dynamic), retail businesses can begin to forecast potential risks and develop effective strategies to mitigate them. This data-rich and intelligence-led approach is undoubtedly the future of retail crime control that businesses need to transition to.

To support this transition, those working in crime, security, or loss prevention roles are encouraged to complete the selfassessment and to invite colleagues from across the business to do the same. Gaining a clear understanding of an organisation’s current risk model capability is the foundation to unlocking the power of Intelligence-led Retail Crime Control. Ultimately, the adoption of intelligenceled practices is not simply an operational enhancement; it is a strategic imperative for the future of the sector.

Appendix 1: The Retail Crime Risk Model Self-Assessment Tool

Below are a series of questions relating to five key areas of retail crime risk models. Answering these questions will generate a score for each of the components as well as an overall score.

Circle the answer that best reflects your business (1, 2, 3 or 4) and then add up your scores at the end of each section. When you have completed all 5 sections, place all your scores in the table at the end of the document.

Figure 1: Retail Crime Risk Model Personas

References

Bates, N.D. (2006) ‘Major developments in premises security liability: recent survey findings’, In Journal of Healthcare Protection Management. 22(1).

Braga et al, (2019) ‘Hot spots policing of small geographic areas effects on crime’, Campbell Systematic Reviews. 15 (3).

Brantingham, P. L., & Brantingham, P. J. (1993) ‘Nodes, paths and edges: Considerations on the complexity of crime and the physical environment’, Journal of Environmental Psychology, 13(1), 3–28.

Caplan, J. M., Kennedy, L. W., & Miller, J. (2011) ‘Risk terrain modelling: Brokering criminological theory and GIS methods for crime forecasting’, Justice Quarterly, 28(2), 360-381.

Clarke, R. and Eck, J. (2007). Understanding Risky Facilities. Washington, DC: U.S. Department of Justice.

Talbot, J. and Jakeman, M. (2009) Security Risk Management: Body of Knowledge. John Wiley & Sons: New Jersey.

Taylor, E. (2023) Fortress Stores: Keeping the Most At-Risk Grocery Stores Trading, ECR Retail Loss.

Taylor, E. (2024) Most At-Risk Stores: How to Engage Others in a Cross-Function Risk Mitigation Strategy, ECR Retail Loss.

Taylor, E. (2024) Stealing with Impunity: The Policing of Prolific Local Offenders and the Impact on Our Shops and Communities. Available at: Read now.

Taylor, E., Taylor, J. & Unsworth, J. (2024) ‘The Politics and Pitfalls of Policing High-Volume Crime: Responding to the Shoplifting Epidemic’, The Political Quarterly, 95(3).

Whitmore, M. (2024) ‘Cybersecurity Risk Management in the Retail Industry: Frameworks, Strategies, and the Target Data Breach Case Study’ in Hampton Global Business Review.

Notes

1. Taylor, E. (2023) Fortress Stores: Keeping the Most At-Risk Grocery Stores Trading, ECR Retail Loss. Available at: https://ecrloss.com/research-paper/keeping-the-most-at-risk-stores-trading/
2. Talbot, J. and Jakeman, M. (2009) Security Risk Management: Body of Knowledge. John Wiley & Sons: New Jersey.
3. Influenced by frameworks such as those developed by the International Organisation for Standardisation (e.g. ISO 31000) and professional guidance from ASIS International.
4. A good overview of FMEA is provided by the University of Cambridge’s Institute for Manufacturing, available here: https://www.ifm.eng.cam.ac.uk/research/dmg/tools-and-techniques/fmea-failure-modes-and-effects-analysis/
5. Illustrating this point, a national survey from the National Association of Convenience Stores in the USA found that 6.5% of convenience stores experienced 65% of all convenience store robberies. Reported in Clarke, R. and Eck, J. (2007). Understanding Risky Facilities. Washington, DC: U.S. Department of Justice.
6. All figures have been standardised to reflect retail-only activity, with modelling and estimates applied where necessary to ensure consistency across reporting formats.
7. Taylor, E. (2023) Fortress Stores: Keeping the Most At-Risk Grocery Stores Trading, ECR Retail Loss. Available at: https://ecrloss.com/research-paper/keeping-the-most-at-risk-stores-trading/
8. Taylor, E., Taylor, J. & Unsworth, J. (2024) ‘The Politics and Pitfalls of Policing High-Volume Crime: Responding to the Shoplifting Epidemic’, The Political Quarterly, 95(3).
9. It is presumed that the higher number of respondents compared to those outlining external variables suggests that up to 6 respondents run their retail crime risk model using internal data only.
10. The Fortress Stores report is available at: https://ecrloss.com/research-paper/keeping-the-most-at-risk-stores-trading/.
11. Environmental criminology studies how spatial environments, urban structures, and routine activities shape crime patterns and where offences cluster. For example, see Brantingham, P. L., & Brantingham, P. J. (1993) ‘Nodes, paths and edges: Considerations on the complexity of crime and the physical environment’, Journal of Environmental Psychology, 13(1): 3-28.
12. Caplan, J. M., Kennedy, L. W., & Miller, J. (2011) ‘Risk terrain modeling: Brokering criminological theory and GIS methods for crime forecasting’, Justice Quarterly, 28(2): 360-381.
13. In criminology, the broken windows theory states that visible signs of crime, antisocial behaviour and civil disorder create an environment that encourages further crime and disorder.
14. See, for example, Talbot, J. and Jakeman, M. (2009) Security Risk Management: Body of Knowledge. John Wiley & Sons: New Jersey. p.169.
15. Bates, N.D. (2006) ‘Major developments in premises security liability: recent survey findings’, In Journal of Healthcare Protection Management. 22(1):67-74.
16. See ‘Most At-Risk Stores: How to Engage Others in a Cross-Function Risk Mitigation Strategy’
17. We are cognisant of the fact that, given the level of subjectivity currently present in retail risk modelling, and the absence of an agreed industry benchmark, it is difficult to determine whether what one business considers ‘established’ would be viewed the same way by another. As such, the analysis in this section should be regarded as exploratory and inferential, rather than holding statistical significance.
18. The survey outlined 19 specific categories of data plus ‘Other’ as can be seen in Table 5.
19. Braga et al, (2019) ‘Hot spots policing of small geographic areas effects on crime’, Campbell Systematic Reviews. Vol 15: 3.
20. See ‘Most At-Risk Stores: How to Engage Others in a Cross-Function Risk Mitigation Strategy’ https://www.ecrloss.com/research/cross-function-risk-migration-strategy?from=/research
21. Taylor, E., Taylor, J. & Unsworth, J. (2024) ‘The Politics and Pitfalls of Policing High-Volume Crime: Responding to the Shoplifting Epidemic’, The Political Quarterly, 95(3), pp. 507-513.
22. Taylor, E. (2024) Stealing with Impunity: The Policing of Prolific Local Offenders and the Impact on Our Shops and Communities. Available at: Read now.

Disclaimer

The research for this report was supported by ECR Retail Loss. This report is intended for general information only. Individuals or companies are advised to take professional advice regarding their specific needs and requirements prior to taking any action resulting from anything contained in this report. Any such actions taken by individuals or companies are entirely at their own risk. Companies are also responsible for assuring themselves that they comply with all relevant laws and regulations, including those relating to intellectual property rights, data protection and competition laws or regulations. The images used in this document do not necessarily reflect the companies taking part in this research.

© 2026, all rights reserved

About the Author

Dr Emmeline Taylor is a Professor of Criminology at City St George’s, University of London and Director of Aptus Business Crime Research Centre. She specialises in understanding business crime, with a particular focus on crime and security issues impacting the retail sector both online and in bricks and mortar stores.

Professor Taylor’s career spans over 20 years, during which time she has worked in the public, private and academic sectors, and on three continents. She has been employed at universities ranked in the Global Top 20 in Singapore and Australia and is currently based in London.

Professor Taylor has published extensively on crime-related topics, including 50+ articles and chapters, and six books, the most recent of which is Armed Robbers published by Oxford University Press (based on interviews with incarcerated prisoners in six Australian prisons).

Emmeline has produced many industry reports on retail crime, including Stealing with Impunity (Co-op, 2023), Fortress Stores: How to Keep Most-at-Risk Stores Trading (ECR, 2023) and Lighting Up: How Tobacco Track and Trace Could Illuminate the Stolen Goods Markets (NBCC, 2024).

She works closely with government, police and industry and in the UK is Chair of the Business Crime Reduction Partnerships (BCRP) National Standards Board, and a member of the Home Office Retail Crime Forum chaired by the UK’s Minister for Crime and Policing. Emmeline is the host of the podcast Retail Crime Uncovered.

Recent reports by the author:

Acknowledgments

We are hugely thankful for the enthusiasm and generous participation of retail businesses globally. There is clearly appetite to better understand how data can be collected and analysed to provide insights into current and emerging risks and inform decision making to assist in mitigating vulnerabilities. We are very grateful to all of those who gave their time to participate in interviews, focus group discussions and complete the online survey. Without these valuable insights the project would not have been possible.

About ECR Retail Loss

ECR Retail Loss is part of ECR Community, a voluntary and collaborative retailer-manufacturer platform with a mission to ‘fulfil consumer wishes better, faster and at less cost’. Over the last 26 years, the Group has acted as an independent think tank focused on creating imaginative new ways to better manage the problems of loss and on-shelf availability across the retail industry. Championing the idea of Sell More and Lose Less, the group is open for any retailer and manufacturer to join.

For further information: https://www.ecrloss.com

Research commissioned by the ECR Retail Loss Group is made possible by independent research grants provided by Axon, Checkpoint Systems, NCR Voyix, Retail Insight, RGIS and Vusion.

This report was made possible by a special additional research grant from Cap Index