Retail crime case management: 7 critical lessons

Retail crime case management should do more than create a digital record of an isolated incident.

At its best, it connects people, vehicles, locations, evidence and outcomes across multiple events.

It helps investigators see patterns, build stronger cases and give police information they can act on.

An incident log can tell a retailer what happened in one store on any given day.

A casefile can show that the same person, vehicle or method appears across several stores, retail brands or police areas.

ECR Retail Loss surveyed 49 retailers about their use of casefile systems.

The findings suggest that the technology is now common, but the value retailers receive from it remains uneven.

Integration is incomplete, data sharing is inconsistent, and older systems received lower average ratings in this sample.

The survey also produced a strong provider signal. However, the sample is too small and uneven to support a simple league table.

The more useful conclusion is that retail crime case management creates most value when it helps retailers join up incidents, prepare good evidence and collaborate with police and trusted partners.

The central lesson: Don’t judge a casefile system by how much information it stores. Judge it by the connections, decisions and outcomes it enables.

What retail crime case management should cover

Retailers use several overlapping terms for the systems that handle crime and security information.

Incident reporting, case management, investigation management, evidence management and retail crime intelligence are related, but they’re not identical.

Incident reporting captures the first account of an event: what happened, where, when and who was involved.

Retail crime case management begins when that record needs to be developed, linked, investigated and progressed.

A capable system should allow authorised teams to:

• connect several incidents to one investigation;
• link people, vehicles, locations, products and methods of offending;
• attach statements, documents, images and CCTV securely;
• record actions, decisions, owners and deadlines;
• control access to sensitive information;
• identify repeat or linked offending across an estate;
• share appropriate intelligence or evidence with trusted partners;
• create consistent evidence packs for police or law enforcement;
• track police, civil, internal and operational outcomes;
• and report on case quality, workload, value and return on investment.

The boundary matters because digitising an incident log does not automatically improve investigations.

If every offence remains a separate record, the retailer may still struggle to identify a prolific offender or organised retail crime group operating across different stores.

Our earlier work on digital incident reporting showed why complete and consistent reporting is an important first step.

Casefile management should build on that foundation rather than simply reproducing it in another system.

1. Adoption is common, but effectiveness varies

The survey found that 76% of the 49 respondents used a casefile system.

Eleven respondents said they did not, while one selected another response.

That makes retail crime case management a mainstream capability in this sample… though not a universal one.

Among the 34 respondents who rated their system’s core casefile functionality:

• 21% described it as extremely effective;
• 41% described it as very effective;
• 29% described it as somewhat effective;
• and 9% described it as not so effective.
• No respondent selected “not at all effective”.

Nearly two-thirds rated their core functionality very or extremely effective.

But the 38% who chose “somewhat” or “not so” effective are a reminder that purchasing a system is not the same as creating a mature capability.

Open comments in our survey go some way to explaining that gap. Retailers wanted:

• better reporting and analytics;
• easier case linking;
• more adaptable workflows;
• clearer auditing and approval controls;
• stronger evidence sharing and faster integrations.

In other words, the challenge was rarely an inability to store a case. It was whether the system helped teams do something useful with it.

User friendliness is also an operational requirement, not a cosmetic one.

If frontline colleagues cannot report quickly using the devices available to them, potentially useful information will be missed.

Retailers should test the interface in real working conditions and close the feedback loop by showing colleagues how their reports contributed to investigations, protective action or police outcomes.

2. A standalone casefile can become another silo

Integration was one of the clearest weak points in our survey. Of the 34 respondents who answered the integration question:

• 32% said their system integrated well with internal platforms;
• 35% reported partial or limited integration;
• 29% said it operated as a standalone system;
• and 3% had not attempted integration.

That means almost two-thirds did not report a fully integrated system.

When 12 respondents were asked why an integration was partial or unsuccessful, internal IT resources and priorities were the most common named reason, followed by technical limitations.

Vendor capability mattered, but so did the retailer’s own roadmap, data architecture and capacity to deliver change.

This is an important buying lesson.

While a strong demo can show how a platform works on its own, retailers need to test how it will work with their actual environment for:

• incident reporting;
• human resources;
• CCTV;
• licence-plate or automatic number-plate recognition;
• point-of-sale data;
• product files;
• dashboards;
• and police reporting routes.

An integration should also have an operational owner.

If the casefile depends on delayed batch uploads, manual copying or an interface nobody monitors, the theoretical connection can fail at the moment an investigator needs it.

Before implementation, map the complete path from an event in a store to a closed case.

Identify which information is created once, which system owns it, who can amend it and how a failed transfer will be detected.

Retail crime case management works best when users do not have to rebuild the same incident in several places.

3. Linking incidents is where the real value begins

One retailer summarised the ambition neatly: “Software that can ‘join up the dots’ is vital.”

The survey’s open responses repeatedly returned to linking.

Retailers valued the ability to connect cases, people and vehicles; aggregate several incidents into one investigation; map organised activity; retain evidence; and collaborate across teams.

The team is no longer asking only, “What happened in this store?” It can also ask:

• Where else has this person or vehicle appeared?
• Are several incidents using the same method?
• Is the behaviour escalating from theft to threats or violence?
• Which stores, brands or police areas are affected?
• Which offender or group accounts for the most harm?
• What evidence is missing before the case can progress?

This is the bridge between case management and retail crime intelligence.

A connected casefile can reveal a pattern that no single event would show.

It can help teams prioritise high-harm or prolific offenders instead of treating every incident as equally important.

Our work on retail crime risk models argues for combining internal and external information rather than relying on yesterday’s incident totals alone.

Retail crime case management provides part of that evidence base, but only if the information is structured consistently enough to be searched, linked and analysed.

One Operations Manager for a leading retailer highlighted a further use for linked case data: informing guarding deployment, physical security and product protection.

Aggregating that information across the estate can help retailers decide where to put people and protective measures.

The same intelligence used to build a case can therefore inform risk models and help retailers reduce opportunities for further offending.

Good system design must still leave room for professional judgement.

Automated matches can point an investigator towards a possible connection, but they should not silently turn a similarity into a finding.

Users need to see why records were linked, assess the evidence and correct false or outdated connections.

4. Police-ready evidence matters

The survey suggests that external collaboration is one area where a casefile can create the most value.

One retailer in our group highlighted the relevance of the 4Ps framework used in the UK’s response to serious and organised crime:

1. Pursue;
2. Prevent;
3. Protect;
4. and Prepare.

These cover pursuing and disrupting offenders, preventing people from becoming involved in crime, protecting people and organisations, and preparing to reduce the impact when crime occurs.

The Home Office’s Strategic Policing Requirement sets out the framework.

For retailers, linking offences and getting complete evidence to police promptly is a practical contribution to Pursue.

It can help investigators see the wider pattern of offending and support consideration of charges across multiple incidents.

This complements the Protect work described above: using the same intelligence to target guarding, physical security and product protection.

Case management can support both stronger investigations and better-informed protective decisions.

Among the respondents who used data-sharing features, the average rating for the quality of police intelligence submissions was 4.0 out of 5.

The speed of police engagement scored 3.61, the overall relationship with local police 3.67 and cross-retailer intelligence and collaboration 3.0.

Those figures are based on only 18 or 19 answers, so they should not be generalised to the whole industry. Even so, the pattern is useful.

Respondents rated the quality of what they submitted more highly than the speed or breadth of the response.

A platform can improve the evidence leaving a retailer, but it cannot remove every operational constraint facing police or partner organisations.

In practical terms, police-ready evidence means more than uploading a CCTV clip.

A good workflow should help the retailer provide:

• a clear allegation;
• accurate time and location;
• witness information;
• descriptions;
• continuity of evidence;
• relevant images or video;
• loss values;
• links to related incidents;
• and a record of what has already been done.

The College of Policing describes one operation in which retailers submit evidence electronically through a secure platform using a standardised digital theft pack.

The aim is to help police target high-harm and prolific offenders while reducing avoidable delays in evidence gathering.

The practical lesson is to agree evidence standards and reporting routes with local partners before configuring the workflow.

Depending on local arrangements, direct police reporting or secure access for authorised police users may reduce hand-offs, support subject identification and help connect related incidents.

Retailers should assess the complete operating relationship rather than assuming that a technical connection alone will improve outcomes.

Useful indicators include:

• the proportion of cases accepted without rework;
• time from incident to submission;
• evidence-pack completeness;
• police queries;
• outcomes;
• repeat offending linked;
• and investigator time saved.

A faster upload is valuable only if it improves the quality or progress of the case.

5. The provider results are a signal, not a verdict

Users working with one particular vendor (Vendor 1) recorded higher mean scores than users of the other named providers across four measures.

These are substantial observed differences, especially for recommendation and data sharing.

They deserve attention, but they do not prove that the provider caused the higher scores.

There are four reasons to resist a simple winner-and-loser interpretation.

1. The overall sample is small. Several countries and providers contributed only one or two complete responses.
2. The number of answers changes between measures.
3. Use of Vendor 1 overlaps strongly with geography and active data sharing, making it difficult to separate the effect of the platform from the environment in which it is being used.
4. This was an industry survey, not a randomised evaluation or representative market study.

The comments also show that users value different things.

• Some praised responsiveness, usability and case linking.
• Others wanted
  • more customisation;
  • stronger case-quality controls;
  • better return-on-investment reporting;
  • or faster development.

Other providers and in-house systems also attracted both positive and critical feedback.

A reasonable conclusion is that the strongest-rated group in this sample was also the group most consistently using connected data-sharing features.

Provider, implementation, operating model and collaboration are intertwined.

For retailers reviewing the market, the table is a reason to investigate what enables those scores. And not a substitute for due diligence.

Retailers who would like a copy of the anonymised findings, or who would like to discuss how their own approach compares, can email Colin Peacock at colin@ecrloss.com.

6. Data sharing needs rules as well as technology

Half of the 32 respondents to the data-sharing question said their system offered sharing and that they used it actively or to a limited extent.

Another 16% shared information through separate tools or processes, while 22% said their system did not offer the capability.

The remaining answers described other arrangements.

One respondent said a single reporting tool for retailers and police, or an alignment between their systems, would be transformational.

Another said privacy concerns prevented cross-retailer sharing, limiting the benefit they received from the platform.

Privacy is part of the operating design for retail crime case management.

Personal data about suspected offenders, witnesses, employees and victims can be sensitive, consequential and capable of causing harm if it is inaccurate or shared too widely.

Retailers need clear rules covering lawful purpose, data minimisation, accuracy, access, retention, correction, audit trails and onward sharing.

They also need to know when a data protection impact assessment or data-sharing agreement is required and how to handle an individual’s rights.

Requirements vary by jurisdiction, so local legal and data-protection advice remains essential.

For UK organisations, the Information Commissioner’s Office data-sharing guidance is the appropriate starting point, including a code of practice and a toolkit for sharing information with law enforcement.

Governance should be visible inside the workflow.

Users should understand which fields are mandatory, what can be shared, with whom, for what purpose and for how long.

Cross-retailer value does not require every retailer to see every other retailer’s records.

A governed model may instead allow authorised police users to identify related incidents across several organisations while keeping retailer access appropriately separated.

Whether this is lawful and workable will depend on the jurisdiction, purpose, permissions and controls.

The ability to share everything is not a mark of maturity. But the ability to share the right information, lawfully and accountably, is.

7. Older systems deserve a fresh look

Average ratings were lower among respondents who had used their system for more than five years.

The seven systems used for more than five years averaged 3.14 out of 5 for core functionality and 4.29 out of 10 for recommendation.

Systems in use for five years or less averaged 3.92 out of 5 for core functionality (n=25) and 7.83 out of 10 for recommendation (n=23).

Those figures do not prove that systems deteriorate simply because they are old.

The older group is small, and contains a mix of products, implementations and business contexts.

Some respondents explicitly described an end-of-life platform or plans to begin a request for proposal, which will pull the average down.

Nevertheless, age is a useful trigger for review, as retail crime, digital evidence, privacy expectations, police reporting and internal technology have all changed rapidly.

A system that met the original brief may now create duplicate effort or prevent the team from using new data sources.

Retailers should not wait for a platform to fail before reassessing it.

Review whether it:

• still supports the current operating model;
• integrates reliably;
• receives security updates;
• preserves accessible evidence;
• gives users adequate support;
• and offers a credible roadmap.

The decision is not always replacement. Better configuration, workflow simplification, training, governance or integration may recover value.

Leadership matters too.

Are teams being helped to use the system’s capabilities within the time and resources available?

Could a clearer process or better connection to another system make an older platform more useful?

The point is to review both the technology and how it is used, rather than allowing an inherited system to define how investigations work.

Your retail crime case management checklist

The survey points to ten questions for any retailer selecting, renewing or redesigning a casefile system.

1. What happens after the incident is logged?

Ask the supplier to demonstrate the journey from a store report to an investigated, reviewed and closed case.

Ensure the system manages actions and decisions, rather than only storing attachments.

2. Can it connect people, vehicles, locations and methods?

Test realistic examples involving several stores and incidents. Confirm that users can understand, challenge and correct suggested links.

3. Does it create police-ready evidence?

Agree evidence standards with police or law-enforcement partners where possible.

Check how the platform handles CCTV, statements, timestamps, continuity, exports and missing information.

4. How will it integrate with the existing environment?

List every required system, interface, owner and update frequency. Include monitoring and recovery when an integration fails.

5. What can be shared, and under which rules?

Define lawful purpose, access, retention and onward-sharing controls before rollout. Do not rely on a general statement that the platform is compliant.

6. Is the workflow simple enough for users?

Case types and mandatory fields can improve consistency, but excessive complexity encourages workarounds and incomplete reporting.

Test with the people who will use it under operational pressure.

7. Can managers audit case quality?

Retailers may need review, approval and monitoring controls for prosecution standards, professional practice and policy compliance.

Confirm these are built into the workflow and reporting.

8. How will success be measured?

Track outcomes, not just reports created.

Link the business case to case quality, time saved, repeat offending identified, police outcomes, civil recovery, loss avoided and colleague safety.

We have already explored how retailers can calculate the value of retail crime prevention more consistently.

9. What will the platform cost to change?

Understand configuration, licences, integrations, storage, support, exports and future development.

A lower entry price can become expensive if every change requires manual work or consultancy.

10. Can the retailer leave without losing its evidence?

Confirm data ownership, export formats, retention, deletion and transition support.

A casefile can remain relevant for years, so exit planning is part of evidence management.

From incident logging to joined-up action

The casefile market will continue to evolve.

Artificial intelligence may become a major differentiator

• Helping investigators draft case summaries;
• Detecting patterns;
• Linking records that may concern the same person or vehicle;
• And surfacing investigative leads.

These outputs should remain subject to human review.

Some retailers may move beyond case management

Shifting towards broader enterprise risk intelligence that connects:

• Organised retail crime;
• Fraud;
• Workplace violence;
• Internal investigations;
• And other risk domains.

It is too early to know how widespread this model will become.

Direct police reporting and wider intelligence networks

This may reduce duplicate effort, reveal cross-retailer patterns and help police prioritise.

However, resource constraints mean that even well-developed cases may not lead to action, which may increase interest in lawful intelligence sharing and other disruption strategies.

And technology cannot carry the whole burden.

Retail crime case management depends on good reporting, clear ownership, trained investigators, reliable integrations, lawful sharing and partners able to act on the evidence.

Our survey gives retailers a useful benchmark.

Most respondents have moved beyond paper or isolated spreadsheets, and many rate their systems positively.

The next stage is to move beyond digitising incidents towards connecting them.

That is where a casefile becomes intelligence, and where retail crime case management begins to justify its investment.

Acknowledgements

We thank all the retailers that took part in our research and working groups. With special thanks to the following for reviewing an earlier draft and sharing their perspectives:

• Phil Bance
• Alex Pickering
• Thomas Haley
• Don Willis

Hone your skills by signing up for our Loss Prevention Executive Leadership Programme.

Frequently asked questions

What is retail crime case management?

Retail crime case management is the structured process and technology used to develop crime or security incidents into managed investigations.

It connects evidence, documents, images, CCTV, people, vehicles, actions and outcomes.

Unlike a basic incident log, it should help authorised teams link related events, build casefiles and collaborate appropriately with police or other trusted partners.

How is case management different from retail incident reporting?

Incident reporting records the initial event: what happened, where, when and who was involved.

Case management takes that record further.

• It supports investigation;
• links several incidents or subjects;
• assigns actions;
• preserves evidence;
• records decisions;
• and tracks the case through to an internal, civil or law-enforcement outcome.

What information should a retail crime casefile contain?

A casefile should contain:

• a clear allegation;
• incident details;
• people and vehicles involved;
• relevant products and loss values;
• witness information;
• images or CCTV;
• actions taken;
• links to related incidents;
• decisions, owners and outcomes.

The exact content should reflect local law, evidence requirements, company policy and data-protection rules.

How can case management improve police engagement?

Case management can improve police engagement by producing complete, consistent and timely evidence packs, reducing duplicate requests and making linked offending easier to identify.

It cannot guarantee a police response or outcome.

Retailers should agree practical submission standards with local partners and measure acceptance, rework, speed and case outcomes.

What should retailers ask when choosing a case management system?

Retailers should test case linking, evidence handling, integrations, data-sharing controls, user experience, case-quality auditing, reporting, costs, supplier support and exit arrangements.

Demonstrations should use realistic multi-incident scenarios and show the complete workflow from store report to police, civil, internal or operational outcome.

About the survey: ECR Retail Loss reported 49 complete responses in June 2026. Detailed question bases varied from 12 to 34 because not every respondent used a system or answered every follow-up. Provider comparisons show observed associations in this sample; they are not causal findings or representative market shares.