Retail crime risk model: 5 red flags that yours needs attention
Does your retail crime risk model help you stay ahead of crime, or only give you yesterday’s news?
Would you confidently bet your next £10 million of security investment on your retail crime risk model?
Not your instincts, your experience, nor the fact you’ve “always known” which stores keep you awake at night.
But your retail crime risk model.
That’s increasingly the question facing retail leaders worldwide, because:
- Organised retail crime is becoming more sophisticated;
- Violence towards retail colleagues continues to rise in many markets;
- And security budgets remain finite.
At the same time, boards expect every investment in guards, CCTV, body-worn cameras and product protection to be backed by evidence rather than intuition.
Yet new research from ECR Retail Loss suggests many retailers still cannot answer that question with confidence.
The study involves more than 70 retail businesses, with a combined turnover of around €3 trillion and around 230,000 stores.
It found that more than two-thirds of retailers (68%) do not have an established retail crime risk model they can confidently rely upon.
And more than one in four (27%) have no crime risk model at all.
That matters because the retailers pulling ahead are no longer simply reacting to crime.
They’re predicting where risk is developing, understanding why it’s emerging, and directing resources before problems escalate.
The author, Prof Emmeline Taylor, argues that the future is Intelligence-led Retail Crime Control.
It uses better intelligence to make better decisions before crime occurs rather than simply responding after the event.
From fortress stores to intelligence-led retail crime control
This report is more than another piece of retail crime research.
It completes what Prof Taylor describes as a trilogy of studies examining how retailers identify, understand and respond to crime.
The first explored Fortress Stores—those locations where rising crime threatened their long-term viability.
The second examined how retailers could engage departments beyond loss prevention to reduce crime more effectively.
This latest report asks perhaps the most fundamental question of all:
How do you objectively identify your highest-risk stores before deciding where to invest finite security resources?
Prof Taylor explains: “I consider this project a trilogy looking at high-risk stores; their identification and how to mitigate the vulnerabilities they present. This research really gets to grips with understanding how you know where your most challenging stores are, and where you need to deploy your finite resources.”
Because if you cannot answer that question confidently, every decision that follows becomes harder.
- Where should guards be deployed?
- Which stores justify additional technology?
- Where should product protection be increased?
- Which locations need more staff training?
- Should trading hours change?
- Should a new store even open in a particular location?
Without a robust retail crime risk model, those decisions inevitably become influenced by anecdotes, experience and whoever shouts loudest.
Good businesses deserve something better than educated guesswork.
What is a retail crime risk model?
One of the first discoveries made during the research was surprisingly simple.
Many retailers were using the terms risk assessment, risk register and risk model interchangeably.
They are not the same thing.
- Risk assessment … Identifies potential risks.
- Risk register … Records and monitors identified risks.
- Retail crime risk model … Uses multiple data sources to estimate where crime risk is highest, why it exists and what the business should do about it.
That distinction matters.
A mature retail crime risk model doesn’t simply explain what happened last month.
It helps predict where tomorrow’s problems may emerge.
It moves the conversation from: “Where did crime happen?”
To: “Where is crime most likely to happen next—and what should we do before it does?”
And that shift changes everything.
Retail crime control is still dominated by firefighting
At first glance, the industry’s progress looks encouraging.
Almost three-quarters of participating retailers (73%) already operate some form of crime risk model.
However, look more closely and a different picture emerges.
Only 44% of those businesses describe their model as established.
The remainder are still refining, testing or developing their approach.
Taken together, that means more than two-thirds of retailers still lack an established crime risk model.
That’s a surprisingly immature position for an industry investing millions every year in crime prevention.
Many businesses are making significant operational and investment decisions without complete confidence that the data behind them accurately reflects reality.
One experienced retailer captured the problem perfectly: “Sometimes you’ll look at a store rating and have a gut feeling it’s not accurate.”
The answer isn’t to abandon the model; it’s to improve it.
Because when the model and experience disagree, one of the two is trying to tell you something.
Five red flags that show your retail crime risk model needs attention
The report identifies five characteristics that distinguish mature models from developing ones.
Turn them around, and they become five warning signs that many retailers will instantly recognise.
If several sound familiar, your organisation may still be operating in what the report describes as firefighting mode.
1. You’re blind to the outside world
Many crime models remain almost entirely inward-looking.
They rely heavily on theft reports, violence reports, and shrink data generated inside the business.
Those measures are valuable.
But they only tell part of the story.
Established models draw on a much richer understanding of what’s happening outside the four walls of the store.
That includes:
- Police crime statistics
- Threat intelligence
- Population density
- Transport hubs
- Deprivation levels
- Organised retail crime intelligence
- Characteristics of the surrounding environment
These factors often explain why crime emerges in particular locations long before internal incident reports begin to reveal the pattern.
The research found that retailers with established models were nearly four times more likely to use threat intelligence platforms and almost five times more likely to include population density than those still developing their approach.
The lesson isn’t to collect every available dataset.
It’s to understand the environment in which crime develops.
2. Your internal data is too thin
Incident reports remain the foundation of almost every retail crime risk model.
More than 90% include theft, and nearly 87% include violent incidents.
Yet many potentially valuable indicators barely feature at all.
Among the factors less commonly incorporated are:
- staff turnover
- employee engagement
- dismissals
- trading hours
- physical surveys
- audit scores
- vandalism
- burglary
- store characteristics
Taken individually, none tells the whole story.
Together, they begin to explain why risk differs between two apparently similar stores.
One participant warned against building what they called a “kitchen sink model.”
Another had assembled 144 variables, many measuring essentially the same underlying condition and inadvertently giving it additional weight.
The objective isn’t to build the biggest model.
It’s to build the one that best explains risk in your business.
3. Your retail crime risk model sits in a loss-prevention silo
A mature retail crime risk model should influence far more than where guards are deployed or which stores receive additional CCTV.
It should become part of the way the business makes decisions.
The research found that more mature organisations were increasingly using their models to shape operational and strategic choices beyond loss prevention.
Security investment remained the most common application, but mature models also influenced product protection, staffing, property decisions, merchandising and store design.
One senior US grocery retailer described how crime risk modelling now influences decisions ranging from late-night trading hours to the extent of self-checkout, additional staff training, merchandising, product protection and shopping trolley controls.
That’s an important shift.
Rather than simply asking, “Where should we put another security guard?”, mature organisations begin asking:
- Should this store trade until midnight?
- Does this location need a different staffing profile?
- Would changing the merchandising reduce opportunity?
- Is additional product protection justified?
- Should this proposed location even become a store?
Crime risk stops being a loss-prevention problem.
And it becomes a business planning problem.
4. You’ve never tested your retail crime risk model
One statistic from the research should make every retail executive pause.
Among retailers able to answer the question, only 34% said their retail crime risk model had been formally tested.
That’s rather like buying a smoke alarm and never checking whether the batteries work.
A risk model only becomes valuable if the business knows it accurately predicts risk.
- Does a store identified as high risk actually experience more incidents?
- Have important variables been missed?
- Are some variables carrying too much weight?
- Has the neighbourhood changed?
Without testing, nobody really knows.
“This is where I think risk modelling becomes really exciting because it enables the testing of the different variables until you feel that you have something robust and valid for your particular business,” says Prof Taylor.
Testing isn’t only good practice. Increasingly, it may become an important legal safeguard.
As retail crime becomes more organised and more violent, businesses are likely to face greater scrutiny over whether foreseeable risks were properly understood and whether reasonable preventative measures were taken.
A documented, evidence-based process is always likely to be more persuasive than relying solely on experience or instinct.
5. Your retail crime risk model is frozen in time
Crime doesn’t stand still, and neither should your data.
Many organisations continue to refresh their models quarterly, or even annually.
That may be perfectly appropriate for long-term strategic investment decisions.
But operational crime risk changes much faster.
- A new transport hub opens.
- A prolific offender is arrested.
- A neighbouring retailer closes.
- Civil disorder erupts.
- Seasonal trading changes customer behaviour.
The report found that more mature retailers were more likely to refresh dynamic data frequently, enabling them to respond more quickly to emerging threats rather than relying solely on historical trends.
The goal isn’t necessarily real-time updates for every variable.
It’s ensuring the refresh cycle matches the decisions the model is intended to support.
Which retail crime control persona are you?
One of the most practical outcomes from the research is a free Retail Crime Risk Model Self-Assessment.
Rather than producing a simple score, it identifies which of the four personas most closely reflects your organisation’s current approach.
- The Firefighter
Crime is managed incident by incident. Decisions rely heavily on experience, intuition and yesterday’s events. - The Reactive Investigator
The organisation has begun building a structured approach, but still relies predominantly on historical data and reactive analysis. - The Analyst
Multiple internal and external data sources are being combined to support operational decision-making, with growing confidence in the outputs. - The Intelligence-led Strategist
Crime intelligence is embedded across the organisation. Data, criminology and business strategy combine to drive proactive, evidence-based decisions.
Importantly, few organisations fit perfectly into a single category.
Many discover they behave like an Intelligence-led Strategist in one area while remaining a Firefighter in another.
That’s precisely why the self-assessment exists: to identify where progress is being made and where the next opportunities lie.
When your model disagrees with your instinct
Perhaps the most refreshing conclusion from the research is that mature organisations don’t blindly trust either the data or their own experience.
They use each to challenge the other.
Most experienced loss-prevention professionals know the feeling.
A report arrives ranking a particular store as relatively low risk. Yet something doesn’t feel right.
The temptation is to dismiss the model, but the research suggests a different response: curiosity.
Perhaps the data is incomplete, one variable has been given too much weight, or another has been overlooked.
Perhaps the surrounding neighbourhood has changed faster than the available data.
Or perhaps the model has uncovered something the business hadn’t yet recognised.
One retailer described a supposedly low-risk store that was nevertheless reporting unusually high shrink.
Rather than dismissing the result, the investigation uncovered an internal theft problem that had previously gone unnoticed.
In other words, anomalies aren’t necessarily evidence that the model has failed.
Sometimes they’re evidence that the business has something important left to discover.
From firefighting to intelligence-led retail crime control
Ultimately, the report argues that the retail crime risk model isn’t the destination; it’s the foundation.
The bigger ambition is something ECR Retail Loss calls Intelligence-led Retail Crime Control.
Instead of asking: “Where did we experience the most crime last year?”
The smart business begins by asking: “Where is risk developing, why is it developing, and what intervention is most likely to prevent it?”
Businesses like Ahold Delhaize USA recognise that as a fundamentally different conversation.
“Crime risk modelling is changing the conversation in our business. Instead of debating where problems may exist, we can use data and evidence to better identify areas of risk, guide investment decisions, and demonstrate the impact of our interventions. That’s becoming increasingly important in today’s retail environment,” says James Cosseboom, Director of Asset Protection at Ahold Delhaize USA.
That shift—from opinions to evidence—is perhaps the report’s most significant finding.
Because a mature retail crime risk model doesn’t simply help loss prevention teams.
It gives operations, finance, HR, property and commercial teams a common evidence base for making better decisions.
The real question isn’t whether you have a retail crime risk model
The report leaves readers with an uncomfortable but important challenge.
- Most retailers already have data.
- Many already have dashboards.
- Some already have sophisticated analytics.
But that isn’t the same as having an effective retail crime risk model.
The real test isn’t whether the business can produce an impressive heat map.
It’s whether that heat map consistently leads to better decisions.
Prof Taylor’s research shows the direction of travel is already clear.
The retailers making the greatest progress aren’t necessarily collecting the most data.
They’re using better intelligence to make better decisions.
So perhaps the most important question isn’t whether you have a retail crime risk model.
Rather, you should ask yourself: “Would we confidently trust it to decide where our next £10 million of security investment should go?”
If you’re not entirely sure of the answer, now might be the right time to find out.
