Protect your business against crime
Common security issues, including premises safety, CCTV surveillance and dealing with security emergencies
Crimes committed against businesses can have a very high cost. Valuable stock and equipment are lost, business premises are damaged, and staff morale can be affected. In extreme cases staff could be injured. Therefore, it makes sense to take the right security measures to protect your business from crime.
Minimise crime opportunities
The security measures you should take will depend on factors such as your business location, the type of goods you sell, the type of equipment you use, your trading hours, whether you handle cash, and the staff you employ. It is important that you are aware of how you can make it more difficult, riskier and less profitable for criminals to target your business.
This guide explains the most common security issues your business is likely to face, your legal obligations, what you can do to prevent or deter crime and where you can go for more information. There is guidance on carrying out a business security survey, how to secure your business premises and how to secure your business assets including cash and stock and theft prevention. In addition this guide outlines how you can help to protect staff, using CCTV surveillance and reporting a crime against your business.
Business security survey
How to protect your business internally and externally by performing a survey to reveal weaknesses in security
To protect your business premises, you should first assess the local environment, eg street, business park or shopping centre. You can look at the level and types of crimes that are being carried out in your area using the Police Service of Northern Ireland's (PSNI's) crime mapping.
Business security survey
This assessment will form part of your first steps to performing a full security survey. A business security survey should include both an external and an internal assessment of any crime risks to your business. Try the onion-peeling principle, which involves thinking about your business and its premises as a series of layers, to conduct your survey.
Preparation for security survey
When using the onion-peeling principle, you should take security measures at each layer to delay and deter the criminal, and to protect or remove any potential targets for crime. There are three types of physical targets in most businesses:
- buildings - eg stores and garages
- property - eg cash, stock and equipment
- people - ie staff, security guards and visitors
Your aim at each layer is to:
- reduce the potential rewards of crime
- reduce any potential provocation to commit crime
- remove any potential excuses for criminal behaviour
You should concentrate on all areas of security and consider all potential targets and the effects on them, such as financial loss, temporary closure, inability to deliver goods, or staff morale. Other risks to consider include: fraud, violence, graffiti, computer data theft, etc.
When preparing your security survey, you should take into account:
- the amount and types of crime in the area using the PSNI crime mapping
- whether anyone nearby has been a victim of crime
- whether any business crime partnerships exist in the area - eg Retailers Against Crime
Use a map to identify access to your business property and potential entry and escape routes. You need to consider any escape routes for offenders that may not be easily seen.
Carrying out a security survey
Consider using a security checklist when undertaking a safety survey to ensure that you cover all areas of concern. Download the PSNI's business crime reduction self-assessment checklist (PDF, 288K).
You should keep notes on your security survey to help future security plans and make them more effective.
There are four areas to consider for your security survey:
- environment - the area around your business - eg the street or alleys bordering your premises
- perimeter - how someone could gain access to your business property from the public space
- the shell - eg doors and windows that could provide access to your buildings
- interior - ie inside the building, and how this could be protected from criminal activities
You should walk around the boundary of your business property and check for any weak areas, both during the day and when dark. Identify opportunities for crime, such as:
- walls or fences that could be climbed
- bins or other objects that could be used to climb or could be targets for arson
- tools or materials left out that could be used to break in
- possible hiding places
- any poorly lit areas that could be used as cover for a break-in
Fencing and property boundaries
Steel fencing, railings or walls of at least 2.5 metres in height can make effective boundaries for your business property. You could also use barbed or razor wire, rotating vanes or electric fence alarms at the top of fences or walls, and anti-climb paint to make access harder.
When dealing with the shell, you should think about security measures that will delay an attempted break-in or put off potential offenders.
You should pay particular attention to the:
- roof, especially a flat roof
- loading bay
- side of your business
- back of your business
You should think about how a criminal might view the business when open and closed, during the day or at night.
Secure your business premises
In order to protect your business property from crime, first carry out a business premises security survey. Once you have determined the main security risks to your business, you can decide what actions you should take.
Which security measures should I take?
The basic idea is to introduce measures that will delay and deter potential offenders from seeing your business as an easy target for crime. We have outlined below security measures that you could apply to protect your business:
- Secure access points - have strengthen doors fitted, ensure all window have locks, install strengthened shutters and ram raid barriers if necessary.
- Secure the perimeter - ensure gates are secure and fences aren't damaged or provide opportunities for access. Applying anti-climb measures can also be effective, however you must have signs to state you have them installed.
- Control access to the business by keeping a record of who has keys or passes and ensure employees that leave hand them back.
- Lighting - install security lights at dark points that will come on when movement is detected.
- Fit intruder alarms.
- Secure equipment with asset tags and record details of serial numbers. You should also consider securing devices such as laptops and tablets to larger equipment such as desks. Secure your business assets.
- Protect stock by keeping regular tabs on stock levels.
- Address IT security issues such as hard-drive encryption, off-site data storage, software security updates. Protect your business online.
- Shred sensitive paper waste.
- Install CCTV surveillance.
Any measures that you take should be legal, appropriate, realistic and cost effective.
For further guidance on securing your business property see PSNI advice on securing your business premises and download Secured By Design's security design advice for commercial property (PDF, 1.75MB).
Professional security consultants can offer a comprehensive risk assessment of any premises and can recommend security measures to meet the risks faced.
Business security: protecting staff
As an employer you have a legal duty for the health and safety of employees. Bringing in measures to improve staff safety and making employees and customers aware of their responsibilities can also improve the security of your business.
Improve staff security
Steps you can take might include:
- checking visitor and delivery personnel identities
- always checking the identity of people you deliver to
- getting signatures for the receipt and issue of goods
- CCTV system to cover entrances and exits
High security risk businesses
If your business handles a lot of cash or expensive goods, it makes sense to use a properly fitted protective screen to protect staff (eg at a cash register), closed-circuit television (CCTV) and secure storage such as a safe. See business security: cash.
If your business is at risk, or is in a high-risk area, it might also be appropriate and cost-effective to employ security guards.
Customers and business security
All customers should be asked to remove motorcycle helmets and scarves that cover a face before they enter your business premises. A height mark at the door can be used by staff to accurately gauge the height of a criminal if a report of crime needs to be made to police. If the height mark is highly visible this can also act as a deterrent for potential criminals that target your shop.
Employees who work alone
If you employ staff who work alone, you can help to reduce risks to them by using:
- personal alarms
- radio link scheme
- controlled access or CCTV with audio
- automatic warning devices
- lone-worker monitoring devices
- regular police or security checks
You could also ask staff to vary their routes and times for added security. Ensure lone workers' safety.
When a violent incident happens
Violent incidents can involve theft, angry customers or customers under the influence of alcohol or drugs. You can offer staff training in conflict management to deal with aggressive customers. Advise staff not to put themselves at risk, to move away from aggressive customers but avoid becoming isolated. PSNI business advice to protect your staff.
When necessary they should dial 999 or get help quickly by using an alarm. They should try to write down information about what happened and secure CCTV footage and the scene until the police arrive.
All such incidents should be reported to the police. This can be done by dialling 999 in an emergency, or 101 for non-emergency situations.
Read PSNI guidance through the Safe Shop initiative that helps businesses employ the principles of prevent, detect and deter in order to protect themselves from crime and promote a safer working environment.
If a member of staff is a victim of violence, they may need medical attention, which may be available in-house or may be required from the ambulance service. However, they will need your support. This might include:
- a debriefing - talking about what happened
- giving time off to recover
- suggesting specialist counselling
Other staff who witnessed the incident may also be affected. They can get help and support from Victim Support NI.
Bomb threats and suspect packages
You should ensure staff know what to do in the unlikely event of a bomb threat or a suspect package is found on your business premises. Download the PSNI's business guidance on dealing with bomb threat telephone calls and suspect packages (PDF, 212K).
Tiger kidnap involves the short-term hostage taking of family members of an employee who has immediate access to cash or valuables. The captives are frequently held overnight and the aim of the criminals is to frighten their victims to such a degree that they will not contact the police, even when they have an opportunity to do so. The PSNI have advice for businesses on reducing the risk of a tiger kidnap.
Secure your business assets
There are a few simple procedures to follow that will help to protect your assets on and off-site. Assets or property could include:
- computer equipment, laptops or tablets
- mobile phones
- information stored on computers, organisers or on paper
- business vehicles
- specialist equipment and tools
- plant and machinery
Marking business assets
You should permanently mark each piece of equipment and make a note of the:
- serial number
You should also maintain a record of all business assets, where they are located and who is responsible for them. Asset checks, as well as stock checks, should be carried out by a dedicated member of staff.
Secure essential and high-value equipment in a separate secure room.
Computer equipment and mobile phones
If a computer, laptop or tablet is lost or stolen, often the loss of information and data can be more a serious issue than the cost of a replacement. This will particularly be the case if personal information is held on the computer. It could damage your reputation, affect your business' ability to operate, put individuals at risk and result in a substantial fine. Read PSNI guidance on what you can do to protect computers in your business.
A way to address this issue would be to use cloud computing. This lets you store business information and use hardware and software remotely and securely over the internet.
Protecting business data
You should carry out an assessment of the risks and take measures to keep your physical and information assets safe. Common threats include:
- cyber crime - malicious people might gain access to your systems and alter, steal or delete data - cyber security risk management
- viruses - programs that are created to cause a nuisance or damage computer systems - detect spam, malware and virus attacks
- fraud - theft of sensitive data such as employee records or valuable intellectual property by hackers or even your own employees - business data breach and theft
- data loss - caused by any of the above or by loss of hardware - eg by a flood at your premises
Small steps can help increase data security. For example, all computers should be password protected and have internet firewall and anti-virus software. Employees who use computer equipment on a regular basis should change their passwords and back up their files regularly. Any information kept on electronic equipment should be copied and kept securely off-site and in a fire-proof safe. Protect your business online.
Every individual mobile phone can be identified by a unique International Mobile Equipment Number (IMEI). The IMEI can be found by typing *#06# into the handset and should be written down and stored securely.
Protecting business vehicles and transported goods
Any vehicles you own should be treated in the same manner as the shell of your business. You should always secure the doors and windows and have a lockable box in the cargo area. You can also add extra security, such as:
- an alarm
- a vehicle tracking system
- an immobiliser
- a steering lock
For high value vehicles and machinery, such as tractors or plant machinery, you could consider marking property or fitting a tracking device. Read PSNI guidance to help prevent plant thefts.
Reflective film on the windows will help to hide the interior. You should always make sure that anything left inside is hidden from view and use signs to let people know that nothing of value is left inside. If your business receives a lot of cash over the counter, it should be removed frequently to a secure location.
Secure lorry parks should be used for overnight stops.
For goods delivered by post, it might be appropriate to use a more secure service such as recorded or special delivery.
Building site security
Building sites are often the target of crime with a lot of high value plant, machinery and tools on site along with large quantities of materials such as cement, bricks, concrete blocks, steel and timber. Download the PSNI's guidance on how to stop building site theft (PDF, 164K).
Business security: cash
If you or your employees handle cash, try to avoid getting into a routine. It is also wise to reduce the amount of cash held on your business premises where possible. This can be done by:
- making a regular, secure payment into the bank
- transferring excess cash into a locked tamper-proof unit
- removing cash overnight - eg emptying tills
- encouraging the use of electronic payments, credit/debit cards or cheques
- paying wages straight into staff bank accounts
Keeping cash on site
If cash has to be kept on site, you should make sure it is held in a secure manner - eg a safe that is fitted to the building. Where possible the minimum amount of cash should be held in public areas and tills should be cleared regularly. Drop-safes, with time locking mechanisms should be used to ensure that cash is held securely.
Staff should not handle cash alone and anyone who deals with financial records should not handle cash. Protect your money guidance from the PSNI.
Moving cash around
When you or an employee makes a secure payment into the bank, it should not be made alone. It is also advisable to vary the times and the route used. Restrict information about cash movement to those directly involved and consider using a professional cash-in-transit business.
Stained and counterfeit cash
Encourage your staff to be aware of the risk of accepting stained notes as these could have been stolen. Notes become stained when a cash degradation system has been set off during a robbery. These systems are used in tills (by banks, post offices, building societies and retail outlets), cashpoints and in cash boxes used by cash-in-transit companies who deliver and collect cash. Download PSNI business guidance on identifying counterfeit currency (PDF, 64K).
If you are offered a stained note by a member of the public, treat it as you would a mutilated or damaged note and do not accept it. Advise the customer to take the note to a Post Office or bank and obtain a Bank of England Mutilated Note (BMN) claim form for the repayment of damaged notes see further information on damaged and contaminated banknotes. By filling in this form and going through the proper channels, providing the note is genuine, they will be reimbursed for the note they have handed in.
There are a number of ways to tell if a note is counterfeit or genuine. It is illegal to keep or pass on fake notes. Stopping criminals from spending stained or counterfeit notes helps to remove the incentive for crime.
The number of cheques being used has declined in preference to the use of online banking and electronic payment systems. These systems having the benefit of additional security and anti-fraud measures. In spite of this cheque fraud has become more organised and sophisticated with advances in computer and printing technology.
When writing cheques:
- always fill out cheques with the full details of the payee
- avoid any blank spaces and rule out any unused space
- when sending by post, it is best to send securely and not use a windowed envelope
- store cheques securely and use them in serial number order
- be sure to compare cheques written with the correct paperwork
- destroy spoiled cheques by shredding if possible
When accepting cheques:
- ensure they are written, signed and torn out in front of you
- check that date and amount are correct
- don't release goods before bank drafts are cleared
- if you receive a cheque for far too much and are asked to send the balance back to the drawer by electronic funds transfer, this is probably a scam where the cheque will bounce but your account is still debited
Debit or credit cards
You must have procedures in place for handling credit and debit cards. The secure chip and pin system should be used where possible. If you are unable to use chip and pin, you should check the cards for:
- start and expiry dates
- signs of tampering
- matching number on the card and till printout
- matching signature
If in doubt, you can always phone the card issuer for authorisation. You can get guidance on accepting card payments from the UK Cards Association.
Contactless payment has become a more popular method of paying through cards as well as wearable and mobile devices. Read UK Cards Association guidance on accepting contactless payments.
Business security: stock and theft prevention
Keeping stock secure depends on knowing what you have and where it is located, so you should keep records of when stock is sold, used, replaced or thrown away. In order to keep stock secure, you should:
- keep records of stock with regular stock checks - including deliveries
- stock control system - ensure a system of reporting stock variations is in place and amendments to the records only take place after authorisation, see stock control systems - keeping track using computer software
- keep stock away from doors and in a place where it takes an obvious action to reach
- use secure lockable, fireproof cabinets or rooms for high-value stock
- use mirrors or closed-circuit television (CCTV) to keep stock and equipment monitored
- try to limit the number of people who have access to valuable stock
Thieves and shoplifters
Staff should always be vigilant for any suspicious behaviour and should take appropriate action, such as reporting an incident. Suspicious behaviour could include:
- choosing purchases quickly
- trying to rush the transaction
- working in groups to distract your staff
- splitting purchases between different debit or credit cards
To find out what else you can do to deter this type of crime, see top tips to reduce shoplifting.
Police guidance to minimise theft for retail businesses
The PSNI has produced a number of information leaflets to help local retail businesses minimise crime:
- Protecting your business - advice for retailers (PDF, 200K)
- Preventing retail burglary (PDF, 104K)
- Safe Shop Scheme (PDF, 948K)
- Shop powers: preventing entry, right of search, right to remove, powers of arrest (PDF, 64K)
Prevent theft by staff
There are a number of measures you can take to combat theft by staff, for example:
- create an honest work culture - educate your staff about the potential costs of theft and have a clear, communicated policy on this issue
- restrict access to warehouses, stockrooms and stationery cupboards
- install CCTV in staff car parks
- regularly change staff who control stock to avoid collusion or bad practice
Before you employ a new staff member, you should check the identity of the staff member and their references thoroughly.
You are also required to check that potential employees have the right to work in the UK. See pre-employment checks.
Reporting a crime against your business
If you need to report a crime against your business, in an emergency dial 999.
For non-emergency incidents and general enquiries, dial 101 - the Police Service of Northern Ireland's (PSNI) non-emergency number. A trained member of staff will take your call. Contact the PSNI.
When you ring the police to report a crime, the police will give you a Crime Index number. Keep this number for future reference, as you might need it when discussing the incident or accessing police records.
You can also report crime anonymously by calling Crimestoppers, an independent charity helping law enforcement to locate criminals and help solve crimes. You can call Crimestoppers on Tel 0800 555 111.
Preventing identity theft, scams and fraud
Identity theft and fraud is an increasing risk for businesses, particularly those that carry out any part of their business online.
The target of a fraud may be an individual within the business or the business itself. Criminals use a wide range of methods and approaches to commit their crimes. The aim is usually to steal sufficient information to assume the identity of the person or business with the aim of obtaining goods, services or credit fraudulently.
One of the most common methods of stealing your corporate identity is through your IT system. Fraudsters may use 'malware' to access usernames, passwords or bank details - detect spam, malware and virus attacks.
Another method is the use of phishing websites which use keystroke logging software to record your keyboard strokes as a way of stealing financial details. Protect your business against phishing.
Protect your business from scams
There are many forms of scams designed specifically to target businesses. You should familiarise yourself and your staff with key signs of a scam. See PSNI business guidance on scams, cons, tricks and fraud.
Minimise the risk of identity theft and fraud
To prevent IT fraud your business should implement anti-virus software and firewalls. You should also introduce internet and email policies to reduce the risk of employees inadvertently disclosing sensitive information. See how to protect your business online.
Another scam involves fraudsters stealing your entire corporate identity. Fraudsters attempt to do this by changing the information your business has registered with Companies House. Find out how you can protect your company from corporate identity theft.
You can help prevent identity fraud through the secure destruction of sensitive business information. When you need to destroy information in paper or electronic formats, make sure that you use reputable suppliers that comply with European standards, particularly EN 15713.
Business security plans and procedures
Your business should have adequate security and safety procedures and staff should be made aware of them. This could be anything from a simple procedure like locking a delivery door immediately after deliveries, or a more complex procedure like using security staff or an alarm system.
Locking up after close of business
You should also have a set procedure for securing your business premises. This should involve checking that all doors and windows are locked, lights and computers are switched off and the alarm and any other security measures are switched on. Pay special attention to areas where you store combustible materials or rubbish. Regularly test fire and smoke detectors to make sure they work.
You should consider a security plan to protect both equipment and information, such as:
- removing equipment from a vehicle overnight
- storing equipment securely
- locking the equipment room
- encouraging staff to be vigilant
Using signs as a security measure
A well-placed sign can help put off a criminal. For example, you could use signs stating:
- all property marked and easy to identify
- no cash held on premises
- staff have no access to the safe
- all tools removed from this vehicle
- closed-circuit television (CCTV) in operation
- no stock left overnight
All employees should be aware of their security duties and you should check that your security measures are followed.
When necessary, employees should dial 999 or get help quickly by using an alarm. They should also try to write down information about the incident and secure CCTV footage and the scene until the police arrive.
For more information, see business continuity and crisis management.
Closed-circuit television (CCTV) uses cameras to monitor the inside and/or outside of your premises. Some CCTV systems require manual operation, either by a private monitoring company or an appropriate member of staff.
Benefits of CCTV
CCTV can help by:
- deterring thieves
- watching remote areas or more than one area at once
- enabling premises to be watched in safety
- helping police to identify and prosecute intruders
Choosing a CCTV system
Your choice of CCTV system will depend on the value of your stock, machinery or office equipment and the type and location of your premises.
Ask your insurance company or crime prevention officer for advice. You can find an approved security supplier.
Placing the cameras
Position cameras in areas:
- particularly vulnerable to intruders
- where staff could be alone or at risk, such as car parks
- hidden from view or which are particularly quiet
You should put up a notice stating that you have a CCTV system. Cameras need to be easy to spot to have a deterrent effect. You can use dummy cameras as a cheap deterrent, either on their own or to make a real CCTV system look bigger. However, relying heavily on these is risky because potential thieves might realise they are fake. Try to:
- protect cameras from attack
- avoid blocking camera views with high-sided vans, trees, etc
- adopt a tape archive system that can be used as evidence if necessary
Make sure that the system is correctly set up and that tapes are capable of recording images clearly. If the system is not recording images sufficiently it may be difficult to identify the perpetrators.
Your insurers may specify the kind of system they want you to install. They may also want your system and installer to be inspected by the National Security Inspectorate (NSI) or SSAIB.
CCTV and data protection
If your business uses closed-circuit television (CCTV), you have a legal duty under the Data Protection Act to make sure that individuals' rights are protected. You usually have to register with the Information Commissioner's Office (ICO) if your business operates CCTV. Failure to do may be a criminal offence and you could face a fine. See if you need to register with the ICO.
CCTV operators must follow the correct procedures when they gather, store and handle images:
- You must tell people that they may be recorded by CCTV, eg by displaying signs. These must be clearly visible and readable. See the ICO's guidance on the right to be informed.
- Individuals have the right to request images that you have recorded of them. You must provide these within one calendar month. See the ICO's guidance on the right of access to personal data.
- Release of CCTV images must be controlled and in line with the system's intended purpose. For example, if the system is intended to help prevent and detect crime, you can disclose images to law enforcement agencies.
- You should only keep recorded images for as long as needed. See the ICO's guidance on data storage limitation.