Security Risk Assessment and Program Consulting

Site Security Risk Assessments

A risk assessment identifies what needs protecting, what threatens it, how likely those threats are and what the consequences would be. We review incident and shrink history, local crime data, operating hours, staffing, existing technology and how the site is used day to day.

Our methodology draws on recognized frameworks, including the ANSI/ASIS/RIMS RA.1 Risk Assessment Standard and ISO 31000 risk management principles. Findings are ranked by risk so budget goes to the controls that matter most.

• Asset and critical area identification, including stockrooms, high-value displays and cash handling
• Threat review covering theft, organized retail crime, workplace violence, trespass and protest activity
• Review of existing officer coverage, technology, policies and incident reporting
• Prioritized recommendations with operational, technology and staffing options

Vulnerability Assessments and CPTED Reviews

A vulnerability assessment tests how well current controls hold up. We walk the site at different times of day, observe entrances, fitting rooms, receiving and emergency exits, and check whether locks, cameras, EAS, lighting and procedures work as intended.

Crime Prevention Through Environmental Design (CPTED) reviews look at how the physical environment supports or undermines security, using the principles of natural surveillance, natural access control, territorial reinforcement and maintenance. Recommendations are checked against life safety and accessibility obligations, including NFPA 101 Life Safety Code egress requirements and the ADA, so a security change does not create a compliance problem.

Post Order Design

Post orders are the working instructions for every officer on a post. When they are generic or out of date, service becomes inconsistent, escalations are missed and the record after an incident is weak.

We write site-specific post orders that define duties, patrol routes, customer engagement standards, use of force limits, detention and escalation procedures consistent with state law and client policy, emergency response and reporting requirements. Post orders are delivered digitally through PostControl, so updates reach every officer on the post and acknowledgment is recorded.

Staffing Models and Program Design

Staffing models translate risk into hours and posts. We map traffic patterns, trading hours, high-risk periods and site layout to recommend post locations, coverage windows, relief and break coverage, and the officer classification for each post.

Classification follows MGP’s Officer Tier Structure, from Tier I Entry-Level and Tier II Experienced officers to Tier III Retired Law Enforcement and Tier IV Off-Duty Law Enforcement, matched to the duties and risk at each post. A program can combine on-site officers, remote video monitoring, mobile response and client loss prevention staff in a single documented design.

Multi-Site Program Audits

Security programs that grow store by store often drift: different post orders, different reporting and different standards for the same role. A multi-site audit measures each location against a common baseline and shows where the program is consistent and where it is not.

Audits cover post order compliance, officer appearance and conduct, patrol and reporting discipline, incident documentation quality, licensing and training records, and alignment with the client’s loss prevention and GSOC procedures. Findings are reported by site and across the portfolio, with a corrective action plan for each gap.

How an Engagement Works

Engagements are scoped to the decision the client needs to make, whether that is a single store opening, a regional rollout or a full portfolio review. An assessment can be scoped on its own or lead into an MGP staffing program.

• Scoping call to confirm sites, objectives, timeline and stakeholders
• Document and data review, including incident history and existing post orders
• On-site assessment and stakeholder interviews
• Written report with prioritized findings and recommendations
• Implementation support, including post orders, staffing plans and training

Frequently Asked Questions

What is the difference between a risk assessment and a vulnerability assessment?

A risk assessment looks at threats, likelihood and consequences across a site or portfolio to decide what to prioritize. A vulnerability assessment tests how well specific controls, such as locks, cameras, procedures and staffing, hold up against those threats. Most engagements include both.

Do I have to use MGP officers to engage MGP for an assessment?

No. Assessments and audits can be scoped on their own. Clients use the findings to guide an internal program, an existing provider or a competitive bid.

Is MGP certified in CPTED or ASIS standards?

MGP applies recognized frameworks, including CPTED principles, ASIS standards and ISO 31000 risk management concepts, in its assessment methodology. We do not represent these as certifications held by the company.

Can you audit a program run by another security provider?

Yes. Audits measure performance against a defined baseline regardless of who provides the officers, and report findings by site with corrective actions.

What do we receive at the end of an assessment?

A written report with prioritized findings and recommendations and, where in scope, draft post orders and a staffing model ready for implementation.

Do your recommendations account for fire code and accessibility?

Yes. Physical security recommendations are reviewed against life safety and accessibility obligations, including NFPA 101 egress requirements and the ADA. Final changes should be confirmed with the client’s facilities team and the local authority having jurisdiction.

Related Services

• Luxury Retail Asset Protection
• Retail Security Services
• Remote Video Monitoring
• Commercial Security Guard Services
• Off-Duty Police Officers
• School Security