Retail Security Risk Management: Shrinkage, Staff Safety and the Law

Shrinkage

Shrinkage is the difference between the stock a retailer should have and the stock it actually has. It includes customer theft, internal theft, fraud (including refund and gift card fraud), supplier error and administrative mistakes such as mis-scanned deliveries. Security officers mainly influence external theft and some forms of fraud. Internal theft and process errors need controls from operations, finance and HR as well.

Violence and abuse toward staff

For many retailers, abuse and violence toward colleagues are now the more pressing concern. HSE defines work-related violence as any incident in which a person is abused, threatened or assaulted in circumstances relating to their work. That definition includes verbal abuse and threats, in person, online or by phone, as well as physical attacks. Common triggers in retail include challenges over shop theft, age-restricted sales, refusals of service and queues.

The UK Government’s retail crime factsheet for the Crime and Policing Act 2026 summarises several sources, including ONS crime statistics and retail industry surveys, on the scale of shop theft and of violence and abuse toward shop workers, and notes that only a small proportion of retail crime reaches the police. Retailers should use their own incident data to understand how those national trends play out in each store.

Other risks

• organised groups targeting specific product lines;
• anti-social behaviour around entrances, car parks and late-opening stores;
• burglary and ram-raids out of hours;
• cash handling and delivery risks;
• risks to lone workers opening and closing stores.

England and Wales: the Crime and Policing Act 2026

The Crime and Policing Act 2026 received Royal Assent on 29 April 2026. Part 3 deals with retail crime:

• Section 45 creates an offence of assaulting a retail worker at work. It covers people working on or about retail premises for or on behalf of the owner or occupier, as well as the owner or occupier, and includes unpaid work. It is a summary offence. The Government’s factsheet describes the maximum penalty as six months’ imprisonment, an unlimited fine or both.
• Section 46 places a duty on courts to make a criminal behaviour order on conviction for an offender aged 18 or over, unless exceptional circumstances justify not doing so. Such an order could, for example, bar the offender from specified shops.
• Section 47 removes the rule that shop theft of goods worth £200 or less is a summary-only offence, so all shop theft would be triable either way.

Important: at the time of writing, legislation.gov.uk shows sections 45 and 47 as prospective, meaning they were not in force at Royal Assent and will commence on a date set by regulations. Retailers should check the current status before relying on them in policies or staff communications.

Separately, an existing provision already applies. Section 68A of the Sentencing Code (Sentencing Act 2020), inserted in 2022, requires courts to treat an offence against a person providing services to the public as an aggravating factor. That provision applies to many retail workers today.

Scotland

The Protection of Workers (Retail and Age-restricted Goods and Services) (Scotland) Act 2021 already makes it an offence to assault, threaten or abuse a retail worker engaged in retail work, where the offender knows or ought to know that the person is a retail worker. Retailers operating in Scotland should reflect this in their staff guidance.

Health and safety duties

Whatever the criminal law says, employers have a duty to protect workers from violence and aggression. HSE’s guidance expects employers to assess the risks, put suitable control measures in place, respond to incidents and support affected workers. Where a violent incident causes a reportable injury, RIDDOR may also apply: the RIDDOR definition of an accident includes an act of non-consensual physical violence done to a person at work.

1. Gather data. Incident logs, stock loss figures by product line, refund reports, CCTV reviews and staff feedback.
2. Identify hotspots. Times of day, entrances, aisles, tills and product categories where incidents cluster.
3. Assess who could be harmed and how. Including lone workers, young workers and staff enforcing age restrictions.
4. Select controls. Store layout, product protection, staffing levels, security officers, CCTV, radios and procedures.
5. Record and review. Document decisions and review after incidents and at least annually.

The value comes from presence and engagement, not confrontation.

Contract security officers in retail must hold the relevant SIA front-line licence. Assignment instructions should state clearly what officers may and may not do, including the store’s policy on detaining suspected thieves. Many retailers adopt a policy of observe, deter and report rather than physical intervention, because of the risk to officers and staff. Any use of force must be lawful, necessary and proportionate.

For a wider comparison of static officers and patrols, see mobile patrols vs static guarding.

Both involve processing personal data, so UK GDPR and the Data Protection Act 2018 apply. The ICO’s video surveillance guidance expects retailers to:

• complete a data protection impact assessment before deployment, covering higher-risk features such as audio recording;
• display signage that is visible before people enter the monitored area, names the operator and gives a contact route;
• set retention periods by purpose and delete footage securely;
• restrict who can view and export footage, and keep an audit trail of disclosures to police;
• be able to respond to subject access requests, redacting third parties where necessary.

Facial recognition technology needs particular care. The ICO treats it as an additional consideration, and retailers considering it should complete a thorough DPIA and take specialist advice before any deployment.

Each incident report should record what happened, who was involved, any injuries, what was taken, what CCTV exists and what action was taken. The Government has said that a standalone retail worker assault offence will also help make sure such assaults are recorded separately. See our guide to security incident reporting for a full checklist.

Review them monthly with the security provider and adjust deployment, such as moving officer hours to peak incident times.

Deployments are scoped around each store’s risk assessment and reviewed against agreed measures. See our retail security page and security guarding service, or request a quote.