How to Carry Out a Warehouse Security Risk Assessment

A security risk assessment applies the same discipline to crime and deliberate harm. It also helps you:

• spend on the controls that address the highest risks, rather than the most visible ones;
• specify security services properly when going to tender;
• demonstrate to customers and insurers that risks are being managed;
• protect staff, including those working alone or at night.

Step 1: Identify assets

List what you are protecting. In a warehouse this usually includes:

• People: employees, agency staff, drivers and visitors.
• Stock: particularly high-value, easily resold or desirable lines.
• Vehicles and trailers: loaded trailers in the yard, tractor units, forklifts.
• Infrastructure: the building, racking, sprinklers, power, IT and warehouse management systems.
• Information: delivery schedules, customer data and access codes, which can help criminals plan.
• Reputation and contracts: service levels to customers and their confidence in you.

Step 2: Identify threats

Consider who might cause harm and how:

• external theft, including from the yard and parked trailers;
• internal theft and collusion between staff, drivers or contractors;
• fraudulent collections using false paperwork or identities;
• criminal damage, trespass and arson;
• violence or aggression towards staff;
• unauthorised access to systems or data.

Use your own incident records, near misses and insurer feedback. Do not import national crime statistics unless they are sourced and relevant to your location.

Step 3: Identify vulnerabilities

Walk the site at different times, including at night and during shift changes. Look at the perimeter, gates, yard, loading docks, doors and windows, roof access, lighting, CCTV coverage, alarm zones, key control, visitor and driver procedures, and how stock and paperwork move through the site.

Step 4: Score each risk

For each threat-vulnerability pair, score likelihood and impact on a simple scale and multiply them. A five-point scale is common:

Risk rating = likelihood × impact. A common approach is to treat 1 to 6 as low, 8 to 12 as medium and 15 to 25 as high, but agree your own thresholds and apply them consistently. Base likelihood on evidence where you can: incident history, the attractiveness of the stock and the strength of existing controls.

Step 5: Decide controls and record residual risk

For each medium or high risk, choose controls, assign an owner and a deadline, and re-score the risk with the controls in place. Controls generally fall into four groups:

• Physical: fencing, gates, dock doors, high-security cages for high-value stock, vehicle barriers.
• Electronic: intruder alarms, CCTV, access control, lighting.
• Procedural: driver and visitor checks, seal checks, key control, separation of duties, stock counts.
• People: gatehouse officers, patrols, keyholding and alarm response, staff training.

The figures above are illustrative. Your scores should reflect your own site and evidence.

Involve the site or general manager, the transport or yard manager, the health and safety lead, someone who understands the alarm, CCTV and access control systems, and your security provider if you have one. Where you store goods for third parties, customers may have their own security requirements written into contracts, so include those too. Your insurer or broker may also be able to share expectations for your type of premises.

For each risk that relies on people-based controls, specify:

• the post or patrol required, and its hours;
• the duties, such as driver checks at the gatehouse, seal checks, yard patrols or lock-up checks;
• what must be recorded and reported, and how often;
• how incidents are escalated and to whom.

This makes quotations comparable and gives you a clear basis for measuring performance. See what to include in a security tender.

Proportionate pre-employment checks, separation of duties between receiving, picking and despatch, and a confidential way to report concerns all reduce opportunity.

CCTV that captures employees is processing personal data. The ICO expects organisations to carry out a data protection impact assessment for surveillance likely to result in high risk to individuals, which includes monitoring workers, and to set out signage, retention and access arrangements.

Record what you reviewed and what changed.

See our logistics and warehousing page, or request a quote to arrange a site survey.