7 Steps to a Loss Prevention Program That Actually Works

A loss prevention program is no longer just a security roster, a camera network or a policy folder. Australian Bureau of Statistics data recorded 595,660 victims of theft excluding motor-vehicle theft in 2024, up 6% from 2023 and the highest level since 2003. Retail locations represented 45% of those thefts, compared with 32% in 2010. ABS data makes the operational point clearly: loss prevention belongs in margin management, site operations and customer experience.

A workable program links behaviour, evidence and controls in a repeating cycle. It identifies where losses occur, explains why they happen, gives staff a safe and consistent response, and measures whether the intervention changed the result.

Why a Loss Prevention Program Matters in Australia Right Now

The retail share of recorded theft has grown materially, but the commercial impact reaches well beyond shop floors. The Australian Institute of Criminology has recorded historical estimates that shoplifting cost Australian retailers around 2% to 3% of sales, which could translate to nearly 25% of profit. The AIC analysis also estimated that retail theft cost NSW retailers about AUD 700 million per year, a historical benchmark rather than a current forecast.

On an operation generating AUD 10 million in annual sales, a 2% to 3% shrinkage rate equates to approximately AUD 200,000 to AUD 300,000 before investigation, administration, insurance, disruption and reputational costs. That's why a small-looking revenue percentage can become a serious finance issue.

State patterns sharpen the picture. In Victoria, retail locations accounted for 32% of recorded other-theft offences in the later reported period, totalling 55,981 victims, according to the Australian Bureau of Statistics recorded-crime release. National statistics don't capture every unreported incident, but they provide a consistent planning benchmark for stock monitoring, access control, staff procedures, incident reporting and targeted surveillance.

The exposure is operational, not theoretical

Retailers face accessible merchandise, busy payment points and repeated customer flow. Licensed venues add alcohol stock, cash handling, crowd movement and staff-only storage. Festivals introduce temporary bars, merchandise stands, gates and unfamiliar contractors. Construction sites face tools, materials, after-hours access and changing subcontractor populations.

A uniform guard presence rarely solves those different problems. A structured loss prevention program assigns controls to specific risks, such as self-checkout exceptions, premium spirits, loading docks, staff entrances, event gates or unsecured construction compounds.

Practical rule: Treat shrinkage as a controllable operating risk. Put it on the same review agenda as staffing, inventory accuracy, incident response and insurance conditions.

Map Your Risks Before You Spend a Dollar on Controls

The first task is not buying cameras. It's creating a defensible picture of what is being lost, where it happens and who can influence it.

Four stages for a site-level assessment

Define the scope. Include customer theft, employee theft, supplier discrepancies, refund abuse, cash variance, stock errors, vandalism and unauthorised access. For a festival, include gates, bars, merchandise, backstage areas, deliveries and post-event pack-down. For a store, include sales floors, self-checkout, receiving, stockrooms and staff access.

Map the hotspots. Plot every incident by location, time, shift, product and operating condition. A simple floor plan can reveal that losses cluster around one entrance, a premium-goods display, a loading bay or a particular service period. Don't confuse more reports with more offending. A new reporting process may increase recorded incidents while improving visibility.

Segment the loss. The 2022 Australia & New Zealand Retail Crime Study found customer theft represented 53% of retail-crime losses, while employee theft represented 24%. The average internal-theft incident cost approximately A$1,200, compared with A$415 for an external-theft incident. The Griffith University summary of the study supports two different control tracks.

Set the baseline. Record loss per turnover, unexplained stock variance, refund-to-sales ratio, exception closure time, repeat-offender frequency and the proportion of incidents supported by evidence. Reconcile point-of-sale, inventory, CCTV, access-control records and incident reports rather than relying on one system.

A useful supporting resource for broader exposure reviews is GoSafe Dark Web monitoring risk tools. Dark web exposure isn't the same as on-site theft, but compromised credentials, leaked access details and exposed business information can increase the risk around staff accounts, contractors and monitoring systems.

Run this assessment on one store, venue or event first. Keep the categories consistent, assign every exception an owner and review the results weekly until the pattern is stable.

The Policy Stack Every Program Needs on Paper First

A loss prevention program fails under pressure when staff aren't sure who can act, what must be recorded or when an incident should be escalated. Written policies turn a good intention into an auditable operating method.

Your policy stack should cover:

• Cash handling: Define till ownership, handovers, safe drops, reconciliation, variance escalation and access to cash rooms.
• Refunds and voids: Require documented reasons, approval thresholds, transaction references and review of repeated exceptions.
• Keys and access: Record issue, return, lost-key escalation, restricted areas and contractor access.
• Receiving and returns: Use delivery checks, quantity verification, damage records and two-person confirmation for sensitive stock.
• Incident response: State who attends, who contacts police or emergency services, who speaks with witnesses and who informs management.
• Evidence preservation: Require staff to secure relevant video, transaction records, access logs, photographs and separate witness accounts before systems overwrite or people disperse.
• Escalation: Set clear triggers for urgent management review, insurer notification, police reporting, staff investigation and legal advice.

The policy must also reflect Australian state requirements. Licensed venues need procedures that work alongside responsible service of alcohol obligations, while security work and intervention powers vary across NSW, Victoria, Queensland and the ACT. Detention or physical intervention must be handled only by appropriately authorised personnel and in line with applicable law, organisational policy and safety requirements.

A policy that says “monitor suspicious behaviour” is too vague. A useful clause says who monitors, what information they record, what behaviour requires assistance rather than confrontation, and how a supervisor reviews the decision.

A policy is valuable only when a new employee can follow it on a busy shift and a manager can audit it afterwards.

Insurers may also expect evidence of controls, training, inspections and incident follow-up. Keep version control, training acknowledgements and review dates. Negotiate the operational detail where appropriate, but don't leave cash, access, evidence or escalation responsibilities ambiguous.

Right Guard, Right Place, Right Time

A CBD shopping centre during peak trade needs a different deployment from a regional music festival. The mistake is to purchase “security hours” and hope they cover every risk.

At the shopping centre, uniformed personnel can combine customer assistance with visible deterrence at entrances and high-risk retail zones. A plain-clothes operator may be appropriate for targeted observation where repeat theft is suspected. K9 patrols can support perimeter, loading-dock or after-hours checks, while back-to-base monitoring handles alarms and escalation outside the busiest trading window.

The supervisor's brief should identify:

• Entrances and exits requiring attention
• Loading docks and delivery periods
• High-value retail zones
• Staff-only doors and lift access
• Expected crowd surges
• Radio channels and escalation points
• Evidence and handover requirements

A regional festival has a different rhythm. The gatehouse controls credentials and contractor movement. Roving teams watch crowd transitions between stages, bars and merchandise areas. Licensed areas need staff who understand responsible service obligations and can de-escalate rather than turn every dispute into a confrontation. At pack-down, the risk shifts to stock reconciliation, sealed transfers, cash movement and vehicle departure.

NSW data illustrates why venue operators need product-specific controls. BOCSAR recorded 29,552 retail-theft incidents in 2024/25, up 5.1% year on year. Liquor appeared in 40% of thefts where an item was recorded, and licensed premises accounted for 21% of all retail-theft incidents. The BOCSAR quarterly update supports controls such as locked premium spirits, opening and closing counts, two-person delivery checks and CCTV covering bars and stockrooms.

Physical boundaries matter too. A damaged fence, unsecured gate or poorly lit loading zone undermines otherwise capable staff. For site planning, operators can review FenceScape chain link as one reference point for perimeter material and access design.

Briefings, handovers and supervision determine whether deployment works. A guard who knows the site, remembers the client's service expectations and writes a useful report contributes more than someone occupying a post.

Choosing Technology That Supports Humans, Not Replaces Them

Technology should answer a defined question. If the risk map shows self-checkout exceptions, prioritise point-of-sale reporting and camera coverage that lets a trained attendant respond. If the problem is premium liquor, secure the display, link stock counts to CCTV and review staff access. If an after-hours construction site is exposed, combine access control, lighting, alarm response and patrols.

Match each tool to the loss pattern

CCTV should cover decisions and evidence points, not merely produce a wall of images. Prioritise entrances, exits, tills, self-checkout, stockrooms, bars, loading bays, staff doors and perimeter approaches. Confirm image quality, camera positioning, retention, time synchronisation and export procedures before procurement.

POS exception reporting should flag unusual refunds, voids, no-sale drawer openings, discounts and transaction reversals. The report needs an owner, a review rhythm and a defined escalation path. An exception without follow-up becomes background noise.

Electronic access control helps separate authorised movement from opportunity. Use role-based access for stockrooms, cash offices, server rooms, backstage areas and construction compounds. Review access after staff changes, contractor completion and lost credentials.

EAS and RFID can support merchandise visibility and stock accuracy, but tags don't replace product placement, staff presence or receiving controls. Selective tagging may make more sense for premium goods than applying the same control everywhere.

Body-worn video can support evidence and transparency during difficult interactions when policy, privacy, consent and retention requirements are clear. It should help supervisors review what happened, not encourage staff to escalate minor disputes.

AI video analytics may identify movement, loitering, intrusion or queue conditions, but alerts still require human judgement. False positives can overwhelm teams, and biased assumptions about people create customer, legal and reputational risks.

Make training part of the control system

Training isn't a box to tick after the technology is installed. Monash University's Australian Consumer and Retail Studies survey of 1,047 Australian shoppers, collected in June 2025, found that 27% considered taking an item without paying at least somewhat justifiable, 32% accepted not scanning items at self-checkout and 36% accepted scanning an item as cheaper than it was. The survey reporting shows why communication and social norms belong in the program.

Staff need practical scripts, not vague instructions to “be vigilant”. Train them to offer assistance, describe a transaction discrepancy neutrally, call a supervisor, preserve evidence and disengage safely when risk increases. Don't profile customers. Don't turn a suspected low-value error into a public confrontation. Consistency protects the customer, the staff member and the evidence.

Measure staff interventions, near-misses, complaints, reporting rates and confidence, alongside recovered merchandise. A program that recovers goods but increases unsafe confrontations is not performing well.

Technology also creates its own attack surface. Access permissions, device administration, network segmentation and vendor support deserve an IT review. A practical WiFi security guide for IT teams can help structure that conversation, particularly where cameras, access readers and mobile devices depend on wireless connectivity.

Finally, compare capital cost, subscription cost, maintenance and evidence workload against the loss it is meant to reduce. A cheaper system that produces unusable footage or unreviewed alerts is not cheaper in operation.

Measure What Actually Reduces Loss

Camera counts and guard hours are inputs. They don't prove that loss fell. A finance-ready dashboard combines incident data, exposure data, process exceptions and evidence quality.

The AIC found that only one in 17 customer or employee theft incidents was reported to police. Employee theft represented 18% of financial losses but only 2% of reported incidents, according to the Australian Institute of Criminology analysis. Internal reporting therefore matters as much as police statistics.

Build the monthly dashboard

Use a pre-intervention baseline and interpret changes carefully. Seasonality, trading volume, event attendance, reporting behaviour and displacement can all distort a simple before-and-after comparison.

The monthly meeting should end with decisions. Increase supervision where risk concentrates, revise training where staff confidence is weak, repair a physical vulnerability, change a camera angle or retire an alert that nobody can action. That's the behaviour-and-data cycle in practice.

Common Questions Australian Operators Ask

What does a professionally run program cost?

There isn't a responsible universal price. Cost depends on site count, operating hours, risk windows, technology, supervision, licensing requirements, event complexity and whether the program includes investigations and reporting. Start with the baseline and prioritise controls against measured exposure rather than buying a uniform guard package.

When should we report an incident to police?

Report offences according to the circumstances, your policy, insurer requirements and police guidance. Urgent threats, violence, serious property damage and immediate safety risks require prompt escalation. For non-urgent matters, preserve evidence, record the incident accurately and make sure internal reporting doesn't replace a police report where reporting is appropriate.

What evidence should we preserve?

Secure relevant CCTV before automatic overwrite, retain POS and inventory records, record access-control events, photograph damage, document the time and location, and obtain separate witness accounts. Keep an evidence register showing who collected, stored and accessed each item. Don't edit or circulate footage casually.

Should we use in-house staff or a specialist contractor?

In-house teams provide site knowledge and daily ownership, but they require recruitment, licensing compliance, supervision, training, relief coverage and performance management. A specialist contractor can add flexible coverage, trained supervisors, K9 capability, covert operations, patrols, monitoring or event-specific staffing. The right model often combines internal process ownership with external capability during peak trade, festivals, investigations or higher-risk periods.

GM GROUP Services provides risk assessments, static guards, K9 units, covert operations, vehicle patrols, gatehouse control, back-to-base monitoring and loss prevention support across NSW, Victoria, Queensland and the ACT. The important test is whether the provider can connect deployment to your baseline, policies, evidence requirements and monthly review.

GM GROUP Services can help retailers, licensed venues, festivals and construction operators assess exposure, design layered controls and deploy appropriately trained personnel. Visit GM GROUP Services to discuss a site-specific loss prevention program built around your operating risks and reporting requirements.