The Overnight Guard Who Skips Rounds
A 40-acre distribution campus runs three fixed posts and one roving patrol per shift. The roving officer carries a guard-tour wand with 18 checkpoints, and the tour system reports 99% completion. During an unrelated investigation, security management learns that the overnight rover has been tapping all 18 checkpoints in the first 40 minutes of a 12-hour shift, then sitting in a break room with the door propped. The supervisor reviews the wand logs nightly and has praised the rover for perfect compliance. The client's operations manager says shrink on the night shift is roughly double the day shift, but attributes it to fatigue and lighting. The site has no CCTV on the dock doors, only at the main gate. Budget for new technology is frozen for six months; the contract allows staffing changes with 30 days' notice.
1. Diagnose why the existing guard-tour control failed to detect this behavior, and identify the specific failure in the security program's design.
Read the worked answer
The control measured presence at checkpoints, not coverage over time. A tour wand with no time-window enforcement and no requirement for checkpoints to be spaced across the shift produces a compliance metric that a motivated officer can satisfy in the first 40 minutes. The nightly supervisor review was a false assurance: it validated completion rate, which was already 99%, so it could never surface the anomaly.
The deeper program failure is that the metric was never validated against the outcome it was meant to protect. The rover's job is deterrence and detection across 12 hours, but the KPI only proved that a wand visited 18 points. A well-designed tour protocol specifies when each checkpoint must be hit (e.g., no more than 90 minutes between rounds, randomized order), and the supervisor's review compares timestamps to expected windows rather than to a completion percentage.
Secondary failure: no independent corroboration. With CCTV only at the main gate, there was no way to test the rover's account of the shift. That is a detection-layer gap, not a guard problem.
2. Given the six-month technology freeze, propose a 30-day corrective action plan that addresses both the behavior and the measurement gap.
Read the worked answer
Separate the person problem from the system problem. The rover's conduct may warrant discipline under the site's post orders, but replacing one officer will not fix a control that any officer can defeat the same way.
Days 1–7: tighten the existing control at zero cost. Reconfigure the tour system (most wand software supports it) to enforce randomized checkpoint order and minimum/maximum intervals between rounds. Rewrite post orders so that a round must be completed within a defined window and that a supervisor's spot check is required at least twice per shift. Add a physical sign-in sheet at a mid-shift location that the rover cannot reach without crossing the dock area.
Days 8–14: add independent verification. Require the shift supervisor to conduct unannounced physical checks of the rover's location at randomized times, logged with timestamp. Cross-reference the rover's tour timestamps against the supervisor's observations. This closes the measurement gap without capital spend.
Days 15–30: address the shrink signal. Interview the operations manager to test the fatigue/lighting hypothesis rather than accepting it. Pull dock-door access logs and shipping/receiving discrepancy records for the night shift. If shrink clusters around specific doors, that is a target for the frozen-budget request when it thaws.
Document all of this so the 30-day notice provision is used only if staffing changes are actually justified by evidence, not by the first plausible story.
3. The client's operations manager insists the problem is fatigue and lighting and resists any change to the guard schedule. How should security management respond?
Read the worked answer
Treat the operations manager's hypothesis as a competing explanation to be tested, not a conclusion to be accepted or rejected on authority. Security management's leverage is evidence, not rank.
Present the tour-timestamp data: 18 checkpoints completed in 40 minutes at the start of a 12-hour shift is not a fatigue pattern; it is a coverage gap. Fatigue would produce declining completion across the shift, not front-loaded completion. That single comparison reframes the conversation from opinion to data.
Then offer to test the lighting hypothesis cheaply: a night walk-through with a light meter at the dock doors, and a review of whether shrink incidents cluster in low-light areas. If they do, that supports the manager and builds a coalition for the budget request. If they do not, the data speaks.
Finally, be clear about the contractual and liability boundary: security owns the post orders and the tour protocol, and management's resistance does not transfer that accountability. Document the recommendation, the client's response, and the residual risk in writing. A security manager who capitulates to a plausible-sounding theory without testing it owns the next incident.