Mixed-Use Building, One Guard, One Budget Line
You are the newly assigned security lead for a six-storey mixed-use building: a ground-floor pharmacy that dispenses opioid agonist therapy, a second-floor co-working tenant, residential floors three to six with 73 units, and a two-level underground parkade. Over 90 days the incident log shows 14 loitering complaints near the pharmacy entrance, 2 needle finds in the parkade stairwell, 2 parkade break-ins (both between 01:00 and 03:00, both driver-side window), one verbal altercation between a pharmacy customer and a resident, and one tenant social-media post naming pharmacy staff and saying “someone should do something.” One guard is on site 17:00–07:00. The pharmacy manager wants a visible guard at the entrance; the strata wants the parkade locked at 22:00; the co-working tenant wants 24-hour fob access. Your budget allows one additional measure this quarter.
1. Rank the identified risks and justify the ranking, including what data you are missing.
Read the worked answer
Rank by likelihood × consequence, and separate frequency from severity - the two things the stakeholders are arguing about.
- Threat against pharmacy staff (the social-media post). Low frequency, by far the highest consequence: named individuals, a call to action, a population with access to the site. Even at low probability, this is the one item that could produce a death or serious injury, so it leads.
- Parkade break-ins. Highest demonstrated likelihood of the property crimes: two in 90 days, tightly clustered in a two-hour window against an unattended, dark, controllable space. Moderate consequence (property, insurance, resident confidence, escalation potential if a resident interrupts one).
- Needle finds in the parkade stairwell. Low-moderate likelihood, high consequence (needlestick injury to a resident, a child, or a cleaner; occupational health exposure; occupier's liability). The stairwell is also the least supervised space in the building.
- Loitering near the pharmacy entrance. Highest frequency (14 complaints), lowest consequence per event, but it is the visible symptom that is driving both the pharmacy's fear and the residents' perception, and it is where the verbal altercation happened.
- Customer/resident altercation. One event, but it shows the two populations are now colliding in a shared space - an indicator, not yet a trend.
Data I do not have and must request:
- Times and days of the loitering complaints (are they pharmacy-hours or overnight?).
- Whether the break-ins involved entry to the vehicles or only glass, and whether any repeat victim or repeat offender pattern exists.
- A lighting and sightline survey of the parkade and stairwell, and the parkade door hardware/status.
- Whether the posting tenant is identifiable, and whether the pharmacy has received any direct threats.
- Occupancy patterns for the co-working tenant after 22:00, which is the whole basis of their 24-hour request.
2. Recommend the one measure the budget allows, and explain what each stakeholder's competing request actually buys.
Read the worked answer
Recommendation: a controlled-entrance measure - electronic access control plus lighting and camera coverage on the parkade pedestrian doors and stairwells, with after-hours access restricted to residents and authorized staff.
Why this beats the alternatives:
- It addresses three of the top four risks at once: it closes the break-in window, removes the unsupervised stairwell where needles are being used, and gives one guard a single chokepoint to watch instead of three floors of open circulation.
- It is structural, not labour - it works on the guard's nights off, during breaks, and after the contract ends.
What each stakeholder's request actually buys:
- Pharmacy: a static guard at the entrance. It buys deterrence and reassurance for the hours the guard is there and nothing for the hours he is not; it also pulls the only guard off patrol, so the parkade and stairwell get worse. The named-staff threat is better addressed by a threat assessment and liaison with police, which costs no capital.
- Strata: lock the parkade at 22:00. Cheap and effective against the 01:00–03:00 pattern, but residents will prop the door or the gate, which converts a locked door into a permanently defeated one. Locking only works with enforcement (door alarms, camera, guard checks) - so treat it as part of the access-control measure, not as a stand-alone.
- Co-working tenant: 24-hour fob access. This directly contradicts the break-in pattern and expands the pool of fobs in circulation. Ask for their after-hours occupancy data. If genuine demand exists, grant access to a controlled lobby only, not the parkade or residential floors.
Whatever is chosen, the recommendation must include how success is measured - break-in count, needle finds, loitering calls per 30 days - reviewed at 90 days. A measure nobody evaluates is just a purchase.
3. How do you communicate this assessment, and where do privacy limits bite?
Read the worked answer
Two different documents for two different audiences, and the tenant's social-media post is the landmine.
Documents:
- A one-to-two page risk assessment for the client (strata council and property manager): ranked risks, the evidence behind each, the recommended measure, cost, the alternatives considered and why they lost, and the 90-day review metrics. Short, decision-oriented, no jargon.
- A separate operations note for guards: what to watch, what to log, what to do on a needle find (do not handle with bare hands; sharps container; report), and when to call police.
Privacy limits - this is private-sector personal information in BC, and the pharmacy context makes it sensitive:
- Do not circulate the tenant's social-media post as an accusation. Report it as an incident, preserve the post, escalate to the client and to police if the threshold for a threat is met. Naming the tenant to the pharmacy or to other residents before any finding is a defamation and privacy exposure for my employer.
- Do not share health information. Nothing about who attends the pharmacy - not in the assessment, not in the guard briefing, not in a shift log that other tenants can read.
- Aggregate before you report. “14 loitering complaints in 90 days” is fine; unit numbers plus names plus descriptions in a document distributed to three stakeholders is not.
- Video and access-control data (fob records) are personal information: collect for a stated purpose, retain for a defined period, release only through the client's privacy officer or on lawful authority.
- If police request footage, my role is preservation and escalation, not discretion.