Scoring a Multi-Site Theft Risk Assessment with Sparse Data
A regional distributor operates six distribution centers, three within 40 miles of major container ports. Over 14 months it recorded 11 trailer-seal anomalies, four full-trailer thefts, and two inventory adjustments above $75,000. The security director uses a 5x5 likelihood-impact matrix, but each site manager self-scores. Results range from 9 at Dallas to 21 at Newark, and the corporate team is preparing a $1.2 million request for perimeter fencing at the lowest-scoring site. Incident data are complete only for Savannah and Newark; Dallas still uses paper gate logs, and two sites changed warehouse managers during the period. The insurance deductible is $250,000, the policy renews in 90 days, and the CFO wants a defensible ranking before approving capital. A customer has also asked for written assurance that its high-value loads are protected at every site. The security director must decide whether the matrix scores are reliable enough to drive the funding decision and what evidence to collect in the next 30 days.
1. Assess whether the 5x5 scores alone justify funding perimeter fencing at the lowest-scoring site. What decision would you make with the current data?
Read the worked answer
The scores are not comparable enough to allocate $1.2 million on rank alone. A 5x5 matrix mixes ordinal judgments; site managers self-score with different definitions, and Dallas's low score may reflect missing paper logs rather than lower risk. The incident counts also lack exposure denominators: Newark may handle more high-value loads or gate transactions than Dallas. Four thefts and 11 seal anomalies across six sites are a small sample, so one unreported event can reorder the ranking.
I would treat the matrix as a screening tool, not evidence. For the CFO, I would separate known loss from control gap. Approve interim low-cost fixes at all sites, such as seal custody, gate cameras and random trailer inspections, and fund a targeted assessment at the two sites with both high-value exposure and weak reporting. Before capital fencing, require 30 days of normalized data: incidents per 1,000 loads, value exposed, seal anomalies per 10,000 trailers, and independent verification. That gives a defensible ranking and supports a qualified customer assurance rather than an unsupported guarantee.
2. Design the 30-day data and validation plan. Identify the minimum evidence needed to recalibrate the matrix and satisfy the CFO and the customer.
Read the worked answer
The plan should start with a common incident taxonomy so each site reports the same event types and severity levels. Reconcile gate logs, seal issuance records, CCTV retention, TMS load data, WMS adjustments and carrier exception reports. Build denominators from loads shipped, trailers received, gate transactions, high-value shipments and employee counts; without denominators, a busy site looks riskier simply because it sees more activity.
Next, conduct short independent site visits using two assessors and a checklist for perimeter, gate, seal control, CCTV coverage, access control and guard practice. Interview site managers to test how they interpret likelihood and impact. Recalibrate the matrix by anchoring likelihood to observed event rates and impact to financial loss, recovery time and customer harm. Use ranges rather than single scores where evidence is thin.
The minimum package for the CFO is a normalized risk ranking with confidence levels, a cost estimate for each control, and expected loss reduction. For the customer, provide the method, limits, and a corrective action timetable. Do not claim zero risk; state what is verified and what remains under review.
3. Recommend interim controls for the next 90 days. How would you prioritize them across the six sites?
Read the worked answer
Prioritize controls that reduce opportunity at high-exposure sites and improve data quality everywhere. First, tighten seal control: issue seals from a locked cabinet with dual custody, log seal numbers against trailer and load, and require a gate inspection before departure. Second, add randomized trailer inspections and CCTV coverage at exit gates, especially where paper logs are still used. Third, verify driver identity and carrier assignment at the gate, and prohibit unescorted access to loaded trailers. Fourth, create a confidential reporting channel and review after-hours access logs.
I would rank sites by value exposed, control weakness and reporting quality, not by the current matrix score alone. Dallas gets immediate data-quality remediation plus spot checks; Newark, with the highest score and complete incident history, gets a control-gap validation and targeted hardening. Savannah's data can serve as a benchmark. The 90-day goal is not to eliminate all theft, but to reduce seal and gate opportunities, detect anomalies faster, and produce evidence reliable enough to support the next capital cycle.