Cash-in-Transit Risk Assessment for a 12-Branch Microfinance Bank
A microfinance bank operates 12 branches across a city. Cash and cheques totalling about PKR 4.2 million move each week between a central vault and the branches using two unmarked vans. Each van carries one armed guard and one driver; neither vehicle has GPS or a radio, and the daily route is posted each morning in a WhatsApp group that includes 14 staff. In the past five weeks there have been three attempted snatchings, all within 400 metres of the same junction, at roughly the same time (between 09:10 and 09:25). Police average response time in that area is about 18 minutes. The bank's insurance policy requires an annual documented risk assessment but lists no specific controls. Branch managers have begun delaying cash pickups because they do not trust the schedule. The head of security has asked you, as security manager, to review the arrangement before the next quarterly insurance audit.
1. Explain how you would structure the risk assessment for this cash-in-transit operation, including how you would score and prioritise the risks you identify. Justify your scoring choices rather than only listing headings.
Read the worked answer
I would start by defining scope and assets, because an assessment that roams across all bank risk will not satisfy the insurer or drive action. In scope: the two vans, the vault-to-branch movement, the junction area, the guards and drivers, and the route information itself. Out of scope: branch counter robbery, which needs a separate assessment.
Next I would separate the risks rather than score 'cash-in-transit' as one line. Realistic entries are: armed robbery at the junction; information leak enabling ambush; vehicle breakdown in an unsafe area; guard injury during an attempt; and schedule disruption causing branches to hold excess cash. Each gets its own likelihood and consequence score on a 5x5 matrix.
Scoring reasoning matters more than the number. Three attempts in five weeks at the same place and time is a strong clustering signal, so likelihood at that junction should be rated high, not 'medium' simply because no money was taken. Consequence combines loss (up to PKR 4.2 million weekly exposure, though a single van carries less), life-threatening injury, and business disruption. I would treat injury as severity 5 even if probability is lower, because consequence scoring should not be discounted by optimism.
The predictable route and the 14-person WhatsApp group raise the information-leak risk, but I would not assume an insider: phones get lost, screens are overlooked, and messages are forwarded. I would record it as a credible risk with an investigation action, not a concluded fact. The 18-minute police response raises the vulnerability score for the junction.
Finally I would build a risk register with owner, existing controls, score, proposed treatment and target date, then rank by score with a rule that any life-threatening risk is treated regardless of rank. That gives the insurer an auditable trail and gives management a defensible priority order rather than a list of fears.
2. Recommend controls using the hierarchy of controls, separating quick wins from 90-day projects. Explain how you would address the route-secrecy problem and why you would sequence the actions that way.
Read the worked answer
The hierarchy pushes me to eliminate or reduce exposure before adding guards or gadgets.
Eliminate/reduce: move as much value as possible to electronic transfer and consolidate branch cash so fewer journeys carry meaningful sums. This is the highest-leverage action because it shrinks the prize. It requires finance and branch operations, so it is a 90-day project, not a security memo.
Engineering: fit GPS trackers with geofence alerts, radios or push-to-talk, panic buttons, dash cameras and reinforced vehicles. These are projects with procurement lead times, but a tracker and radio for two vans can realistically be a 30-day quick win.
Administrative: remove the route from WhatsApp immediately, replace it with a need-to-know schedule held by a nominated dispatcher and the guard commander, vary departure times and routes, and require a check-in at the junction. This is the fastest and cheapest control and should start today.
On route secrecy, I would treat it as an information-handling problem, not just a 'stop using WhatsApp' instruction. The group has 14 members; I would identify who genuinely needs the route, move them to a controlled channel, require confirmation of receipt, and brief staff that forwarding is a disciplinary matter. I would also vary timing so that even a leak does not give a reliable ambush window, and add a police liaison request for the 09:10-09:25 period.
Sequencing: secrecy and variation first because they reduce the immediate ambush advantage; tracking and radios next because they shorten response; vehicle hardening and cash reduction after that. I would not spend the first month buying vehicles while the schedule is still broadcast daily.
3. What residual risk would remain after your controls, and how would you document acceptance and monitor performance?
Read the worked answer
Residual risk will remain because cash still moves, guards are still exposed, and the junction remains a known hotspot. After controls I would expect the junction risk to fall from high to medium: likelihood reduced by varied timing, secrecy and tracking; consequence reduced but not eliminated by vehicle hardening and faster response. I would state that explicitly rather than declare the risk 'closed', because claiming zero risk would undermine the assessment's credibility with the insurer.
Acceptance should be documented by the accountable executive, not by me alone. The record should state the residual rating, the specific assumptions (for example, that route variation is actually happening and GPS is maintained), the conditions under which operations should pause (such as tracker failure plus a known police incident at the junction), and a review date. The insurer should receive the same summary. If management declines a recommended control, that decision and its rationale belong in the record with a named owner.
Monitoring should use a small set of leading indicators, not just loss counts. Useful measures: percentage of journeys with a functioning tracker and radio check-in; route and timing deviation rate; near-miss and attempt reports; average time from panic activation to police notification; guard attendance at monthly ambush-response drills; and branch cash held above limit because pickups were delayed. I would review monthly with operations and finance, and trigger an out-of-cycle review after any attempt, vehicle change, or change in the police response pattern.
The branch managers' loss of trust is itself a risk indicator. Publishing a reliable pickup window and a single point of contact would address it, and their compliance with cash limits should be tracked rather than assumed.