Shrinkage Spike at a Regional Distribution Center

Start by challenging the number. Shrink is a measurement, not a finding. Before any spend, confirm the 0.41% → 1.28% movement is a real loss and not a change in counting method, cycle-count frequency, or the denominator.

Data to pull

• Shrink by SKU, location and value band - theft concentrates in high-value, small-cube items; process error spreads across bulk.
• Receiving variance and vendor short-ship logs for the same period.
• Outbound audit and customer-claim data - a loss that surfaces at the customer is a loading or shipping problem, not a pick-module problem.
• Returns cage reconciliation, plus dumpster and compactor activity.
• Door-event logs (if the PACS records them) and manual door-prop observations by shift.
• Driver sign-in log reconciled against actual dock-door activity, by hour.

Three competing hypotheses

1. Internal theft - expect clustering by shift and zone, disappearance of specific high-value SKUs, and variance that survives a recount.
2. External or collusive - expect correlation with driver arrival windows, dock-door anomalies, and loads that leave heavy and arrive light.
3. Process error - mispicks, unreconciled returns, receiving mistakes; expect diffuse patterns and reversals on recount.

Test, do not accuse. Seed a controlled audit - a marked pallet, a targeted cycle count of the top 50 value SKUs - and run a short covert review of the shift-change window. Keep HR and legal inside the process so anything that becomes an investigation is defensible.

What changes the conclusion: if a recount of the top 50 SKUs comes back clean and the variance sits in receiving, you have a process problem and the $180,000 belongs in receiving controls and visibility, not in investigations. Write that outcome down before you start, so the answer cannot be reverse-engineered to fit the purchase.

Rank by likelihood × consequence, and prefer controls that remove a vulnerability over controls that merely observe it.

Candidate control	Addresses	Est. cost	Decision
Shift-change door discipline: one controlled entry, staffed 15 minutes either side, plus door-position switches and propped-door alarms on all 7 doors	The most-observed vulnerability, and the one that enables every other loss path	$10–14k capital, $0 procedure	Do first
Driver and visitor management: photo badge, electronic log tied to the dock schedule, escort rules	Removes the anonymous-driver gap	$18–25k	Do
Cameras on staging lanes and the returns cage (10–12 units, 30-day retention)	Visibility into the two uncovered high-loss areas	$45–60k	Do
Card access on the remaining 4 doors	Closes the tailgating route structurally	$35–45k	Do, or phase II
Tailgating video analytics at the employee entrance	Same problem the door sensors already flag	$25–35k	Defer

Committed: roughly $120–145k, leaving a reserve for investigation support and contingency.

Why the cheap one comes first. A door that people prop is a supervision and culture problem before it is a hardware problem. Buying cameras to watch a propped door produces evidence of a policy nobody enforces. The propped-door alarm works only if someone is assigned to answer it - so the allocation must include a named responder, not just a sensor.

Why the analytics wait. Analytics tuned against no baseline, with no response plan behind it, generates nuisance alarms that train staff to ignore the console. Revisit it after three months of door-event data tells you what normal looks like.

You do not sign that risk is acceptable; the accountable business owner does. Security advises and states the residual risk precisely. Before you put your name on the advice:

• Commissioned and tested. Every Phase 1 control has a recorded test: each propped-door alarm annunciates at the console within a stated time; camera coverage is verified by a recorded walkthrough of every claimed field of view, not by a coverage drawing.
• Owned. A named role answers each alarm, with a written response matrix and a staffed console during the hours that matter. An alarm with no owner is worse than no alarm.
• Baselined. Metrics are defined and measured before the change: shrink percentage, door-alarm events per shift, time to acknowledge.
• Quantified residual. Stated in business terms, e.g. 'with Phase 1 in place, an estimated 0.4–0.6 points of shrink remains attributable to receiving error until that process is re-engineered.'
• Signed at the right level. The memo goes to the executive who owns the P&L, with the specific exposure they are accepting.
• Reopen triggers. A review date (two quarters) and explicit triggers - shrink not down 30%, or any single loss event above $50,000 - that void the acceptance.

Document as a one-page risk acceptance memo attached to the assessment, with the tests, the metrics and the triggers as appendices. That page is what protects the analyst when the next loss happens.