Security & Safety Site Assessment: Loss Prevention, Reduce
Vulnerability to Loss, Eliminate Potential Liability Exposure,
Cost-Effective, LP Awareness Training
The report below is a sample
of a Security and Safety Site Assessment conducted by Summit Loss Prevention
This is an actual report -- however, to protect the
privacy of all parties involved, the names and locations have been changed.
Click on a topic below to scroll down to the section.
Hours: 24 Hours Five Days/Some
H. Products Manufactured: Parts for Aerospace and Military Components
SKY-HI AEROSPACE LOSS PREVENTION ASSESSMENT SUMMARY REPORT
March 7, 2005
The investigator conducted a Loss
Prevention Assessment at Sky-Hi Aerospace in Dayton, OH during
January 2005. This document will summarize the assessment results in
several critical Loss Prevention areas. The Assessment was done as part
of an ongoing internal investigation at the facility. A report on the
investigation findings will be submitted separately.
scope of the Loss Prevention Assessment was intentionally broad and multi-faceted to insure
that all potential security related factors were addressed and given
appropriate attention. The investigator incorporated security industry standards
as a benchmark for consistency and thoroughness, in addition to the
input obtained from various Sky-Hi Aerospace management personnel.
During the investigation of the criminal acts
perpetrated at the facility, several vulnerabilities were identified
that were also evaluated during the Loss Prevention Assessment
The Loss Prevention Assessment covered four major
areas of concern. The primary areas covered are as follows:
In addition, the investigators conducted
interviews with a cross-section of Sky-Hi’s employees and management
personnel in an effort to identify any specific internal concerns
related to loss prevention.
The results of the Loss Prevention Assessment
indicate there are several areas of the business that are not adequately
protected or consistently maintained from a Loss Prevention standpoint.
The lack of a formalized Loss Prevention Program, or sufficient loss
prevention focus on some vulnerable areas of the facility, is the
primary finding of the Assessment.
Specifically, there have been lapses in the
amount of attention paid to asset protection of tools, raw materials,
supply items and ‘scrap’ metal. The recent internal investigation
demonstrated that additional internal controls, designed to deter and/or
detect theft and fraud activities by employees and management alike, are
necessary within the facility.
From an outside service provider standpoint,
certain entities were not being monitored appropriately by some members
of Sky-Hi’s management. On a few occasions it was determined that these
service providers took advantage to inflate their invoices or perform
substandard work. The deterrents in place were not being utilized
properly to detect these situations in each case. Certain internal
controls need to be enhanced, implemented and routinely audited to
monitor compliance and, when necessary, discipline those who are not in
compliance with these requirements.
Physical security aspects such as burglar alarms,
camera systems, key and lock control programs and others have not been
maintained adequately, resulting in a poor overall loss prevention
environment. Maintenance Department management had responsibility for
these systems and failed to maintain them properly. The opportunity for
internal theft is greatly increased when these systems are not utilized
as they are designed. Each of these systems needs to be brought up to
an acceptable level of operation and then consistently maintained.
It was determined that the burglar alarm system
has not been utilized effectively for approximately two years. The
system is not currently monitored by any outside agency. At this time,
a break-in to the facility would not be detected by the alarm system.
Procedures need to be enhanced and implemented to get the system back up
and fully functional.
The camera system is not being utilized
consistently and many of the camera placements reviewed are
inappropriate and do not address loss prevention needs.
Management staff are not routinely trained to utilize the existing
camera system and therefore do not know how to maximize it as a
management and loss prevention tool. Specific guidelines need to be
designed and implemented for the training and subsequent use of this
The integrity of the key and lock control system
has been compromised and needs to be revamped. An unknown number of
Grand Master keys that provide access to many doors within the facility
have been distributed haphazardly to numerous employees without
consideration of their real need to possess them. There have been no
definitive records maintained of the keys that have been distributed to
employees for the past 18-20 months. There is no way to recover all the
GM keys that are unaccounted for within the facility. This is a
significant issue from both a security and safety perspective.
From the Human Resource standpoint, background
checks currently do not include a criminal records check or driving
history, both important tools in determining who is being hired and
brought into the facility. Management and employee interviews revealed
there are suspected narcotic and controlled substance users among the
workforce. Specific individuals have been identified as drug ‘dealers’
or ‘suppliers’. Suspicions of alcohol impairment were raised as well.
Each of these issues warrants further investigation. Management persons
interviewed during the assessment indicated that they were not
adequately trained or prepared to respond to drug or alcohol impairment
or drug dealing issues from either a business or criminal perspective.
Loss Prevention training and awareness is needed in this area.
The current drug screening process is not as
strong a deterrent as it should be and there is some indication that the
company random drug screening dates may not be confidential. It has
been alleged that an employee of the company Sky-Hi utilizes to conduct
the screening has been alerting Sky-Hi employees to these dates in
advance, undermining the intent and integrity of the process. Further
investigation is needed to completely assess this situation.
There is no formal post accident drug testing
currently available. Any time there is an accident with injury or an
incident resulting in a pre-determined amount of dollar loss a
post-event drug screen should take place. Historically, this post-event
testing will reduce the number of worker’s compensation cases and also
lower the number of accidents and incidents over time.
The submission of bogus overtime hours and
subsequent payroll fraud has been an issue with several employees and
their supervisor. The investigation identified this issue within the
Overtime hours, in general, were not monitored or
controlled within the Maintenance Department. In one instance an
employee was paid more than double what his hourly wages would have been
over a two-year period of time through unsupervised overtime.
Management in this department was not held accountable for overtime
within this department. A system to identify abuses is not currently in
There have been several employee accidents
involving injury that warranted additional investigation. The accident
response process needs to be enhanced and conducted in a systematic
method. Currently, some accidents receive a sufficient response,
however the accident reporting guidelines are not consistent and some
accidents are not reviewed. This results in potential fraud within the
Worker’s Compensation coverage area. Accident and injury investigation
techniques need to be addressed to deter fraud and improve safety and
In the Electronic Technology area of the business
(computer systems), it was determined that protection of proprietary
information (PIP) and electronic information security (ELIS) is
sub-standard given the sensitive nature of the business. Management
staff acknowledged during interviews that they have e-mailed company
information they are working on to their personal computers at home. It
is recommended that this practice be prohibited. The security risks
associated with this practice are significant.
According to the IT Manager, there is no current
program to monitor employee computer usage or outgoing e-mails. There
are few written policies or procedural restrictions regarding this
sensitive area of the business. Current policy addresses only user
privacy issues and does not prohibit the behavior described above. IT
Management loss prevention awareness and training in this area is
Safety and Environmental policies, procedures and
training programs have been designed and implemented within the
facility. Additional focus is needed to enhance the guidelines already
established in this area by the current Safety Manager.
The Safety review can be broken down into three
The review of the Facility Safety identified some
key areas for improvement. The local fire department has been contacted
and provided with information regarding the facilities for response and
pre-planning. The need to continue to be aggressive with local FD code
enforcement and training of responding firefighters is obvious.
Internal protections such as extinguishers (multiple types) were in good
working order and obviously marked, however the provided sprinkler
systems requires annual testing by a certified vendor.
testing at both plants should be conducted immediately; the system is
essential to control fire growth and minimize damages.
The system at
Sky-Hi has had multiple changes and additions since the last certified
The system at McDougal-Shell lacked acceptance testing and is
due for annual testing.
The Safety Manager should be present during
The highest risk for extensive injury, production
disruption or liability arises from the use of several hazardous
chemicals on site at Sky-Hi. Storage is centrally located on site.
Several items could help to minimize the risk of accidents.
of drums on pallets help minimize risk of spills, but the environmental
exposure of drum pallets causes them to fill with environmental moisture
thus reducing their ability to contain a spill.
The mixing of full and
empty drums also causes worker confusion. Drums should be marked in a
way to delineate “full”, “in use” and “empty/residual.”
A review of on
site chemical usage should be conducted to determine the minimum amount
of product used on a weekly/monthly basis so that unnecessary storage of
product is kept to a minimum.
A more thorough safety/haz-com
interaction with managers responsible for chemical utilization would
establish stronger control of drum allocation, usage, return and
storage. This interaction would also improve the education about drums
with particle aluminum contamination that can sometimes be mixed with
other drums in the drum storage area. Marking of these drums or
altogether prevention of this is optimum.
A tremendous benefit regarding chemical usage and
any potential spills is the on-site hazardous materials response team.
The ability to have employees trained to respond to a facility spill
decreases response time and decreases plant down time.
Employees that work with a chemical and are
well-trained in its risks can quickly and efficiently stop a leak or
clean up a spill with proper training and equipment. This is one area
related to the haz-mat team that should be more thoroughly reviewed.
Equipment such as Level A entry suits should be maintained in quantities
large enough to mitigate hazards and must be pressure tested annually.
There should be equipment for response to a spill and separate equipment
A comprehensive training guideline should be established
with minimum performance standards and annual training. Current annual
training for the team members is just a few times per year.
releases and chemical usage should be reviewed by the team members to
help identify and correct problems prior to incidents occurring.
Forklift training and certification procedures
need to be reviewed. The first place to start is the identification of
key employees who are responsible for operating forklifts on a dailybasis.
Those employees should receive training and certification on
an annual basis, as most currently do.
A limited number of fill-in or
part-time employees should be identified and receive training on a
semi-annual basis. The increase in training is necessary due to the
limited number of times they access the vehicle, which increases the
potential for an accident.
Personnel who only occasionally utilize
forklifts (less than 2-5 per month) should be discouraged from becoming
certified, and shift-based operators should be identified. This would
greatly reduce the risk of damage or injury and lessen the current
number of certified forklift operators in the plants.
Most of the facility equipment and machinery is
in great working order and safety systems are in place and operating.
Several presses were in need of safety modifications with
upgrade equipment that is already on site. The installation of that
equipment should occur immediately.
Anytime a safety issue is
identified within the facility and equipment modification or procedural
changes are required, they should take high priority.
Some form of heat
shielding or access restriction should be added in the sizing area at
the Sky-Hi plant.
In areas where laser usage takes place, a more
comprehensive plan should be developed to limit access during use and
possible exposure during operation.
The second floor storage area within the Sky-Hi
plant over the production area at Sky-Hi should have a more thorough
engineering review to check weight distribution to make sure the 65
lbs/sq ft maximum is not exceeded.
One of the largest injury rates during 2004
appears to be cuts and lacerations from exposed metals. This will be
partially discussed during employee safety, however managers and the
safety manager should take a stronger approach at identifying and
protecting exposed metal edges that are of high risk to help minimize
The review of Employee Safety issues also
identified some areas of improvement. Safety training of employees
should occur in several different ways. Employees should be initially
trained regarding overall safety procedures and then be trained to their
Semi-annual refresher training should be
conducted for all employees regarding plant operations and required
trainings (i.e. hearing protection, lock out / tag out, etc).
trainings should occur monthly or quarterly to review safety concerns
that may be new or causing issue within the plants.
committee must be staffed and meet monthly to review safety issues and
help the safety manager identify issues that should be addressed. After
talking with Mike Wilson (safety manager) and during our observations
it appeared to us during the assessment that many aspects of safety were
not taken seriously by members of middle management.
training and audit functions should be implemented to stress several
different areas of safety.
The injury reporting process should be revised to
place stronger controls on employee responsibility for injuries.
current process does not identify causative factors and any remediation
to prevent future injuries.
It also does very little to identify
process/procedural changes, equipment modifications or disciplinary
action of the employee or manager.
If the current system does not have
employee, manager, safety committee/manager and executive management
reviews installed the potential for abuse is present.
A process should
be established to reduce the number of reportable worker injuries. This
injury reduction process should be facility-wide and production/plant
Incentives or penalties should be developed.
Air management for employees is an area of
concern at the McDougal-Shell plant.
The fume and dust removal system
that was installed when the plant opened has yet to be serviced. A
service regimen must be established that allows for optimum exhaust and
A filter changing schedule should be maintained by facility
Quarterly flow testing should be conducted at each
entry/machining area to check performance of the exhaust system.
the inspection of the facility, aluminum dust covered most surfaces in
the facility, including offices. A check of the HVAC system showed that
filters had been removed due to clogging and not replaced. Obviously,
it is dangerous to allow aluminum dust to migrate through the heater,
and at a minimum it is a fire hazard.
Previous exposure to the heaters
in the Sky-Hi plant caused damage and replacement of expensive complete
The more important factor is that the amount of dust
that caused the filters to clog is now being aggressively circulated
throughout the plant for workers to breathe and is a repertory hazard.
Remediation of the exhaust problem should limit a significant amount of
the dust issue, but a maintenance schedule must be established for the
HVAC filter change also.
During the assessment we spoke with John Winston from Twin Oaks, who advised he would submit a quote for this
This should not be conducted by any outside vendor. This is a
simple maintenance task which should be provided by Sky-Hi maintenance
people on a weekly basis.
It should also be of consideration during the
expansion of the McDougal-Shell plant to enclose an employee
break/dining area. The current area is next to, and exposure continues,
for employees during breaks and dining.
The safety manager has an annual review of
Personal Protective Equipment (PPE) hazard evaluation requirements for
each worker. The Safety Manager, Plant Managers and employees must
utilize provided equipment where required.
If the hazard evaluation identifies required
equipment and the PPE is provided, the employees should be required to
The hazard evaluation should look at process/procedural
changes to prevent employee exposure to risk.
When those changes are
not an option and PPE is required, it is the last level of protection
for the employee.
As part of this, the facility manager and safety
manager should review the policy of allowing employees to eat or smoke
at their workstation. This can be distracting and it prevents employees
for utilizing assigned PPE (i.e. gloves, full face shields, etc.).
Several areas that were specifically identified as ‘no eating’ had
employees snacking during the facility review.
There is already a Business
Continuation plan in place for the facilities.
plan needs to be reviewed at a minimum annually and updated.
should be dedicated to each operation of the company (i.e. Accounting,
Human Resources, Production, etc.) as to the requirements for emergency
operations or movement offsite.
Due to some of the types of items
produced within the facility a stronger terrorism reduction plan should
be in place.
Key management and office personnel should receive
training in facility and personnel protection related to potential
A plan should be developed that mirrors the national
risk level and includes procedural facility and personnel changes as the
national (soon to be regional) risk levels change (i.e. yellow to
orange, orange to red, etc.).
The plan should also include training and
procedures for specific risks that may be specific to a region or
The plan must insure for duplication of essential records
that would allow the company to continue operations if an area were
destroyed or access denied.
The business continuation plan should be in
all hazard manuals that allows for raw stock, machinery and chemicals to
continue to arrive at the plants, daily employee productions, payroll
and facility operation to occur and completed projects to be forwarded
to customers during or after any national, regional, local or facility
The loss prevention issues identified during the
assessment are listed in this segment of the report. Assessment
findings to be addressed include the following items:
Design and implement a Loss Prevention Programfor
all locations. The program should include the following items:
Require Comprehensive Background Checksfor all job
candidates. Specific applicant information should be obtained regarding
criminal, civil, or driving issues to preclude hiring those individuals
with troubling histories.
Verify that Subcontractors and Temporary Agencies perform
similar Background Checksfor any individual that will perform
work within the facility. Maintaining a consistently high standard for
these employees helps avoid security and liability issues.
Additionally, recurrent review of all contractors and service providers
should be conducted to maintain appropriate checks and balances and
Require current employees and management to notify Sky-Hi
if they are convicted of a felonyoffense during the course of
their employment with the company. It is appropriate for an employer to
be made aware of their employee’s criminal status as it may jeopardize
security at the facility. Periodic background updates are permissible
and recommended on an as needed basis.
Include a Duty to Informrequirement in the
Employee Handbook or Policy Manual. Simply stated, this policy requires
employees who have knowledge of a security or safety issue to inform
management about the issue. This policy allows employees to bring
useful information forward that they otherwise might feel uncomfortable
sharing with management. Examples of the type of information employees
become aware of are:
Enhance the current Drug and Alcohol Screening Program by
Post-Accident testing on a 100% mandatory basis – this
will identify employees who were impaired at the time of their accident
and thereby reduce Worker Compensation expenses
Include the entire workforce in the current Random Drug
Screening program, not just those required by the FAA or DOT – this will
be an added deterrent to the 33% of employees not currently subject to
the Random Screening Provisions
Train and educate management to utilize the ‘For Cause’
testing provision on an ‘as needed’ basis – this deterrent tool is
already available under the current Drug Policy but has not been
utilized on a single occasion by management to date
Require more strict compliance related toPhoto
Identification Badges. They are to be worn at all times while on company
property. Retain a copy of each employee’s photo in the employee’s
personnel file for use as needed. Enforce guidelines for the recovery
of the ID badge upon separation from the company.
Establish a Key Control Policythat provides
consistent guidelines for management related to assigning, accounting
for, securing, and recovering all facility keys. This policy should
include forms to be utilized at the facility to record key assignment
and recovery information. Each key holder is required to sign for keys
they receive and agree to comply with security provisions associated
with key controls.
An O-K Lock
representative has reviewed the existing key and lock set-up at the
facility and a report specifying the recommended changes is being
prepared for review.
Repair or replace all equipment required to arm the ADT
security system and maintain use of the system on an ongoing basis.
This entails revising all pass code holders numbers and determining a
‘Call list’ to be used by the ADT monitoring station in the event of
unauthorized or undetermined activity. Additionally, procedures and
training must be designed and implemented on the acceptable use of the
system. A review of the system was concluded during the Assessment.
The changes to the system are included in a separate document attached
to this report.
The Security Camera System (CCTV)should be
enhanced and utilized on a consistent basis to deter losses and
encourage efficient and productive work performance. The system should
continue to be utilized to review accidents and other incidents as it
has been in the past. The specific enhancements include expanding the
number of cameras at the facility from 5 to 8, and
reconfiguring the placement and/or angle of camera coverage at the
primary facility. The review process has been concluded during the
Assessment. The changes to the system are outlined in a separate
document attached to this report.
Design and implement Loss Prevention Trainingfor
all Sky-Hi’s management and employees. The lack of a consistent
training program to raise awareness and educate employees and management
about basic loss prevention responsibilities is a major issue and
increases the likelihood of internal theft and other negative
behaviors. As with Safety Training,it is proven that recurrent
training sessions have a positive impact on the bottom line. The program
should consist of three separate types of training based on the
New Hire Orientation – Employee Handbook reviewed –
Signature page obtained and filed. Explains basic loss prevention
policies and procedures. Establishes the appropriate environment that
Sky-Hi intends for its employees to operate within. Outlines
expectations and standards to be maintained.
Employee Training - Designed to raise Loss Prevention and
Security awareness for current employees. Re-emphasizes Loss Prevention
standards and allows experienced employees an opportunity to seek
clarification or offer input on any LP or Safety issues they may have.
Management Training – Designed to educate and increase the
confidence level of Sky-Hi’s Management staff and raise their awareness
on LP issues such as internal theft and employee substance abuse. Includes exercises on
writing Incident Reports, and conducting basic fact-finding interviews
for incidents they may face.
There is a lack of management awareness concerning
Reasonable Cause Drug Screens if an employee is suspected of being under
the influence of alcohol or controlled substances.
More emphasis needs
to be placed on what management can, and should, do in the event of this
It was determined that many of the management currently in
place are reluctant to get involved and make a decision in situations
that warrant immediate attention.
Managers need to be better educated about
the process so they become more confident to use it.
There is no formal Inventory Control System in place to
account for company tools, equipment, chemicals or product.
reported losses in these areas, however with no system in place to
account for the losses, it becomes difficult to attack the issue and
identify who is responsible.
An Inventory Control System will deter
internal theft and assist in holding individuals accountable for their
work habits. This system includes an Etching Program for all expensive
tools and equipment.
A specific program for the recovery of all ‘scrap’
metal can be included in this system.
There was a consistent finding that indicated a lack of
Loss Prevention Documentation and Communication.
that occurred within the facility were not consistently documented or
properly communicated to upper management for follow-up or review.
Management LP training sessions targeting this issue will improve their
ability to complete these informational reports.
The design and implementation of a comprehensive
Loss Prevention Program, with appropriate procedural guidelines and
sufficient focus is the primary recommendation of the Assessment.
Within the LP Program, there are various
components to be considered as a whole. Enhancements to the Background
Check policies and a revised Employment Application are initial items
within the LP Program. Formalized Loss Prevention Orientation and
Training components will be designed and implemented for all Sky-Hi
management, new-hires and current employees.
Management training should include specific
instruction on responding to potentially criminal issues such as
internal theft and narcotics sales or use. The LP Programwillalso provide specific policy and procedure related to the
administration of Key Controls, Access and Egress Controls, Security
Camera System, Burglar Alarm System, and Inventory Controls (Etching
Program, Tool Crib Operation, Scrap Metal Recovery Program, etc.).
The cost centers that will benefit directly from
the Loss Prevention Program implementation are OSP (including tooling),
payroll, scrap recovery, maintenance and shipping/receiving, among
Proprietary Information Protection (PIP) and
Electronic Information Security (ELIS) standards for computer use and
security of sensitive information must become a priority and be
monitored in a systematic manner.
ALoss Prevention Auditwillbe designed and conducted periodically to maintain compliance with the
established standards and/or identify those managers and employees who
do not understand their responsibilities or have chosen to subvert the
regulations for any number of reasons.
If an Audit Finding determines
that the employee acted to intentionally cause a loss or do other harm
to the business, an internal investigation should be conducted to
thoroughly examine what occurred and identify those responsible.
Plans and Follow-Up Auditsshould be utilized consistently to
increase procedural compliance,help deter negative activities
and keep the awareness level high for possible issues.
There is substantial legal precedent which
demonstrates that companies who are aware of security issues and do not
initiate a reasonable response have increased liability exposure.
Conversely, companies that are able to demonstrate that they have, in
fact, responded to security issues in the recommended pro-active manner
are much better protected against such losses.
Summit Loss Prevention Consulting
appreciates being chosen for this assignment. If there are any
questions concerning this report please contact Tony Jarana.
For information about conducting a comprehensive investigation,
call 317-363-8312, send email to
info@SummitLossPrevention.com. or submit the short form below:
The local and Midwest
markets we serve in and around Indiana include Batesville, Bloomfield,
Bloomington, Boonville, Brownsburg, Carmel, Chicago, Cincinnati, Columbus,
Derby, Detroit, Edinburgh, Elkhart, Fishers, Fort Wayne, Fortville, Gary,
Greenfield, Greensburg, Indianapolis, Kokomo, Lafayette, Lebanon,
Louisville, Marion, Mooresville, Muncie, Noblesville, Notre Dame, Peru,
Plainfield, Richmond, Rockport, Rockville, Rushville, Smithville, South
Bend, Syracuse, Terre Haute, Topeka, Union City, Valparaiso, Wabash, Warsaw,
West Lafayette, Westfield and Zionsville.