What Should Be on a Retail Store Security Survey Checklist?

By awareretailgroup.com Editorial· Edited by Tom Walsh· Published 2026-10-21

A retail store security survey checklist is a zone-by-zone walk of the store: perimeter, cash office, stockroom, docks, fitting rooms, keys and codes, and alarms and cameras. Every item is scored by severity, and every failure gets a named owner and a due date. The top check in each zone:

• Perimeter: doors lock, the deadbolt has at least a 1-inch throw, and the approach and parking lot are lit.
• Cash office: a drop-safe or limited-access safe is in use, and the combination changed when the last access-holder left.
• Stockroom: access is restricted to employees, and cameras cover it.
• Docks: delivery and garbage doors are locked when not in use, and loading-bay power is cut at close.
• Fitting rooms: written rules for use and returns, and a staffed changing-room station.
• Keys and codes: a record of every key issued, and every key recovered when an employee leaves.
• Alarms and cameras: devices are tested and repaired, and footage is kept at least 30 days.

Reported shoplifting is still edging up. In the Council on Criminal Justice’s mid-year 2026 update, the average reported shoplifting rate in the first half of 2026 was 4% higher than in the same period of 2025, across the 18 cities with shoplifting data through June (Council on Criminal Justice). The report adds that police-reported figures almost certainly undercount total shoplifting by a significant amount.

How do I score a store security self-audit and make sure every failed item actually gets fixed?

Score every item by severity. OSHA’s guidance on identifying hazards says to determine the severity and likelihood of incidents for each hazard found, then use that to prioritize corrective action (OSHA). For a store audit, label every item Critical, worth 3 points (a safe combination nobody changed, a dock door that doesn’t lock), or Major, worth 2 points (a missing changing-room sign, an untrimmed tree by a low roofline), then divide points passed by points possible for the overall score. Fail the audit on any single failed Critical item, no matter what the overall score reads. Each security survey should have three parts: a defined goal, a written checklist, and a report of the results (Effective Security Management, Seventh Edition (p. 214)). The score belongs in the report; the goal and the checklist come before it.

At the perimeter: a strike plate secured with 3-inch screws and a deadbolt with at least a 1-inch throw (East Brunswick). San Diego PD sets a stricter spec: at least 4 screws, 3 to 4 inches long, anchored into a wall stud (San Diego Police Department). In the cash office: a drop-safe, limited-access safe, or comparable device (WAC 296-832), with the combination changed when an employee who had access to it leaves (LAPD). In the stockroom: cameras with no blind spots, an item NIOSH’s gas-station and convenience-store guidance lists for building managers (NIOSH). On keys: a record of every key issued, every key recovered when an employee leaves, and cores changed after a loss, which SDPD says to consider (San Diego Police Department).

Consider changing lock cores after a key loss, per SDPD; it is a note on the keys row, not a Critical check.

• Give every failed item a named owner, not “manager on duty”
• Set the due date from the severity column, not a flat number for every row
• Re-check every open item before scoring anything new at the next audit
• Send any item that fails twice in a row to LP or AP

Re-audit at least once a year, or sooner if business operations change or a workplace violence incident occurs (OSHA 3153), and use an interim fix, like staging deposits elsewhere until a safe is repaired, to cover the gap while the permanent one is pending (OSHA).

How often should you change locks and codes after an employee leaves?

Change the safe combination when an employee who had access to it leaves (LAPD). The same page advises limiting access to keys, the safe, computerized records and alarm codes, and engraving “DO NOT DUPLICATE” on store keys (LAPD). San Diego’s police department applies the same logic to hardware: consider changing lock cores and keys when key losses occur (San Diego Police Department). Trigger the change from the event: a termination or a lost key. A high-turnover store can trip that trigger often. If there’s reasonable belief that keys have reached the wrong hands, change the combination immediately, and replace the lock itself when that isn’t possible (Handbook of Loss Prevention and Crime Prevention, Fourth Edition (p. 201)).

How long should you keep security camera footage?

San Diego’s police department sets the clearest floor: camera images should allow clear identification of anyone on the premises, with recordings kept securely for at least 30 days (San Diego Police Department). The Retail Council of Canada’s Ontario guide complicates that number. One section recommends storing footage for at least 60 days, preferably 90 (Retail Council of Canada), while another section of the same document sets the minimum at 30 days with 90 recommended (Retail Council of Canada). The two numbers inside one guide don’t match, which is worth knowing before adopting either one as policy. Write a store-level minimum into your retention policy rather than leaving it to whatever a DVR ships with by default: set it at 30 days at minimum (SDPD), and budget toward 90 if storage cost allows (Retail Council of Canada).

What should the dock and fitting-room checks look for?

Docks need two policies to verify: delivery and garbage-removal doors locked when not in use, and deliveries scheduled during normal daytime operations (OSHA 3153). Once the building is empty, the closing manager should also cut power to the loading-bay door and confirm no other door or window can be opened from inside (POP Center). Fitting rooms need a different kind of check: clear rules on changing-room use and returns (Retail Council of Canada), and a staffed changing-room station, since placing staff at changing-room stations and setting clear rules for their use are both measures that make shoplifting harder (POP Center). Score both items pass or fail on what you see at the door and in the written rules. See why some retail security cameras and tags fail to deter theft for how camera placement and tag design interact with this kind of physical check.

How do you prioritize fixes when there’s more to fix than budget?

Fund the fixes that don’t depend on anyone remembering to do something first. OSHA’s late-night retail guidance calls engineering controls the most effective option because they make a physical improvement without relying on human behavior, while administrative controls, a written rule, a posted sign, work only if people actually follow them (OSHA 3153). That puts a repaired dock lock or a rewired light ahead of a new sign when the budget runs short. Electronic article surveillance carries an older figure that belongs in historical context: one evaluation concluded EAS could reduce shoplifting and total inventory shortage by 35 to 75 percent (POP Center). Weigh that kind of spend against cheaper administrative fixes, a current key log, a posted changing-room rule, that cost staff time rather than capital. A documented audit trail also matters if a premises liability claim over inadequate security ever follows an incident on the property.

When should you call in LP, AP, or the police instead of doing it yourself?

OSHA’s late-night retail guidance recommends requesting periodic law enforcement or outside consultant review of the worksite as part of evaluating a prevention program (OSHA 3153). San Diego’s police department says its Community Relations Officer can run the survey and security assessment at no cost (San Diego Police Department), and East Brunswick’s Community Policing Unit offers free security survey evaluations based on availability (East Brunswick). Ask your own department whether it offers the same before paying a consultant for a first-pass survey. Inside the store, the trigger is simpler: send any item that fails two audits in a row to LP or AP instead of scoring it a third time.

How do you brief associates so the fixes actually stick?

A fix that only lives in a manager’s binder is easy for the floor team to never hear about. After an incident, the Ontario security guide recommends telling all staff what steps were taken and about any new or updated measure, a camera or a round of training, once the debrief is finished (Retail Council of Canada). Apply the same habit to a routine audit: when a fix closes, say so at the next loss-prevention huddle instead of letting it disappear into a spreadsheet. A short update, what failed, what changed, who to tell if it happens again, keeps the fix visible past the week it was made.

What to do this week

• Run the perimeter-to-alarm walkthrough and score every item Critical or Major using the table above.
• Assign a named owner and a due date to every failed item the same day you find it.
• Write a camera-retention minimum of at least 30 days into policy (SDPD).
• Change the safe combination when an employee with access leaves (LAPD).
• Re-check every open item at the next audit before scoring anything new.