To protect your business premises, you should first assess the local environment, eg street, business park or shopping centre. You can look at the level and types of crimes that are being carried out in your area using the Police Service of Northern Ireland's (PSNI's) official crime statistics.

Business security survey

This assessment will form part of your first steps to performing a full security survey. A business security survey should include both an external and an internal assessment of any crime risks to your business. Try the onion-peeling principle, which involves thinking about your business and its premises as a series of layers, to conduct your survey.

Preparation for security survey

When using the onion-peeling principle, you should take security measures at each layer to delay and deter the criminal and to protect or remove any potential targets for crime. There are three types of physical targets in most businesses:

1. buildings - eg stores and garages
2. property - eg cash, stock and equipment
3. people - ie staff, security guards and visitors

Your aim at each layer is to:

• reduce the potential rewards of crime
• reduce any potential provocation to commit crime
• remove any potential excuses for criminal behaviour

You should concentrate on all areas of security and consider all potential targets and the effects on them, such as financial loss, temporary closure, inability to deliver goods, or staff morale. Other risks to consider include: fraud, violence, graffiti, computer data theft, etc.

When preparing your security survey, you should take into account:

• the amount and types of crime in the area
• whether anyone nearby has been a victim of crime
• whether any business crime partnerships exist in the area

Use a map to identify access to your business property and potential entry and escape routes. You need to consider any escape routes for offenders that may not be easily seen.

Carrying out a security survey

Consider using a security checklist when undertaking a safety survey to ensure that you cover all areas of concern.

You should keep notes on your security survey to help future security plans and make them more effective.

There are four areas to consider for your security survey:

Environment

The area around your business - eg the street or alleys bordering your premises.

Perimeter

How someone could gain access to your business property from the public space.

Outer shell

For example, doors and windows that could provide access to your buildings.

Interior

Consider inside the building, and how this could be protected from criminal activities.

You should walk around the boundary of your business property and check for any weak areas, both during the day and when dark. Identify opportunities for crime, such as:

• walls or fences that could be climbed
• bins or other objects that could be used to climb or could be targeted for arson
• tools or materials left out that could be used to break in
• possible hiding places
• any poorly lit areas that could be used as cover for a break-in

Fencing and property boundaries

Steel fencing, railings or walls of at least 2.5 metres in height can make effective boundaries for your business property. You could also use barbed or razor wire, rotating vanes or electric fence alarms at the top of fences or walls, and anti-climb paint to make access harder.

When dealing with the shell, you should think about security measures that will delay an attempted break-in or put off potential offenders.

You should pay particular attention to the:

• roof, especially a flat roof
• cellar
• loading bay
• side of your business
• back of your business

You should think about how a criminal might view the business when open and closed, during the day or at night.

In order to protect your business property from crime, first carry out a business premises security survey. Once you have determined the main security risks to your business, you can decide what actions you should take.

Which security measures should I take?

The basic idea is to introduce measures that will delay and deter potential offenders from seeing your business as an easy target for crime. We have outlined below security measures that you could apply to protect your business:

Secure access points

Have strengthened doors fitted, ensure all windows have locks, install strengthened shutters, and ram raid barriers if necessary.

Secure the perimeter

Ensure gates are secure and fences aren't damaged or provide opportunities for access. Applying anti-climb measures can also be effective, however, you must have signs to state you have them installed.

Access control

Control access to the business by keeping a record of who has keys or passes and ensure employees that leave hand them back.

Lighting

Install security lights at dark points that will come on when movement is detected.

Alarms

Fit intruder alarms.

Secure property

Secure equipment with asset tags and record details of serial numbers. You should also consider securing devices such as laptops and tablets to larger equipment such as desks. Secure your business assets.

Stock control

Protect stock by keeping regular tabs on stock levels.

IT security

Address IT security issues such as hard-drive encryption, off-site data storage, and software security updates. Protect your business online.

Sensitive information

Carefully dispose of any sensitive documents or information by shredding sensitive paper waste.

Security cameras

Install CCTV surveillance and regularly check that your cameras are in full working order.

Any measures that you take should be legal, appropriate, realistic and cost-effective.

For further guidance on securing your business property see the National Security Inspectorate's workplace security safety guidance.

Professional security consultants can offer a comprehensive risk assessment of any premises and can recommend security measures to meet the risks faced.

As an employer you have a employers' health and safety responsibilities. Bringing in measures to improve staff safety and making employees and customers aware of their responsibilities can also improve the security of your business.

Improve staff security

Steps you can take might include:

• checking visitor and delivery personnel identities
• always checking the identity of people you deliver to
• getting signatures for the receipt and issue of goods
• CCTV system to cover entrances and exits

High security risk businesses

If your business handles a lot of cash or expensive goods, it makes sense to use a properly fitted protective screen to protect staff (eg at a cash register), closed-circuit television (CCTV), and secure storage such as a safe. See business security: cash.

If your business is at risk or is in a high-risk area, it might also be appropriate and cost-effective to employ security guards.

You could also join local community initiatives or Neighbourhood Watch initiatives. Contact the PSNI for details of initiatives in your area.

Customers and business security

All customers should be asked to remove motorcycle helmets and scarves that cover a face before they enter your business premises. A height mark at the door can be used by staff to accurately gauge the height of a criminal if a report of crime needs to be made to the police. If the height mark is highly visible this can also act as a deterrent for potential criminals that target your shop.

Employees who work alone

If you employ staff who work alone, you can help to reduce risks to them by using:

• personal alarms
• radio link scheme
• controlled access or CCTV with audio
• automatic warning devices
• lone-worker monitoring devices
• regular police or security checks

You could also ask staff to vary their routes and times for added security. Ensure lone workers' safety.

When a violent incident happens

Violent incidents can involve theft, angry customers, or customers under the influence of alcohol or drugs. You can offer staff training in conflict management to deal with aggressive customers. Advise staff not to put themselves at risk, and to move away from aggressive customers but avoid becoming isolated.

When necessary they should dial 999 or get help quickly by using an alarm. They should try to write down information about what happened and secure CCTV footage and the scene until the police arrive.

All such incidents should be reported to the police. This can be done by dialling 999 in an emergency, or 101 for non-emergency situations.

Victim support

If a member of staff is a victim of violence, they may need medical attention, which may be available in-house or may be required from the ambulance service. However, they will need your support. This might include:

• a debriefing - talking about what happened
• giving time off to recover
• suggesting specialist counselling

Other staff who witnessed the incident may also be affected. They can get help and support from Victim Support NI.

Download violence at work guide (PDF, 105K).

Bomb threats and suspect packages

You should ensure staff know what to do in the unlikely event of a bomb threat or a suspect package is found on your business premises. Download the PSNI's business guidance on dealing with bomb threat telephone calls and suspect packages (PDF, 212K).

Tiger kidnap

Tiger kidnap involves the short-term hostage-taking of family members of an employee who has immediate access to cash or valuables. The captives are frequently held overnight and the aim of the criminals is to frighten their victims to such a degree that they will not contact the police, even when they have an opportunity to do so.

There are a few simple procedures to follow that will help to protect your assets on and off-site. Assets or property could include:

• computer equipment, laptops, or tablets
• mobile phones
• information stored on computers, organisers, or on paper
• business vehicles
• specialist equipment and tools
• plant and machinery

Marking business assets

You should permanently mark each piece of equipment and make a note of the:

• make
• model
• serial number

You should also maintain a record of all business assets, where they are located, and who is responsible for them. Asset checks, as well as stock checks, should be carried out by a dedicated member of staff.

Secure essential and high-value equipment in a separate secure room.

Computer equipment and mobile phones

If a computer, laptop, or tablet is lost or stolen, often the loss of information and data can be more of a serious issue than the cost of a replacement. This will particularly be the case if personal information is held on the computer. It could damage your reputation, affect your business's ability to operate, put individuals at risk, and result in a substantial fine. Read PSNI guidance on what you can do to protect computers in your business.

A way to address this issue would be to use cloud computing. This lets you store business information and use hardware and software remotely and securely over the internet.

Protecting business data

You should carry out an assessment of the risks and take measures to keep your physical and information assets safe. Common threats include: 

• cyber crime - malicious people might gain access to your systems and alter, steal or delete data - cyber security risk management
• viruses - programs that are created to cause a nuisance or damage computer systems - detect spam, malware, and virus attacks
• fraud - theft of sensitive data such as employee records or valuable intellectual property by hackers or even your own employees - business data breach and theft
• data loss - caused by any of the above or by loss of hardware - eg by a flood at your premises

Small steps can help increase data security. For example, all computers should be password protected and have an internet firewall and anti-virus software. Employees who use computer equipment on a regular basis should change their passwords and back up their files regularly. Any information kept on electronic equipment should be copied and kept securely off-site and in a fire-proof safe. Protect your business online.

Every individual mobile phone can be identified by a unique International Mobile Equipment Number (IMEI). The IMEI can be found by typing *#06# into the handset and should be written down and stored securely.

Protecting business vehicles and transported goods

Any vehicles you own should be treated in the same manner as the shell of your business. You should always secure the doors and windows and have a lockable box in the cargo area. You can also add extra security, such as:

• an alarm
• a vehicle tracking system
• an immobiliser
• a steering lock

For high-value vehicles and machinery, such as tractors or plant machinery, you could consider marking property or fitting a tracking device. Read PSNI guidance to help prevent plant machinery thefts.

Reflective film on the windows will help to hide the interior. You should always make sure that anything left inside is hidden from view and use signs to let people know that nothing of value is left inside. If your business receives a lot of cash over the counter, it should be removed frequently to a secure location.

Secure lorry parks should be used for overnight stops.

For goods delivered by post, it might be appropriate to use a more secure service such as recorded or special delivery.

Building site security

Building sites are often the target of crime with a lot of high-value plant, machinery, and tools on site along with large quantities of materials such as cement, bricks, concrete blocks, steel, and timber. See the National Business Crime Centre's guidance on construction site security.

If you or your employees handle cash, try to avoid getting into a routine when depositing it to a bank or building society. It is also wise to reduce the amount of cash held on your business premises where possible. This can be done by:

• making a regular, secure payment into the bank
• transferring excess cash into a locked tamper-proof unit
• removing cash overnight - eg emptying tills
• encouraging the use of electronic payments, credit/debit cards or cheques
• paying wages straight into staff bank accounts

Keeping cash on site

If cash has to be kept on-site, you should make sure it is held in a secure manner - eg a safe that is fitted to the building. Where possible the minimum amount of cash should be held in public areas and tills should be cleared regularly. Drop-safes, with time-locking mechanisms, should be used to ensure that cash is held securely.

Staff should not handle cash alone and anyone who deals with financial records should not handle cash.

Moving cash around

When you or an employee makes a secure payment to the bank, it should not be made alone. It is also advisable to vary the times and the route used. Restrict information about cash movement to those directly involved and consider using a professional cash-in-transit business.

Stained and counterfeit cash

Encourage your staff to be aware of the risk of accepting stained notes as these could have been stolen. Notes become stained when a cash degradation system has been set off during a robbery. These systems are used in tills (by banks, post offices, building societies, and retail outlets), cash points, and cash boxes used by cash-in-transit companies that deliver and collect cash.

If you are offered a stained note by a member of the public, treat it as you would a mutilated or damaged note and do not accept it. Advise the customer to take the note to a Post Office or bank and obtain a Bank of England Mutilated Note (BMN) claim form for the repayment of damaged notes see further information on damaged and contaminated banknotes. By filling in this form and going through the proper channels, providing the note is genuine, they will be reimbursed for the note they have handed in.

There are a number of ways to tell if a note is counterfeit or genuine. It is illegal to keep or pass on fake notes. Stopping criminals from spending stained or counterfeit notes helps to remove the incentive for crime.

Cheques

The number of cheques being used has declined in preference to the use of online banking and electronic payment systems. These systems have the benefit of additional security and anti-fraud measures. In spite of this cheque, fraud has become more organised and sophisticated with advances in computer and printing technology.

Writing cheques

When writing cheques:

• always fill out cheques with the full details of the payee
• avoid any blank spaces and rule out any unused space
• when sending by post, it is best to send securely and not use a windowed envelope
• store cheques securely and use them in serial number order
• be sure to compare cheques written with the correct paperwork
• destroy spoiled cheques by shredding if possible

Accepting cheques as payment

When accepting cheques:

• ensure they are written, signed, and torn out in front of you
• check that date and amount are correct
• don't release goods before bank drafts are cleared
• if you receive a cheque for far too much and are asked to send the balance back to the drawer by electronic funds transfer, this is probably a scam where the cheque will bounce but your account is still debited

Debit or credit cards

You must have procedures in place for handling credit and debit cards. The secure chip and pin system should be used where possible. If you are unable to use chip and pin, you should check the cards for:

• start and expiry dates
• signs of tampering
• matching number on the card and till printout
• matching signature

If in doubt, you can always phone the card issuer for authorisation.

Contactless payment has become a more popular method of paying through cards as well as wearable and mobile devices.

Keeping stock secure depends on knowing what you have and where it is located, so you should keep records of when stock is sold, used, replaced, or thrown away. In order to keep stock secure, you should:

• keep records of stock with regular stock checks - including deliveries
• stock control system - ensure a system of reporting stock variations is in place and amendments to the records only take place after authorisation, see stock control systems - keeping track using computer software
• keep stock away from doors and in a place where it takes an obvious action to reach
• use secure lockable, fireproof cabinets or rooms for high-value stock
• use mirrors or closed-circuit television (CCTV) to keep stock and equipment monitored
• try to limit the number of people who have access to valuable stock

Thieves and shoplifters

Staff should always be vigilant for any suspicious behaviour and should take appropriate action, such as reporting an incident. Suspicious behaviour could include:

• choosing purchases quickly
• trying to rush the transaction
• working in groups to distract your staff
• splitting purchases between different debit or credit cards

To find out what else you can do to deter this type of crime, see top tips to reduce shoplifting.

Prevent theft by staff

There are a number of measures you can take to combat theft by staff, for example:

• create an honest work culture - educate your staff about the potential costs of theft and have a clear, communicated policy on this issue
• restrict access to warehouses, stockrooms, and stationery cupboards
• install CCTV in staff car parks
• regularly change staff who control stock to avoid collusion or bad practice

Staff credentials

Before you employ a new staff member, you should check the identity of the staff member and their references thoroughly.

You are also required to check that potential employees have the right to work in the UK. See pre-employment checks.

If you need to report a crime against your business in an emergency dial 999.

Non-emergencies

For non-emergency incidents and general enquiries, dial 101 - the Police Service of Northern Ireland's (PSNI) non-emergency number. A trained member of staff will take your call. Contact the PSNI.

When you ring the police to report a crime, the police will give you a Crime Index number. Keep this number for future reference, as you might need it when discussing the incident or accessing police records.

Anonymously report a crime

You can also report crime anonymously by calling Crimestoppers, an independent charity helping law enforcement locate criminals and help solve crimes. You can call Crimestoppers on Tel 0800 555 111.

Identity theft and fraud can be a threat to your business, particularly if you carry out any part of your business online.

The target of fraud may be an individual within the business or the business itself. Criminals use a wide range of methods and approaches to commit their crimes. The aim is usually to steal sufficient information to assume the identity of the person or business with the aim of obtaining goods, services, or credit fraudulently.

One of the most common methods of stealing your corporate identity is through your IT system. Fraudsters may use 'malware' to access usernames, passwords, or bank details - detect spam, malware, and virus attacks.

Another method is the use of phishing websites which use keystroke logging software to record your keyboard strokes as a way of stealing financial details. Protect your business against phishing.

Protect your business from scams

There are many forms of scams designed specifically to target businesses. You should familiarise yourself and your staff with key signs of a scam. See PSNI guidance to protect yourself from scams and fraud.

You can protect your business from scams in several ways. For example, you should:

• Limit the number of employees authorised to approve purchases of goods and services, and ensure that all other employees know they cannot discuss ordering or payments.
• Never agree to anything in a rush. Remember, it is possible to make a legally binding contract over the phone, and the main problem with oral contracts is proving exactly what was said and agreed. Generally, it is one person's word against another's.
• Do some research on the goods or service being offered.
• Read the small print thoroughly before signing any paperwork, so that you know what you are committing to and how much it might cost.
• Keep copies of all paperwork, proof of postage and all other correspondence.

Don't be pressured into paying for services you have not agreed to, that don't match what you ordered, or that were promised and haven't been provided. You should take advice on your legal rights if you are unsure.

If you are threatened with debt collectors or a credit 'black listing', remember that only a court can decide whether you are liable to pay, and disputes with another business will not necessarily affect your credit rating.

See the Little Book of Big Scams for further guidance on how to protect your business from scams.

Telephone preference service

If you are a sole trader or a partnership you can register with the Telephone Preference Service (TPS) by calling the TPS Registration Helpline on Tel 0345 070 0707. 

The TPS is a central opt-out register, whereby individuals can register their wish not to receive unsolicited sales and marketing telephone calls. It is a legal requirement that businesses do not make such calls to numbers registered on the TPS.

Minimise the risk of identity theft and fraud

To prevent IT fraud your business should implement anti-virus software and firewalls. You should also introduce internet and email policies to reduce the risk of employees inadvertently disclosing sensitive information. See how to protect your business online.

Another scam involves fraudsters stealing your entire corporate identity. Fraudsters attempt to do this by changing the information your business has registered with Companies House. Find out how you can protect your company from corporate identity theft.

You can help prevent identity fraud through the secure destruction of sensitive business information. When you need to destroy information in paper or electronic formats, make sure that you use reputable suppliers that comply with European standards, particularly EN 15713.

Your business should have adequate security and safety procedures and staff should be made aware of them. This could be anything from a simple procedure like locking a delivery door immediately after deliveries, or a more complex procedure like using security staff or an alarm system.

Locking up after close of business

You should also have a set procedure for securing your business premises. This should involve checking that all doors and windows are locked, lights and computers are switched off and the alarm and any other security measures are switched on. Pay special attention to areas where you store combustible materials or rubbish. Regularly test fire and smoke detectors to make sure they work.

You should consider a security plan to protect both equipment and information, such as:

• removing equipment from a vehicle overnight
• storing equipment securely
• locking the equipment room
• encouraging staff to be vigilant

Using signs as a security measure

A well-placed sign can help put off a criminal. For example, you could use signs stating:

• all properties are marked and easy to identify
• no cash is held on the premises
• staff have no access to the safe
• all tools removed from this vehicle
• closed-circuit television (CCTV) in operation
• no stock left overnight

All employees should be aware of their security duties and you should check that your security measures are followed.

When necessary, employees should dial 999 or get help quickly by using an alarm. They should also try to write down information about the incident and secure CCTV footage and the scene until the police arrive.

For more information, see business continuity and crisis management.

Closed-circuit television (CCTV) uses cameras to monitor the inside and/or outside of your premises. Some CCTV systems require manual operation, either by a private monitoring company or an appropriate member of staff.

Benefits of CCTV

CCTV can help by:

• deterring thieves
• watching remote areas or more than one area at once
• enabling premises to be watched in safety
• helping police to identify and prosecute intruders

Choosing a CCTV system

Your choice of CCTV system will depend on the value of your stock, machinery, or office equipment and the type and location of your premises.

Ask your insurance company or crime prevention officer for advice. You can find an approved security supplier.

Placing the cameras

Position cameras in areas:

• particularly vulnerable to intruders
• where staff could be alone or at risk, such as car parks
• hidden from view or which are particularly quiet

You should put up a notice stating that you have a CCTV system. Cameras need to be easy to spot to have a deterrent effect. You can use dummy cameras as a cheap deterrent, either on their own or to make a real CCTV system look bigger. However, relying heavily on these is risky because potential thieves might realise they are fake. Try to:

• protect cameras from attack
• avoid blocking camera views with high-sided vans, trees, etc
• adopt a tape archive system that can be used as evidence if necessary

Make sure that the system is correctly set up and that tapes are capable of recording images clearly. If the system is not recording images sufficiently it may be difficult to identify the perpetrators.

Insurance requirements

Your insurers may specify the kind of system they want you to install. They may also want your system and installer to be inspected by the National Security Inspectorate (NSI) or SSAIB.

CCTV and data protection

If your business uses closed-circuit television (CCTV), you have a legal duty under the Data Protection Act to make sure that individuals' rights are protected. You usually have to register with the Information Commissioner's Office (ICO) if your business operates CCTV. Failure to do may be a criminal offence and you could face a fine. See if you need to register with the ICO.

CCTV operators must follow the correct procedures when they gather, store, and handle images:

• You must tell people that they may be recorded by CCTV, eg by displaying signs. These must be clearly visible and readable. See the ICO's guidance on the right to be informed.
• Individuals have the right to request images that you have recorded of them. You must provide these within one calendar month. See the ICO's guidance on the right of access to personal data. 
• Release of CCTV images must be controlled and in line with the system's intended purpose. For example, if the system is intended to help prevent and detect crime, you can disclose images to law enforcement agencies.
• You should only keep recorded images for as long as needed. See the ICO's guidance on data storage limitation.

See the ICO's CCTV checklist. Read further guidance on the UK General Data Protection Regulation (UK GDPR).