How Security Consultants Save Businesses Money by Reducing Loss

   Every business accepts some level of risk. Theft, fraud, employee misconduct, operational inefficiencies, compliance failures, workplace incidents, supply-chain disruptions, cyber events, property damage, and business interruptions can all create financial consequences. The mistake is assuming that because a loss has become part of normal operations, it is therefore an acceptable cost of doing business. From a Weedman & Co. perspective, one of the fundamental purposes of security consulting is to identify where an organization is unnecessarily exposed, determine what those exposures are costing the business, and help management make informed decisions about whether the cost of reducing the risk is justified by the potential loss.



   The value of a security consultant is therefore not simply measured by how many cameras were installed, how many policies were written, or how many vulnerabilities were identified. The real value is found in the relationship between the exposure, the probability of an event, the potential impact, the cost of intervention, and the organization's ability to respond if the event occurs. A $100,000 security improvement may be an unnecessary expense for one organization and an extremely important investment for another. The difference is not the price of the security measure. The difference is the risk it is addressing.



   Consider a business experiencing $300,000 in annual losses associated with theft, fraud, inventory discrepancies, operational inefficiencies, and other preventable conditions. If a consultant is hired for $50,000 and the organization subsequently reduces those losses by $220,000, the financial benefit is significant. But the important lesson is not that every $50,000 consulting engagement will generate a $220,000 savings. That would be an unsupported promise. The lesson is that security can be evaluated as a business investment when the organization establishes a baseline, identifies the causes of loss, implements targeted corrective actions, and measures the results over time.



   This is where professional security consulting differs from simply selling security products. A vendor may have a financial interest in selling a particular camera system, access-control platform, alarm system, guard service, or technology solution. A consultant's role should be broader. The consultant should first understand the problem and then determine whether technology, personnel, process changes, environmental design, training, policy, insurance, contractual protections, or some combination of these measures is appropriate. Sometimes the right answer is to buy something. Sometimes the right answer is to change something the organization is already doing.


 

   Risk identification is therefore one of the first places a consultant can create financial value. Businesses frequently know that they have losses but do not always understand the conditions producing them. A retailer may know that inventory is disappearing but not understand whether the primary issue is shoplifting, employee theft, receiving procedures, inventory controls, vendor discrepancies, poor storage practices, or inaccurate reporting. A property manager may know that incidents are occurring but not recognize that lighting, landscaping, access control, resident behavior, or maintenance practices are contributing to the problem. A manufacturer may understand that production is being interrupted but not recognize the dependency on one vendor, one machine, one employee, or one facility.



   The consultant's job is to look for the connection between the loss and the condition creating the opportunity for that loss. That requires more than collecting information. It requires observation, analysis, professional judgment, and an understanding of how the organization actually operates. A policy may say one thing while employees do something completely different. A security system may be installed but routinely bypassed. A procedure may exist but be impossible to follow efficiently. A vendor may technically meet contractual requirements while creating operational exposure elsewhere. The difference between documented compliance and operational reality is often where significant risk exists.



   Loss prevention is another area where relatively small improvements can produce meaningful financial results. A business does not necessarily need to eliminate every loss. That may be unrealistic and economically inefficient. The objective is to identify losses that are significant, recurring, preventable, or disproportionate to the resources being used to address them. A consultant can help determine where intervention is most likely to produce a meaningful reduction. That could involve employee practices, inventory controls, access management, environmental design, surveillance, transaction controls, vendor management, or changes to the physical layout.



   The same concept applies to liability. Security professionals should understand that liability exposure is not limited to obvious security failures. Poor documentation, inadequate maintenance, inconsistent procedures, failure to address known hazards, ineffective training, or a lack of follow-through after an assessment can all become significant issues. In certain circumstances, statutes such as Florida Statute 768.0706 establish specific requirements that can affect the liability position of qualifying multifamily residential properties. The important lesson is not that compliance eliminates liability. It is that properly understanding applicable requirements and documenting the organization's actions can become an important component of risk management.



   Crisis management provides another example of where security consulting can produce financial value. A crisis does not have to destroy a company to become expensive. A few hours of operational disruption can affect revenue, payroll, customer relationships, supply chains, contractual obligations, and employee productivity. The longer the organization remains unable to perform critical functions, the greater the potential financial impact. A consultant can help identify critical operations, dependencies, decision-making authority, communication requirements, alternate resources, and recovery priorities before an incident occurs. The goal is not to predict every possible crisis. The goal is to understand what the organization depends upon and what happens when those dependencies are disrupted.



   This is where security and business continuity begin to overlap. A security incident may start as a security problem but quickly become an operational problem. A cyber incident can stop production. A workplace violence event can close a facility. A fire can disrupt an entire supply chain. A vendor failure can prevent a company from delivering its own products. A theft can result in more than the value of the stolen property if critical equipment, information, or inventory is unavailable. Effective risk management therefore requires the consultant to look beyond the immediate loss and understand the secondary and tertiary consequences.



   Insider risk is another area where organizations can lose substantial resources without always recognizing the security implications. Insider risk does not necessarily involve a malicious employee. It can include negligence, unauthorized access, poor judgment, policy violations, fraud, information mishandling, conflicts of interest, or individuals who have excessive access to systems or information they do not need to perform their jobs. Addressing insider risk requires more than background checks. It involves appropriate hiring practices, access management, segregation of duties, supervision, training, monitoring, offboarding, and understanding what information or resources each person actually needs to perform their role.



   Supply-chain risk presents a similar challenge because the organization may not directly control the conditions creating the exposure. A company can maintain strong internal security and still be affected by a compromised vendor, unreliable supplier, transportation disruption, counterfeit materials, inadequate contractor security, or a single-source dependency. Security consulting can help organizations examine the risk beyond their own four walls by evaluating vendor relationships, contractual requirements, operational dependencies, logistics, access, information sharing, and contingency options. The objective is not to eliminate every vendor risk. It is to understand where the organization is dependent upon someone else and whether the consequences of that dependency are acceptable.



   Operational efficiency is another area that is frequently overlooked when discussing security consulting. Security should not automatically mean adding more procedures, more personnel, more technology, and more expense. Poorly designed security can actually create operational inefficiency. Employees may develop workarounds because a process is too restrictive. Multiple systems may perform the same function. Security personnel may spend time monitoring low-value activities while higher-risk areas receive less attention. Access procedures may create unnecessary delays. Equipment may be purchased but never properly utilized. A consultant should be willing to identify these inefficiencies rather than simply recommending additional layers.



   This is why security decisions should not be based solely on the amount of available data. Data is important, but data does not make the decision. Data can be incomplete, manipulated, misinterpreted, or viewed without the operational context necessary to understand what it actually means. Professional judgment is required to interpret the information in relation to probability, impact, vulnerability, environment, and consequence. The consultant's value is often found in connecting those pieces rather than simply presenting the client with another report full of numbers.



   For executives and boards, this becomes especially important because security decisions are ultimately business decisions. Executives are responsible for allocating limited resources across competing priorities. Security competes with technology, staffing, facilities, marketing, production, compliance, maintenance, expansion, and other business requirements. A security professional who cannot explain why an investment matters in business terms will eventually have difficulty gaining executive support. The conversation should therefore move from "You need more security" to "Here is the exposure, here is the potential consequence, here are the available options, here is what each option costs, and here is what risk remains after implementation." That approach also changes how return on investment should be discussed. Security does not always generate a traditional revenue-producing return. Sometimes the return is a loss that never occurs. Sometimes it is reduced downtime. Sometimes it is avoided litigation expense. Sometimes it is faster recovery. Sometimes it is lower insurance exposure. Sometimes it is the ability to continue operating during a disruption. Measuring that value requires establishing what the organization was experiencing before the intervention and determining whether the condition improved afterward.



   This is why security consulting should not end when the report is delivered. A report identifies conditions at a particular point in time. Effective risk management requires follow-through. Were the recommendations implemented? Were they implemented correctly? Did the condition improve? Did the risk change? Did the corrective action create another operational problem? Did the threat environment change? Did the organization experience another incident that reveals something the original assessment missed? Without reassessment, organizations can spend money solving yesterday's problem while today's risk continues to develop.



   At Weedman & Co., this is where we see the relationship between security consulting and enterprise risk management. Security is one component of a larger business environment. Physical security, personnel, technology, compliance, supply chain, business continuity, crisis management, insurance, vendor management, and operational decision-making can all influence the same financial outcome. Looking at each area independently can cause organizations to miss the relationship between them. Looking at them together provides a much clearer picture of where risk is actually being created and where an investment may have the greatest effect.



   The most valuable security consultant is therefore not necessarily the person who recommends the most expensive security program. It is the professional who can determine what the organization actually needs, what it does not need, what it is currently doing poorly, what it is doing unnecessarily, and what consequences may result if the identified exposure remains unresolved. Sometimes that means recommending additional security. Sometimes it means eliminating unnecessary spending. Sometimes it means changing a process. Sometimes it means accepting a risk because the cost of reducing it exceeds the reasonably foreseeable benefit. Good risk management requires the ability to recognize all of those outcomes.



   Security consulting should ultimately be viewed as an investment in decision-making, not simply an expense for protection. Businesses cannot eliminate risk, and they should not attempt to eliminate every risk regardless of cost. They should understand their exposure, prioritize what matters, determine what level of risk is acceptable, and invest where the reduction in exposure justifies the cost. When that process is done correctly, the consultant is not simply selling security. The consultant is helping the organization protect revenue, reduce unnecessary loss, preserve operational capability, and make better decisions about where its resources should go.



   The question every executive and board should be asking is not simply, "How much will this security program cost?" The better question is, "What is the cost of the risk we are accepting, and what will it cost us if we are wrong?" That is where security becomes part of enterprise risk management, and that is where the conversation moves from security spending to business decision-making.


This article is intended for professional and educational discussion. Specific financial savings, liability outcomes, insurance effects, and return on investment will vary by organization and should be established through documented analysis rather than assumed in advance.



About The Author:


Joseph Weedman, B.A., FCP, SRMP-C is the Founder & CEO of Weedman & Co., with more than two decades of hands-on experience building and operating businesses across security, protective services, investigations, emergency response, and risk management. He holds a Bachelor of Arts in Security Management, is a Florida Certified CPTED Practitioner (FCP), and holds the SRMP-C professional designation. His background spans physical security, information security, school and campus security, industrial espionage, risk management, business operations, and crisis response. As an operator, business owner, and risk professional, Mr. Weedman brings practical field experience to Enterprise Risk Management (ERM), ESRM, operational risk, resilience, compliance, supply-chain risk, and business continuity. His work today focuses on connecting security, operations, compliance, resilience, and enterprise risk management to help organizations better understand and manage the risks that affect their business.

Understanding Risk Assessment and Risk Analysis

By site-qCMZqg • October 4, 2026
Risk assessment and risk analysis are terms often used interchangeably, but they are not the same thing. Both are fundamental to effective risk management, yet each serves a different purpose. A risk assessment establishes an understanding of an organization's exposure. Risk analysis goes deeper, examining why that exposure exists, what could cause an event, how likely it may be, what the consequences could be, and how existing safeguards influence the outcome. The distinction is important because collecting information about risk is not the same as understanding risk. Risk Assessment: Identifying the Exposure A risk assessment begins with understanding the environment being evaluated. What are the organization's critical assets? What operations are essential? Who has access? What threats exist? What vulnerabilities are present? What safeguards are already in place? What dependencies could create additional exposure? The purpose is to establish a meaningful picture of the organization's risk environment and identify conditions that require attention. A professional risk assessment should do more than create a list of deficiencies. A missing camera, inadequate lighting, unsecured door, outdated policy, single-source vendor, or lack of emergency planning may all be observations, but an observation alone does not establish the significance of the risk. The assessment establishes what is present, what is absent, and what conditions deserve further examination. Risk Analysis: Understanding What the Exposure Means Risk analysis takes the identified exposures and examines them more deeply. Why does the vulnerability exist? What conditions make an event more or less likely? What would happen if the event occurred? How quickly would the organization recognize it? What would happen after detection? What resources would be required to respond? What operations could be interrupted? What dependencies could increase the consequences? This is where professional judgment becomes particularly important. Risk analysis is not simply assigning a number to a spreadsheet. It is interpreting the available information and understanding how the individual pieces interact. A useful distinction is simple: risk assessment identifies and evaluates the exposure; risk analysis interprets the exposure and examines its potential consequences. A Finding Is Not the Same as a Risk Consider a parking area with inadequate lighting. The assessment may identify the lighting deficiency. The analysis asks what that deficiency actually means. Is the area used after dark? Who uses it? Does the lack of lighting create concealment? Does it interfere with surveillance? Is there a history of incidents? Are employees required to walk through the area? Are there other security measures that compensate for the deficiency? Does the condition create a meaningful opportunity for crime, injury, or another loss? The lighting condition is the observation. Understanding how that condition affects the organization is the analysis. This distinction is one of the reasons experienced risk professionals cannot rely entirely on checklists. A checklist can identify conditions. It cannot always determine their significance. Data Does Not Make the Decision Modern risk professionals have access to more information than ever before. Crime statistics, incident histories, insurance losses, environmental information, operational metrics, surveillance records, financial information, and other data can all contribute to a risk assessment. But data should inform professional judgment, not replace it. Data can be incomplete, outdated, improperly collected, manipulated, misunderstood, or disconnected from the specific environment being evaluated. A crime statistic for a geographic area does not automatically determine the risk at a particular property. A low number of historical incidents does not necessarily mean the environment has low exposure. Likewise, a high incident rate does not automatically tell a professional what intervention will be most effective. The professional's responsibility is to determine what the information actually means in context. This is where risk assessment becomes more than data collection. The ability to see the environment, understand the information, recognize its limitations, and interpret it against probability, impact, vulnerability, and consequence is what turns information into usable risk intelligence. Probability, Impact, and Vulnerability Probability and impact are two of the most commonly discussed components of risk, but they should not be viewed in isolation. A relatively unlikely event can still deserve significant attention if the consequences would be severe. Conversely, a frequent event may require a different response when its consequences are limited and manageable. Vulnerability adds another dimension. Two organizations can face the same threat but have completely different levels of risk because their environments, operations, safeguards, personnel, resources, and response capabilities are different. A facility with strong access management, effective surveillance, trained personnel, appropriate lighting, established emergency procedures, and reliable communications may be substantially more resilient than a similar facility without those capabilities. The question therefore should not simply be, "What is the threat?" It should also be, "How vulnerable are we to it, and what happens if our existing safeguards fail?" Existing Security Measures Must Be Evaluated for Function One of the most common weaknesses in risk assessments is treating the presence of a security measure as proof that the risk has been addressed. A camera is not automatically effective security because it exists. An alarm is not automatically protective because it is installed. A policy is not automatically effective because it is written. A security officer does not automatically reduce risk simply because someone is standing at a post. The professional must examine how the measure actually functions. Does the camera provide meaningful coverage? Can footage be retrieved when needed? Is the alarm monitored? Who responds when it activates? Is the policy understood and followed? Does the security officer have the training, authority, equipment, and procedures necessary to perform the assigned function? The difference between security presence and security performance is an important part of professional risk analysis. Quantitative and Qualitative Risk Analysis Quantitative analysis uses numerical information to help evaluate risk. Financial loss estimates, incident frequency, downtime, replacement costs, probability calculations, and other measurable variables can be useful when reliable information exists. More sophisticated techniques can also be used when the risk and available data justify them. However, numerical precision should not be confused with certainty. A calculation can produce a very precise number while still being based on uncertain assumptions. Qualitative analysis relies more heavily on professional judgment, observations, interviews, experience, scenario analysis, and environmental context. This can be particularly valuable when reliable numerical data is limited or when the risk involves complex human, operational, or environmental factors that cannot easily be reduced to a single number. Neither approach should automatically be considered superior. The appropriate approach depends on the risk, the quality of the available information, and the decision that needs to be made. Risk Matrices Are Tools, Not Answers Risk matrices can be useful for organizing information and communicating priorities. They provide a common framework for considering probability and impact and can help organizations determine where additional attention may be warranted. But the matrix itself does not perform the analysis. A risk labeled "high," "medium," or "low" should have reasoning behind that classification. Two organizations may reasonably classify the same condition differently because their assets, operations, vulnerabilities, consequences, and risk tolerances are different. The value is not the color on the matrix. The value is the professional reasoning that produced it. Residual Risk Is Part of the Decision Risk rarely disappears completely. Even after safeguards are implemented, some level of exposure usually remains. That remaining exposure is residual risk. A mature risk assessment should therefore identify not only the original exposure, but also what happens after mitigation is applied. What has been reduced? What remains? What has changed? What risk is the organization still accepting? This is especially important for executives and decision-makers. They need to understand not only what has been corrected, but what remains and why the organization has decided to live with it. Risk management is not necessarily about eliminating every possible risk. In many environments, that would be impossible, operationally impractical, or financially unreasonable. The objective is to make informed decisions about the risks an organization chooses to address, transfer, mitigate, or retain. From Assessment to Risk Management The ultimate purpose of risk assessment and risk analysis is not to produce a report. It is to improve decision-making. The findings should help determine whether additional resources are justified, whether an existing safeguard should be changed, whether an operation should be redesigned, whether a vulnerability should be accepted, whether additional protection is warranted, or whether a portion of the financial exposure should be transferred through insurance or another mechanism. This is where assessment and analysis become part of a larger enterprise risk-management process. The assessment establishes the environment. The analysis provides meaning and context. Risk treatment determines what should be done. Monitoring and reassessment determine whether those decisions continue to be appropriate as conditions change. The Weedman & Co. Perspective A strong assessment identifies the environment and the exposure. A strong analysis explains why the exposure matters, what conditions contribute to it, how existing safeguards affect it, what the potential consequences are, and what options are available. The professional's job is not simply to collect data and assign a score. It is to see the environment, understand the information, interpret it within the context of the organization, evaluate probability and impact, understand vulnerability, and determine what the risk actually means. That requires experience, critical thinking, technical knowledge, and professional judgment. Risk management is not about predicting the future with perfect accuracy. It is about making better decisions with the information available while recognizing what is known, what is uncertain, and what could happen if the assumptions are wrong. About The Author: Joseph Weedman, B.A., FCP, SRMP-C is the Founder & CEO of Weedman & Co., with more than two decades of hands-on experience building and operating businesses across security, protective services, investigations, emergency response, and risk management. He holds a Bachelor of Arts in Security Management, is a Florida Certified CPTED Practitioner (FCP), and holds the SRMP-C professional designation. His background spans physical security, information security, school and campus security, industrial espionage, risk management, business operations, and crisis response. As an operator, business owner, and risk professional, Mr. Weedman brings practical field experience to Enterprise Risk Management (ERM), ESRM, operational risk, resilience, compliance, supply-chain risk, and business continuity. His work today focuses on connecting security, operations, compliance, resilience, and enterprise risk management to help organizations better understand and manage the risks that affect their business.

The PACT Model: A New Era of Crime Prevention Through Integrated Risk Analysis

By site-qCMZqg • July 10, 2024
Weedman & Co.’s Proactive Analysis for Crime and Threats (P.A.C.T)

Why a Thorough CPTED Assessment Matters Under Florida Statute 768.0706

By site-qCMZqg • June 10, 2024
Florida Statute 768.0706 changed the conversation surrounding security assessments for qualifying multifamily residential properties. The statute establishes a presumption against liability in connection with certain criminal acts committed by third parties when the owner or principal operator substantially implements specified security measures and satisfies the statute's other requirements. One of those requirements is particularly important to the security profession: the property must have a Crime Prevention Through Environmental Design, or CPTED, assessment that is no more than three years old and that is performed by a law enforcement agency or a Florida CPTED Practitioner designated by the Florida Crime Prevention Training Institute of the Department of Legal Affairs. The owner or principal operator must also remain in substantial compliance with that assessment. That distinction matters because an assessment is not simply another document that gets placed in a property management file. When security documentation may later become relevant to a liability claim, the quality of the assessment, the qualifications of the person conducting it, the conditions documented during the assessment, and what the property does with the findings all become important. A security assessment should not merely state that a property has cameras, lighting, locks, gates, or access controls. It should establish what was actually observed, what was evaluated, what conditions existed at the time of the assessment, what deficiencies were identified, and what corrective actions may be necessary. The difference between checking a box and conducting a defensible assessment is substantial. Florida's statute is also more specific than the general concept of conducting a "security assessment." Section 768.0706 applies to a defined category of multifamily residential property: a residential building or group of residential buildings such as apartments, townhouses, or condominiums consisting of at least five dwelling units on a particular parcel. The statute then identifies specific security measures, including entry and exit camera systems that record and maintain retrievable footage for at least 30 days, specified parking-lot lighting, lighting in walkways and common areas, at least a one-inch deadbolt on each dwelling-unit door, locking devices on specified windows and doors, locked gates with key or fob access around pool areas, and peepholes or door viewers where applicable. The important lesson for security professionals is that the statute should not be treated as a checklist that automatically creates protection once someone signs an assessment. The statutory language uses the term “substantially implements,” and the owner or principal operator carries the burden of demonstrating substantial implementation of the specified security measures. The assessment is therefore part of a larger compliance picture. The professional needs to understand what the statute requires, what the property actually has, whether those measures are functioning as intended, whether the physical environment supports the intended security outcome, and whether the property remains substantially compliant over time. This is where CPTED becomes particularly important. CPTED is not simply an evaluation of whether a property has enough lights and cameras. The broader purpose of CPTED is to examine how the physical environment influences behavior, visibility, access, territorial definition, activity, and opportunity. A property can technically possess the required security devices while still presenting environmental conditions that create unnecessary opportunities for crime. A camera may be installed but positioned poorly. A light fixture may be operational but fail to illuminate the area where visibility is actually needed. Landscaping may obscure sightlines. A gate may exist but remain routinely unsecured. An access-control system may be installed but undermined by operational practices. A security assessment should therefore examine the relationship between the security measure and the environment in which that measure is expected to function. This is one of the biggest differences between a professional CPTED assessment and a basic property walkthrough. A walkthrough may identify what is present. A meaningful assessment asks whether what is present is actually accomplishing its intended purpose. That requires observation, verification, documentation, and professional judgment. It also requires the assessor to understand that security conditions are not static. Properties change. Tenants change. Employees change. Landscaping grows. Lighting fails. Cameras are repositioned. Gates are damaged. Access procedures evolve. Construction alters sightlines. Parking patterns change. New amenities are added. A property that was appropriately assessed three years ago may not present the same security environment today. The three-year assessment requirement therefore should not be misunderstood as meaning that a property only needs to think about security once every three years. The statute establishes that the CPTED assessment must be no more than three years old, while also requiring the owner or principal operator to remain in substantial compliance with the assessment. That creates an ongoing responsibility rather than a one-time paperwork exercise. A property manager who receives an assessment identifying a deficiency cannot reasonably treat the assessment as complete simply because the document has been filed. The more important question becomes what happened after the assessment. Was the deficiency corrected? Was the correction documented? Did the physical condition change? Did the corrective action actually resolve the identified issue? Documentation becomes particularly important here. A defensible assessment should allow another professional to understand what was examined and what was observed without relying entirely on the assessor's memory. Photographs, measurements where appropriate, descriptions of physical conditions, identification of access points, observations regarding lighting and visibility, documentation of security equipment, and explanations of identified deficiencies can all contribute to a stronger record. Documentation should describe the condition that actually existed rather than simply repeating what a property manager says should exist. There is a major difference between writing "security cameras are installed" and documenting where the cameras are located, what areas they cover, whether they are operational, whether footage is retrievable, and whether their placement supports the intended security function. This is particularly relevant to cameras because the statutory requirement is not merely the presence of a camera. For the specified entry and exit camera system, the statute addresses recording and maintaining retrievable footage for at least 30 days to assist in offender identification and apprehension. A camera that is physically mounted to a building but is not recording, cannot retrieve footage, does not cover the relevant entry or exit, or does not retain footage for the required period raises a very different compliance question than a properly functioning system. Lighting provides another useful example. Security professionals should be careful not to treat the existence of a light fixture as equivalent to adequate lighting. Section 768.0706 establishes a specific lighting requirement for parking lots and also addresses lighting in walkways, laundry rooms, common areas, and porches. A professional assessment should therefore distinguish between the presence of lighting equipment and the actual lighting condition of the environment. Dark areas, obstructed fixtures, failed lamps, poorly positioned lighting, or environmental conditions that create shadows can change the security characteristics of a property even when the property technically has lighting installed. The same principle applies to doors, windows, gates, and other access points. Security is not established merely because a lock exists. The assessor should consider whether the required locking device exists, whether it is functioning, whether the door or window can actually be secured, whether the access point is being routinely defeated by operational practices, and whether the physical environment creates another path around the intended security measure. This is where experienced assessment becomes more valuable than a simple inventory. The objective is not merely to identify security equipment. It is to understand whether the security architecture works as intended. The statute also addresses employee training. By January 1, 2025, qualifying owners or principal operators were required to provide proper crime-deterrence and safety training to current employees, and employees hired after that date must receive the training within 60 days of hire. The statute defines that training in relation to the security principles, devices, measures, and standards identified in the statute and requires the training to be reviewed at least every three years and updated as necessary. The owner or operator may request that the law enforcement agency or CPTED Practitioner conducting the assessment review the training curriculum. That provision reinforces another important security principle: technology and physical measures are only part of the security system. Employees interact with the environment every day. They open and close gates, issue credentials, observe suspicious behavior, receive visitors, respond to alarms, report maintenance problems, and make decisions that can either support or undermine the security design. A property can invest heavily in physical security and still create vulnerabilities through poor employee practices. Training therefore should not be treated as an administrative requirement disconnected from the physical assessment. The people operating the property are part of the security environment. From a Weedman & Co. perspective, this is where the assessment needs to move beyond compliance and into risk management. The question should not simply be, "Do we have the required device?" The better question is, "What risk is this measure intended to address, and is it functioning in the environment in which it was installed?" That distinction is important because security is rarely effective when it is designed around individual products instead of the relationship between the threat, the environment, the asset, the people, and the consequences of failure. A professional CPTED assessment should therefore identify the conditions that influence opportunity. Where are people expected to walk? Where are vehicles entering and leaving? Where are the blind spots? Where do residents gather? Where can someone approach a building without being observed? Which doors are routinely used? Which gates are frequently left open? Where does landscaping obstruct visibility? Where are lighting deficiencies located? Where does pedestrian movement intersect with vehicle movement? Where does normal resident behavior create predictable patterns? These questions help transform a security assessment from an equipment inventory into an analysis of the environment. This is also why the qualifications of the assessor matter. Section 768.0706 specifically identifies who may perform the CPTED assessment for purposes of the statute: a law enforcement agency or a Florida CPTED Practitioner designated by the Florida Crime Prevention Training Institute of the Department of Legal Affairs. The statute does not simply say that any security consultant may conduct the required assessment. For a property seeking to rely on the statutory presumption, understanding the statutory qualification requirement is essential. The legal significance should also be described accurately. Section 768.0706 does not create blanket immunity for multifamily properties. It establishes a presumption against liability when the statutory requirements are met, and the owner or principal operator bears the burden of demonstrating substantial implementation of the specified security measures. The statute also expressly states that it does not establish a private cause of action. Security professionals should therefore avoid promising property owners that an assessment will "prevent a lawsuit" or "eliminate liability." A professional assessment is not a legal guarantee. What it can do is provide documented evidence of the property's security condition and its efforts toward substantial compliance with the statutory framework. That distinction is especially important when attorneys become involved. In litigation, the question may not simply be whether an assessment exists. Questions can arise concerning when it was performed, who performed it, what was actually inspected, what conditions existed, whether the required security measures were implemented, whether deficiencies were identified, whether corrective actions were taken, and whether the property remained substantially compliant. The assessment therefore becomes part of a larger evidentiary record. The more accurately that record reflects the physical property and the actions taken by management, the more useful it can become to the organization and its legal and insurance professionals. This is where the concept of an Underwriting Defense Package or risk-engineering record can become valuable from an enterprise risk perspective. A property owner should not have to reconstruct its security history after an incident occurs. There should already be documentation showing what was assessed, what was found, what was corrected, what remained outstanding, who was responsible for corrective action, and when the condition was revisited. Security documentation becomes far more useful when it demonstrates a continuing process rather than a single inspection date. The same information can have value beyond litigation. Insurance professionals, risk managers, property managers, ownership groups, and corporate decision-makers increasingly need a better understanding of the conditions underlying a property's risk. A professional assessment can provide a common factual foundation for those conversations. It can identify conditions that require investment, distinguish operational deficiencies from physical deficiencies, and help management prioritize corrective action according to risk rather than simply reacting to whatever problem receives the most attention that week. The most important lesson is that a CPTED assessment should not be treated as a compliance document that is completed, signed, filed, and forgotten. It should be treated as a snapshot of the property's security environment and the beginning of a continuing process of verification and improvement. The assessment establishes what was observed. Management's actions afterward demonstrate what the organization did with that information. When those two pieces remain connected, the assessment becomes much more meaningful. Florida Statute 768.0706 gives qualifying multifamily property owners and operators a specific statutory framework for establishing a presumption against liability when the required security measures and assessment requirements are substantially implemented. But the strength of that position depends on more than possessing a document with "CPTED Assessment" written across the top. It depends on whether the property actually implements the applicable security measures, whether the assessment accurately reflects the property, whether deficiencies are addressed, and whether the organization can demonstrate what it did with the information it received. For security professionals, that should be the larger takeaway. An assessment is not valuable because it says a property is secure. It is valuable because it documents what was actually examined, identifies what was found, explains why it matters, and creates a defensible record of what should happen next. The professional's job is not to make a property appear secure on paper. It is to help the owner understand the actual security environment and make informed decisions about risk. At Weedman & Co., we believe that is where CPTED becomes more than a compliance exercise. It becomes part of a broader enterprise risk-management process that connects physical security, property operations, employee practices, liability exposure, insurance considerations, business continuity, and corrective action. Security was the foundation. Global ERM is where we are today. This article is intended for educational and professional discussion and is not legal advice. Florida Statute 768.0706 should be reviewed in its current form, and property owners should consult qualified legal counsel regarding the application of the statute to their specific circumstances. Current statutory reference: Florida Statute §768.0706, Multifamily residential property safety and security; presumption against liability. About The Author: Joseph Weedman, B.A., FCP, SRMP-C is the Founder & CEO of Weedman & Co., with more than two decades of hands-on experience building and operating businesses across security, protective services, investigations, emergency response, and risk management. He holds a Bachelor of Arts in Security Management, is a Florida Certified CPTED Practitioner (FCP), and holds the SRMP-C professional designation. His background spans physical security, information security, school and campus security, industrial espionage, risk management, business operations, and crisis response. As an operator, business owner, and risk professional, Mr. Weedman brings practical field experience to Enterprise Risk Management (ERM), ESRM, operational risk, resilience, compliance, supply-chain risk, and business continuity. His work today focuses on connecting security, operations, compliance, resilience, and enterprise risk management to help organizations better understand and manage the risks that affect their business.